legionlocker | 58f943a9d654185d8170fa9027aeea648435eeae44848e6495687a73e21cba33

Analysis

max time kernel
68s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2024 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RNSM00455.7z
Size

115.6MB
MD5

5113b2777400798e5429dc13f8efd1a7
SHA1

42d62e59ba8591948af568a45c81932f1ca52e36
SHA256

58f943a9d654185d8170fa9027aeea648435eeae44848e6495687a73e21cba33
SHA512

a9c64b71594e0a198189311fee6a8408c0e4b42fa8cf0c3059f10ddd0ed891ce7fcf2f72f83547caa17054780aa2b5e38fa0b1daa9d48c92540fc4ae01e66c48
SSDEEP

3145728:ijuQ5KJQMrXnEjLrFwymSPaesQzs6KcYCww/8pBJ0YJECvMnwnFWhH3q:ii0wnrEjLrFCSPaet4SYCLEpB2SECEw1

Score

10^/10

legionlocker njrat us account agilenet defense_evasion discovery evasion execution exploit persistence ransomware spyware stealer trojan upx vmprotect

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

US ACCOUNT

212.7.208.123:6020

Mutex

93f19dda2412c86ad7520ba4198f39a0

Attributes

reg_key
93f19dda2412c86ad7520ba4198f39a0
splitter
|'|'|

Extracted

Path

C:\Users\Admin\Desktop\LegionReadMe.txt

Ransom Note

Ooops! All your important files are encrypted! What happend to my computer? All your important files are encrypted. No one can help you to restore files without our special decryptor Backups were either encrypted or deleted. Shadow copies also removed. If you want to restore some of your files for free write to email (contact is below) and attach 2-3 encrypted files. You will receive decrypted samples. To decrypt other files you have to pay $50. How do i pay? Payment is accepted in Bitcoin only. Please check the current price of Bitcoin and buy some Bitcoins. And send the correct amount to the address specified at the bottom of the sheet. Contact: 1.Download Tor browser (https://www.torproject.org/) 2.Create account on mail2tor (http://mail2tor2zyjdctd.onion/) 3.Write email to us ([email protected]) In case of no anwser in 72 hours write us to this email: [email protected] What if i already paid? Send your Bitcoin wallet ID to e-mail provided above. Attention! 1.Do not modify encrypted files. 2.Do not try decrypt your data using third party software, it may cause pernament data loss. Our Bitcoin address: 131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

Emails

[email protected]

Wallets

131fjhrB4wH8j6adZXudp1Wn23pR33tpAh

URLs

http://mail2tor2zyjdctd.onion/

Signatures

Detected LegionLocker ransomware 1 IoCs

Sample contains strings associated with the LegionLocker family.

ransomware

resource	yara_rule
behavioral1/files/0x0007000000023cca-398.dat	family_legionlocker

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
LegionLocker
Ransomware family active in 2021.
ransomware legionlocker
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/4080-309-0x0000000007370000-0x0000000007406000-memory.dmp	Nirsoft

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/4080-309-0x0000000007370000-0x0000000007406000-memory.dmp	WebBrowserPassView

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3000	netsh.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1796	takeown.exe
2388	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	winlogon.exe

Executes dropped EXE 11 IoCs

pid	Process
652	HEUR-Trojan-Ransom.MSIL.Blocker.gen-0676494ba8bcb15b745317710eceb44292abc0aa70bb7db9026e4351791ff29b.exe
2588	HEUR-Trojan-Ransom.MSIL.Blocker.gen-393ef769e50c4a21376a34250e41f310536c73d073e2abd7c87bf55b28564fe5.exe
3396	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe
5084	HEUR-Trojan-Ransom.MSIL.Blocker.gen-9919f28be513382d62605a9f2dd1b3134d88d9d7282ae134a28ee8c3131f6d16.exe
4212	HEUR-Trojan-Ransom.MSIL.Blocker.gen-bd50c00f8a2edeb99f8f7a41da3fdd5f4921d58c8c4ba80f583830e3782e4f30.exe
548	HEUR-Trojan-Ransom.MSIL.Blocker.gen-f7c70400a9d763ae8e2c9c4f0474827ccceea245cde3c1ce03b91d77b1b05725.exe
1840	winlogon.exe
4080	HEUR-Trojan-Ransom.MSIL.Blocker.gen-fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a.exe
4928	HEUR-Trojan-Ransom.MSIL.Encoder.gen-2eafbf195ee3064026099a6f5f6c78aaaae170c9fb81a5f49f501bf0f061cfd4.exe
3388	HEUR-Trojan-Ransom.MSIL.Encoder.gen-a7feee63c2aa57d79479cba581d45176e7d2fba293a3754cbdc0aa174e58f37d.exe
4020	HEUR-Trojan-Ransom.MSIL.Encoder.gen-adf700068c099d450f2328590a02b675b1908c3a6e3d77c8abfa36a0d7625fde.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1796	takeown.exe
2388	icacls.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/548-541-0x0000000006850000-0x0000000006878000-memory.dmp	agile_net

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0007000000023cc5-302.dat	vmprotect
behavioral1/memory/4080-303-0x0000000000310000-0x00000000005CA000-memory.dmp	vmprotect
behavioral1/files/0x0007000000023cc5-301.dat	vmprotect
behavioral1/files/0x0007000000023d45-317.dat	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysnet = "C:\\Users\\Admin\\AppData\\Local\\sysnetwin.exe"	HEUR-Trojan-Ransom.MSIL.Blocker.gen-fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5148	powershell.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000023ccd-791.dat	upx
behavioral1/memory/2328-810-0x0000000000400000-0x00000000005BB000-memory.dmp	upx
behavioral1/files/0x0009000000023d75-1005.dat	upx
behavioral1/memory/2328-1481-0x0000000000400000-0x00000000005BB000-memory.dmp	upx

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
8004	sc.exe
7552	sc.exe
7572	sc.exe
5740	sc.exe
5356	sc.exe
5484	sc.exe
5596	sc.exe
7016	sc.exe
2192	sc.exe
5204	sc.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe:ZONE.identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2552	4080	WerFault.exe	104
4516	1840	WerFault.exe	129

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winlogon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Blocker.gen-fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Encoder.gen-a7feee63c2aa57d79479cba581d45176e7d2fba293a3754cbdc0aa174e58f37d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Blocker.gen-393ef769e50c4a21376a34250e41f310536c73d073e2abd7c87bf55b28564fe5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Blocker.gen-f7c70400a9d763ae8e2c9c4f0474827ccceea245cde3c1ce03b91d77b1b05725.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2000	taskkill.exe
4728	taskkill.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe:ZONE.identifier	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Windows\explorer\winlogon.exe\:ZONE.identifier:$DATA	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2888	powershell.exe
2888	powershell.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
900	7zFM.exe
2280	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeRestorePrivilege	900	7zFM.exe
Token: 35	900	7zFM.exe
Token: SeSecurityPrivilege	900	7zFM.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	4484	taskmgr.exe
Token: SeSystemProfilePrivilege	4484	taskmgr.exe
Token: SeCreateGlobalPrivilege	4484	taskmgr.exe
Token: SeDebugPrivilege	2280	taskmgr.exe
Token: SeSystemProfilePrivilege	2280	taskmgr.exe
Token: SeCreateGlobalPrivilege	2280	taskmgr.exe
Token: 33	4484	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4484	taskmgr.exe
Token: SeDebugPrivilege	5084	HEUR-Trojan-Ransom.MSIL.Blocker.gen-9919f28be513382d62605a9f2dd1b3134d88d9d7282ae134a28ee8c3131f6d16.exe
Token: SeDebugPrivilege	2588	HEUR-Trojan-Ransom.MSIL.Blocker.gen-393ef769e50c4a21376a34250e41f310536c73d073e2abd7c87bf55b28564fe5.exe
Token: SeDebugPrivilege	548	HEUR-Trojan-Ransom.MSIL.Blocker.gen-f7c70400a9d763ae8e2c9c4f0474827ccceea245cde3c1ce03b91d77b1b05725.exe
Token: SeDebugPrivilege	4080	HEUR-Trojan-Ransom.MSIL.Blocker.gen-fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
900	7zFM.exe
900	7zFM.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
4484	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe
2280	taskmgr.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 2280	4484	taskmgr.exe	91
PID 4484 wrote to memory of 2280	4484	taskmgr.exe	91
PID 2888 wrote to memory of 4292	2888	powershell.exe	95
PID 2888 wrote to memory of 4292	2888	powershell.exe	95
PID 4292 wrote to memory of 652	4292	cmd.exe	96
PID 4292 wrote to memory of 652	4292	cmd.exe	96
PID 4292 wrote to memory of 2588	4292	cmd.exe	97
PID 4292 wrote to memory of 2588	4292	cmd.exe	97
PID 4292 wrote to memory of 2588	4292	cmd.exe	97
PID 4292 wrote to memory of 3396	4292	cmd.exe	98
PID 4292 wrote to memory of 3396	4292	cmd.exe	98
PID 4292 wrote to memory of 3396	4292	cmd.exe	98
PID 4292 wrote to memory of 5084	4292	cmd.exe	99
PID 4292 wrote to memory of 5084	4292	cmd.exe	99
PID 4292 wrote to memory of 4212	4292	cmd.exe	100
PID 4292 wrote to memory of 4212	4292	cmd.exe	100
PID 4292 wrote to memory of 548	4292	cmd.exe	101
PID 4292 wrote to memory of 548	4292	cmd.exe	101
PID 4292 wrote to memory of 548	4292	cmd.exe	101
PID 3396 wrote to memory of 2604	3396	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe	121
PID 3396 wrote to memory of 2604	3396	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe	121
PID 3396 wrote to memory of 2604	3396	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe	121
PID 3396 wrote to memory of 1840	3396	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe	129
PID 3396 wrote to memory of 1840	3396	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe	129
PID 3396 wrote to memory of 1840	3396	HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe	129
PID 4292 wrote to memory of 4080	4292	cmd.exe	104
PID 4292 wrote to memory of 4080	4292	cmd.exe	104
PID 4292 wrote to memory of 4080	4292	cmd.exe	104
PID 4292 wrote to memory of 4928	4292	cmd.exe	108
PID 4292 wrote to memory of 4928	4292	cmd.exe	108
PID 1840 wrote to memory of 1568	1840	winlogon.exe	110
PID 1840 wrote to memory of 1568	1840	winlogon.exe	110
PID 1840 wrote to memory of 1568	1840	winlogon.exe	110
PID 4292 wrote to memory of 3388	4292	cmd.exe	113
PID 4292 wrote to memory of 3388	4292	cmd.exe	113
PID 4292 wrote to memory of 3388	4292	cmd.exe	113
PID 4292 wrote to memory of 4020	4292	cmd.exe	114
PID 4292 wrote to memory of 4020	4292	cmd.exe	114
PID 4292 wrote to memory of 4020	4292	cmd.exe	114

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00455.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0676494ba8bcb15b745317710eceb44292abc0aa70bb7db9026e4351791ff29b.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-0676494ba8bcb15b745317710eceb44292abc0aa70bb7db9026e4351791ff29b.exe
    3⤵
    - Executes dropped EXE
    PID:652
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-393ef769e50c4a21376a34250e41f310536c73d073e2abd7c87bf55b28564fe5.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-393ef769e50c4a21376a34250e41f310536c73d073e2abd7c87bf55b28564fe5.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2588
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe":ZONE.identifier & exit
      4⤵
      Subvert Trust Controls: Mark-of-the-Web Bypass
      System Location Discovery: System Language Discovery
      NTFS ADS
      PID:2604
  - - C:\Users\Admin\AppData\Roaming\Windows\explorer\winlogon.exe
      "C:\Users\Admin\AppData\Roaming\Windows\explorer\winlogon.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\Users\Admin\AppData\Roaming\Windows\explorer\winlogon.exe":ZONE.identifier & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
    - - C:\Users\Admin\AppData\Roaming\Windows\explorer\winlogon.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows\explorer\winlogon.exe"
        5⤵
        
        PID:1580
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Windows\explorer\winlogon.exe" "winlogon.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        
        PID:3000
    - - C:\Users\Admin\AppData\Roaming\Windows\explorer\csrss.exe
        
        "C:\Users\Admin\AppData\Roaming\Windows\explorer\csrss.exe" -reg C:\Users\Admin\AppData\Roaming\Windows\explorer\winlogon.exe
        5⤵
        
        PID:2432
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-9919f28be513382d62605a9f2dd1b3134d88d9d7282ae134a28ee8c3131f6d16.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-9919f28be513382d62605a9f2dd1b3134d88d9d7282ae134a28ee8c3131f6d16.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-bd50c00f8a2edeb99f8f7a41da3fdd5f4921d58c8c4ba80f583830e3782e4f30.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-bd50c00f8a2edeb99f8f7a41da3fdd5f4921d58c8c4ba80f583830e3782e4f30.exe
    3⤵
    - Executes dropped EXE
    PID:4212
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-f7c70400a9d763ae8e2c9c4f0474827ccceea245cde3c1ce03b91d77b1b05725.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-f7c70400a9d763ae8e2c9c4f0474827ccceea245cde3c1ce03b91d77b1b05725.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1904
      4⤵
      Program crash
      PID:2552
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-2eafbf195ee3064026099a6f5f6c78aaaae170c9fb81a5f49f501bf0f061cfd4.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-2eafbf195ee3064026099a6f5f6c78aaaae170c9fb81a5f49f501bf0f061cfd4.exe
    3⤵
    - Executes dropped EXE
    PID:4928
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4h31xu21\4h31xu21.cmdline"
      4⤵
      PID:1676
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC46.tmp" "c:\Users\Admin\AppData\Local\Temp\4h31xu21\CSC44423428B07F4E1EAB2B7FE9A3BCA379.TMP"
        5⤵
        
        PID:4992
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM Raccine.exe
      4⤵
      Kills process with taskkill
      PID:2000
  - - C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM RaccineSettings.exe
      4⤵
      Kills process with taskkill
      PID:4728
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /DELETE /TN "Raccine Rules Updater" /F
      4⤵
      PID:2128
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SQLTELEMETRY start= disabled
      4⤵
      Launches sc.exe
      PID:5204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-CimInstance Win32_ShadowCopy | Remove-CimInstance
      4⤵
      PID:5292
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
      4⤵
      Launches sc.exe
      PID:5356
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SQLWriter start= disabled
      4⤵
      Launches sc.exe
      PID:5484
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SstpSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5596
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config MBAMService start= disabled
      4⤵
      Launches sc.exe
      PID:5740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5148
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
      4⤵
      PID:7184
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c rd /s /q D:\\$Recycle.bin
      4⤵
      PID:6104
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config fdPHost start= auto
      4⤵
      Launches sc.exe
      PID:8004
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config Dnscache start= auto
      4⤵
      Launches sc.exe
      PID:2192
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config FDResPub start= auto
      4⤵
      Launches sc.exe
      PID:7016
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SSDPSRV start= auto
      4⤵
      Launches sc.exe
      PID:7552
  - - C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config upnphost start= auto
      4⤵
      Launches sc.exe
      PID:7572
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-a7feee63c2aa57d79479cba581d45176e7d2fba293a3754cbdc0aa174e58f37d.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-a7feee63c2aa57d79479cba581d45176e7d2fba293a3754cbdc0aa174e58f37d.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3388
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"
      4⤵
      PID:2160
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1796
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32 /grant "Admin:F"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2388
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-adf700068c099d450f2328590a02b675b1908c3a6e3d77c8abfa36a0d7625fde.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-adf700068c099d450f2328590a02b675b1908c3a6e3d77c8abfa36a0d7625fde.exe
    3⤵
    - Executes dropped EXE
    PID:4020
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-c1c6b26201dc36e2d18c626b280b130745c198aa5b5742554107cba8122dfe1e.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-c1c6b26201dc36e2d18c626b280b130745c198aa5b5742554107cba8122dfe1e.exe
    3⤵
    PID:1848
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn PolicyUpdate /tr "C:\Users\Admin\AppData\Roaming\System.exe -silent"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1592
  - - C:\Users\Admin\AppData\Roaming\System.exe
      "C:\Users\Admin\AppData\Roaming\System.exe" -regedit
      4⤵
      PID:1840
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 1520
        5⤵
        Program crash
        
        PID:4516
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5.exe
    HEUR-Trojan-Ransom.MSIL.Encoder.gen-d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5.exe
    3⤵
    PID:3484
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Gen.gen-2cff240d188e36ab237b48a9ab08a2ce88757541ccae28b5cbbb73ea6ce90f05.exe
    HEUR-Trojan-Ransom.MSIL.Gen.gen-2cff240d188e36ab237b48a9ab08a2ce88757541ccae28b5cbbb73ea6ce90f05.exe
    3⤵
    PID:4824
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.Win32.Agent.gen-880b7bfbf9e73719ed8edcb047a5a2e7c860f43a60247fc9880fb9aa4b40bf4c.exe
    HEUR-Trojan-Ransom.Win32.Agent.gen-880b7bfbf9e73719ed8edcb047a5a2e7c860f43a60247fc9880fb9aa4b40bf4c.exe
    3⤵
    PID:4340
- - C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-d1a3a6a4b1da349f6603663e126aa53756cabca221117d30e69ae0cb9bf41108.exe
    HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-d1a3a6a4b1da349f6603663e126aa53756cabca221117d30e69ae0cb9bf41108.exe
    3⤵
    PID:2328

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 132 -p 4080 -ip 4080
1⤵
PID:2604

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:5048

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1840 -ip 1840
1⤵
PID:4792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:7684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
PID:7692

C:\Users\Admin\AppData\Roaming\System.exe
C:\Users\Admin\AppData\Roaming\System.exe -silent
1⤵
PID:4732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s FDResPub
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\7-zip.chm.exe

Filesize
1.8MB

MD5
12e13adc6936218011ad935d27f8ded3

SHA1
811279a09b0340a603e3c0fde5c700fa433b623e

SHA256
a8133ccf506340c9e8f6231622b32878c5cf7af58fc18d0893c7c952c356e5c6

SHA512
ded86f2a4c41296ef97e632336d7b7641d98950989dfb7b92c788633b8bbf2a3de8e43a9979fd301767dd0feaf31bf952bcefee37e38fb1c59244513fac0ee1f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zE483DB0E7\00455\HEUR-Trojan.Win32.Crypt.gen-f78c68ca7f8656acb436074abe7c464c30ead1bac6302a08531cf491a5ac6447.exe

Filesize
2.6MB

MD5
01380bc5f904c3a49ce6e736c86ea018

SHA1
bdf66c80f433ac6e64b3c63320349ae04e531047

SHA256
f78c68ca7f8656acb436074abe7c464c30ead1bac6302a08531cf491a5ac6447

SHA512
22ec26594b79ea992e514b5a71f88c89fb59a131989b1a140662ca585392db9153645052622f1a638888a014d13033221abdfe5621e51b1066a965535b12fd7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ibtov4be.e5q.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\sysnetwin.exe

Filesize
28.2MB

MD5
a29b8ccab47072f1589c663dda1d979f

SHA1
453d8e41a699ad3a2b2bf89ab1599e4ac2208f7e

SHA256
fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a

SHA512
16a9fa62fc454f470c71ff44818dfcada75748bbddbcaecd72e1954c84a2665bfc5180cad6b2f4a09c7a21736dacf1e90f49b6dbacbfead8b184db48752260b6

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\explorer\csrss.exe:ZONE.identifier

Filesize
28B

MD5
90fd34c6bd120fb6d41d18161a05296b

SHA1
346e55ea4c486d9f4ac7e65793c34fc18e5a28b1

SHA256
53c9dbb7d60a9fd6c12d2580557472f0132cc26c055e2e841b455be1b8713695

SHA512
74a0d8a648267a6c2a31cecd076a3d30d59951ca3e00b8e2e0a935a709cd105c6a8da2da6988f4c3bbef13aea3ad9a805547e8373e57a471d1f794db4ca4709e

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0676494ba8bcb15b745317710eceb44292abc0aa70bb7db9026e4351791ff29b.exe

Filesize
6.4MB

MD5
9f1332f7bbfe8172cd6056f6ae2668a0

SHA1
494a1eb33b5974a135e6532be6f6dfc5d57299af

SHA256
0676494ba8bcb15b745317710eceb44292abc0aa70bb7db9026e4351791ff29b

SHA512
b84ee634a18719621d3112500ef08a6778ee41cb32c8ee02e81bec00aaff48ec58460185bee8e404a6f3ecaccb1f37fb2b708e8914198ed573fbc418b866774a

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-393ef769e50c4a21376a34250e41f310536c73d073e2abd7c87bf55b28564fe5.exe

Filesize
408KB

MD5
2d4d15ab8a44fed07548ab0f06e9bd77

SHA1
0db3a2224b7f75520da02a1d3dbdd89399ff8acf

SHA256
393ef769e50c4a21376a34250e41f310536c73d073e2abd7c87bf55b28564fe5

SHA512
ef025455f2912914f9014aded00f1e6fbf85bfa51883428343815871de82d15c41599ffc360e662f0d27d65a7e84ba0f33fe28c031855c11c1b6e3c7a0088312

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe

Filesize
148KB

MD5
0607dcb78849fc2437a923136be8e45c

SHA1
3d35617d8ce2b02b583e0f1555d10c9fbb5d5b3f

SHA256
62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d

SHA512
caf9be027ec2e21c9c4ff689ce13405fa8c27c9c204ec5dc42afa48effd37167268db170e3f8ab39acd8cf5570fd6c3bc88fd1e633e00144e8498c00181c28dc

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-62813c4c155e309d7fe5725b11262f6e5273cab524dd6d1dba2790c224ef435d.exe

Filesize
148KB

MD5
43ea88a5b432f274ee28d20d11e9c082

SHA1
76f0abe312c5944734b7e6735c4d65b01610f22e

SHA256
a83d993473cd911f0a2e5bcd50d51f0c1016f0287ad535acb61a10b5dab14a52

SHA512
24ff75b2da2658241eaf2455bd50c7b6789bb10d0adcb6ec3a97268e5be6e6644b35324ef5d0884abaaa4be47d53fb1a9160161e0324e84c2c0230640888f029

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-9919f28be513382d62605a9f2dd1b3134d88d9d7282ae134a28ee8c3131f6d16.exe

Filesize
2.0MB

MD5
9af6873db9d304b9be69268ba120deba

SHA1
c9aa98833e80811a28028cc06f3a25d62f5466f9

SHA256
9919f28be513382d62605a9f2dd1b3134d88d9d7282ae134a28ee8c3131f6d16

SHA512
7daa5a3e175e86ff3512b4e2ae3c290fa245e409fd3c4290ce82e4e532ccdf0be71c2ad85e37f8e2e668a013e75fe7baad4b5163d28eac75aade0dc743a42abb

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-9919f28be513382d62605a9f2dd1b3134d88d9d7282ae134a28ee8c3131f6d16.exe

Filesize
2.0MB

MD5
84687838c1b7e471a5ae46c40d8aad9a

SHA1
cce7294a3bd5f8b66b2a10c665f43d02c0bc901a

SHA256
420793bacbee4bf0035e5979d5374bb4291125a20a3aa5c331bfe297023f7634

SHA512
372eb428fc82029e41fa75ebd7f24908ceeced39318904c174cc0b357d8d485224bcd6f0b51e5cc2fb5666a80a2d88abd468ede32b6daed78e436a8657a12186

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-bd50c00f8a2edeb99f8f7a41da3fdd5f4921d58c8c4ba80f583830e3782e4f30.exe

Filesize
6.4MB

MD5
4f68ab8dd327d3e9787d775196232698

SHA1
97cfc93709a56a85074efc275da231e86a4f8cc3

SHA256
bd50c00f8a2edeb99f8f7a41da3fdd5f4921d58c8c4ba80f583830e3782e4f30

SHA512
d47c0a833f0407436e7b031001fe87dabe092a8b58575bdec8367b8ec83e9276281d281959b304710d891571499b811c5178cf2c6951672e1c257a85a9372623

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-f7c70400a9d763ae8e2c9c4f0474827ccceea245cde3c1ce03b91d77b1b05725.exe

Filesize
409KB

MD5
29eb300b5971c2e0515ff659812e2371

SHA1
c7ae86671fb3ca25aa64204181f464e7d76e7a58

SHA256
f7c70400a9d763ae8e2c9c4f0474827ccceea245cde3c1ce03b91d77b1b05725

SHA512
eddf934fee213d24d3cc0affddf19441ef9186c290fab340ab9c6021de85436bc2516daeac4dcc47c8cbbb7bb6d8b80940706b86fd623760b886e08ac3ef98e9

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a.exe

Filesize
7.9MB

MD5
7ef698c47072c8e2fabaab2c2e38e645

SHA1
af63af15110444a3f0ef8fe46040eace5904635b

SHA256
a79990960bec846b50c26c0306fe547886e82a6720cfff60473241442e476f44

SHA512
d72949ae0091f2aa25f6fb903532c98a595c9b124daf186f7c1bb344ae2a561f09f0ebfac1a66898eb8a475e4339296f9e2e05ef059fb4cf1ed583a8f165029e

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a.exe

Filesize
9.1MB

MD5
aa420bd587eeea6c7eb6af04bf88172f

SHA1
d09c09ffe7ea2abc017f22c429c54d6145bb2e7c

SHA256
d5c213c99d1206bc90a19a51c23caf0c8d9b4c784df395330c853f5ad026b7c9

SHA512
41180d81f7c1c5f907e032a42f036ac29049b7332520d99601f5219746a04f959217bd1217e2fbae744d2f90d50eb847f3c5be42df538be90c6b295e19f6d197

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fdf24fde6e4d1dcc6d20c8ce3f9b2c60d0933c26caae4537b75da04d6d6e119a.exe

Filesize
28.2MB

MD5
64dacf4bd30de6ac17430c5875d4ad7e

SHA1
7f57bb9b4c89d51975e0fc2ed2e35ac979b8380d

SHA256
bfdab54240bc3829c74e757c76e98ffa69d0f50c494642922decf1c9a2045518

SHA512
9947112b49e41add1cc3814a7a3c18ecc5cd345ad85451b8fbafce24556ea5eeb909cbe9ac966aaae2f9873b1ebadf0c5ecb6ba7a2ecb65b88ffbb559d23597e

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-2eafbf195ee3064026099a6f5f6c78aaaae170c9fb81a5f49f501bf0f061cfd4.exe

Filesize
180KB

MD5
e13bb800a53131521f2c6ed5e924576f

SHA1
9f1688c34ef4f64770e471c1703ce9095c880c0f

SHA256
2eafbf195ee3064026099a6f5f6c78aaaae170c9fb81a5f49f501bf0f061cfd4

SHA512
94eba4206c3bea25f383382f6cd893ecc9fb4dd3d5f9c224ef1b8c3d10e96501584392552553b54796afd87c8f0c09e97b2f3f4b65e3847380d93f721e62d484

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-a7feee63c2aa57d79479cba581d45176e7d2fba293a3754cbdc0aa174e58f37d.exe

Filesize
81KB

MD5
258a5d28d5656b40a77e31ba3635a933

SHA1
ca4fa85484e40bbd4f5acad0645ea6dabd4e20bf

SHA256
a7feee63c2aa57d79479cba581d45176e7d2fba293a3754cbdc0aa174e58f37d

SHA512
b30a41e02fe00ca5fdeddf02bbef0a9e5711fd67173dda4f9d332a76db10ecb521cf3e8130dcabca0ae64f219f261a352a7bff825ae1c59826bbde7dc8c2ba37

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-adf700068c099d450f2328590a02b675b1908c3a6e3d77c8abfa36a0d7625fde.exe

Filesize
79KB

MD5
175fd6d766996e5d472b58af0a30f0d0

SHA1
aa9065e69b91828c27917193fdc7f2f9327c5dc6

SHA256
adf700068c099d450f2328590a02b675b1908c3a6e3d77c8abfa36a0d7625fde

SHA512
66b01e6560022f6df06878916220f44645d93bfe68ed2e68529429a9faf4cc06612142c5db24bb3f66e1144c9f06ab8dee6f5ff21d9731c6129e5cc49d0d1b72

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-c1c6b26201dc36e2d18c626b280b130745c198aa5b5742554107cba8122dfe1e.exe

Filesize
266KB

MD5
499e480b66f10fa64ea7091400630892

SHA1
dfc01c5f83c216d2d1916a52a727d4fbdb465505

SHA256
c1c6b26201dc36e2d18c626b280b130745c198aa5b5742554107cba8122dfe1e

SHA512
6f01a3611f6dd30a481649f3d7bf539a8fc8fa25a7f607887f0cf76b5808aecb24bc64df1f17e22e122c300d55b12b6f36c0e085a24710311ecaf291d4e19168

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Encoder.gen-d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5.exe

Filesize
50KB

MD5
38e37cf8e2d5c41a849ef6c41f183dc3

SHA1
b3a1ebb4788e7925934299669806552a92c5c78f

SHA256
d8784f71e2b19bc6750598f8cdebd6100add67bc8ca727aeee905d101abf77a5

SHA512
82b3d3d7208fc8608e3d656d6c803e674118eb13b3f79ae0e82d962a54ea71b839bb96c69eb85ee92608327098daf226fdf4ebb06f0606c7cb7975d4135dfac4

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Gen.gen-2cff240d188e36ab237b48a9ab08a2ce88757541ccae28b5cbbb73ea6ce90f05.exe

Filesize
71KB

MD5
22a7bedfbd506feb6858389786f179a5

SHA1
00bb6b60158b5b777a13030ef90474aed28016ad

SHA256
2cff240d188e36ab237b48a9ab08a2ce88757541ccae28b5cbbb73ea6ce90f05

SHA512
09cef5a329748df02d73c1d73af350d68e256059337d33b14eca93b6d16fe3f2c8a2b161cb66c87bc7a4834bf9c6351e24aafbdc29949ff0126b457aedcfb55f

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.MSIL.Thanos.gen-a8d8d3171ceed7180259d95682130a8c3ab05b1e7b4d42ee31bbb53194ca9d5a.exe

Filesize
120KB

MD5
f2187e2e343f53e341caebc3e700741d

SHA1
6e41d22d7ea47a470c462ba438bf5c1327a58332

SHA256
a8d8d3171ceed7180259d95682130a8c3ab05b1e7b4d42ee31bbb53194ca9d5a

SHA512
0df5a69aa47c49211d011d8cb23ae1edf70f2e553dae2e881c6bf021252aff9407458cbc5070df4c983d60b8c1caa436709199af14f58d2605b7dc701f2f7718

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.Win32.Agent.gen-880b7bfbf9e73719ed8edcb047a5a2e7c860f43a60247fc9880fb9aa4b40bf4c.exe

Filesize
2.0MB

MD5
01c80fce0ee7f3d0b60e17dd466860af

SHA1
0751da18f572d842f57413f3d3ed884c36796edc

SHA256
880b7bfbf9e73719ed8edcb047a5a2e7c860f43a60247fc9880fb9aa4b40bf4c

SHA512
4cdf373f488702499c5b1e9c080868ab933f9eb1b591361dae4272426dc5b7936e732564958ab4ab858a617ad990b119c67ffbe4565eaf096dd64b37163634cc

Download Submit
C:\Users\Admin\Desktop\00455\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-d1a3a6a4b1da349f6603663e126aa53756cabca221117d30e69ae0cb9bf41108.exe

Filesize
1.8MB

MD5
61053e43dfea4a49e94fdacbcfb37c6b

SHA1
8977967fbd67642a9649acc233d5feb7dbae1d82

SHA256
d1a3a6a4b1da349f6603663e126aa53756cabca221117d30e69ae0cb9bf41108

SHA512
e6f9b4dbf9a92584c4da874421707dc96138f6f7a20c4dd9a1ec087cb184d77c46365e8c58d7001aa6dfa73ae7918797b3b2ec4e5eff740bf5316f9c1ca6b16a

Download Submit
C:\Users\Admin\Desktop\CheckpointUnblock.ogg

Filesize
978KB

MD5
b6b621f121a026c83ac037ac6cd62ed4

SHA1
e26f315bf62fbb9d50509d619c9302a1970e74e6

SHA256
892225e6ec69626eab57fe7ae9077885d5e8c42d7e3b8c01f0a853d790a17d18

SHA512
d349520e711dcee64e6e77ad89a70f5a282c1cefffe22caab72f0ac08da7ced2d967e4c0bbc61f96970644c35acb50387d95e475800d488434111968af5a8638

Download Submit
C:\Users\Admin\Desktop\GetRegister.xls

Filesize
604KB

MD5
de3e05739713dec73d74fb6508c31c6c

SHA1
8a8768bf65953fb357487328ba78fefde8ad7d12

SHA256
2093cf968b089a7dc385e860e44d79a9c78a016aa77d71b47f6874cf16c5a7ea

SHA512
2c6eae7f665f4a81812ef0b0a4f320ebc22ff77aa8d75d335491e2c77d677486f07c0bede62dd3fba10fb1441ccf055e4742c8d9bc7667cb8fe8118ffb171079

Download Submit
C:\Users\Admin\Desktop\GetUnlock.m4a

Filesize
949KB

MD5
81ed27674313a12d88de2804702f674a

SHA1
cada9610682d08dcc7438be435b01ac166847fd0

SHA256
4e5e7c313dce281b74b9fb8d194a6e3f37b504de8282c78a7387a25a7cd81926

SHA512
499066da465cfcf736e18dc1408cae9d1209b632e27fecc72188faa1d151aa2625b719d02a4cf409e70cc7ec7a767790737c76adb6872d844d17658a59e31160

Download Submit
C:\Users\Admin\Desktop\GrantReset.ogg

Filesize
748KB

MD5
58ef45a40e86c4b537f7064bd0ec9df7

SHA1
0066028d8719b40ed50dda95e7d6c0e53d2cef3a

SHA256
1d3a1b0d7c9562d398ea9627460149ba0a06b96ccfb5c663a79a0b0a8e3ec778

SHA512
7f07a4ad2ee67818c84bd484c505a55933848328b73e406947c15587b9bfe3314d004ce74d91f3a7850fc3037cc58c21908641101893f7da1b09357b7d44feb9

Download Submit
C:\Users\Admin\Desktop\LegionReadMe.txt

Filesize
1KB

MD5
d2f3040490176995eacad72b4509c524

SHA1
5a2cf08a4de4e1883416648744b4886f5ad1d515

SHA256
1348d38381e51bfe3c25658fda0dc39e9c09f7a14981b834ea0c99bd830d3947

SHA512
b81a7928eb29b7d14462c4beebd6d904784d80f006fc3614a77ae70ce462291fc1d0e6171d65359a5bea1de51fd3da91dd35f0f90c852874c16ebb07c81139ac

Download Submit
C:\Users\Admin\Desktop\MergeConvertTo.m4v

Filesize
805KB

MD5
3a7f74f057b73f721ca8599517edd1e3

SHA1
434d2a05778a3c4f5ee7ce32e1f6091e4c72db92

SHA256
d2db4c4197a3a7b16a767f84c0aeafd703d34add32b25a298acd5c11ff797690

SHA512
1c24fbbbc346ab0c6269801c33d734650a8759551fd8f41521e52957d3544471961cde370ac932a18d52f8bec75447086eab63b0329c420ef8c8d81b07b6484f

Download Submit
C:\Users\Admin\Desktop\RemoveDismount.jpeg

Filesize
518KB

MD5
830ed6fe2ce84b081f46eab4ff573105

SHA1
e2bfd99350756b51c7927f2bd66e1f2ef333dc21

SHA256
9350154712ab62cecc0eab679e394b8fdf7412eba0cfea4afcd0a71742b6e543

SHA512
1c85a8850274bc4d17304553de09b2bc67d22ce75f54782e86bb9d9bd7e838133e3ab490e29d7c63b35188a5c7fe0ba41408b32d896dc519f12064256db91e79

Download Submit
C:\Users\Admin\Desktop\SearchUninstall.xlsx

Filesize
11KB

MD5
8bba945e910e48a64a69da7662b4e07e

SHA1
f39416e2e893c734003e2056833da3fd094596f0

SHA256
0b7855a2eefbae597231251e5fc72e38853e0a49a5b290db89296582ff3f2c41

SHA512
bda1ecc8e1d2d6dee3b7842769c777d137a7a84ad0263c9893f839e8e26545d8f410b1f0b7114d9ab8b72f88e0e07e33003c1a9ebce63c75babb086ffd288441

Download Submit
C:\Users\Admin\Desktop\StopDismount.odp

Filesize
921KB

MD5
8c88abc0fbfa11b279b3727a8aeab37d

SHA1
db3f8187bc22707894004a857cebba7b96a638ba

SHA256
2af565fa07c01d3bad04e7e2b84055fc41d7804f59d3ada4d46f39b2378ee50c

SHA512
7b20b3616d05fcd47643d45074a47c7a1c1bf52d1ee99ce6f624c833dd9eda318e41cbba7358a17bd2bab828d988a53c123f20580f068d277f8762cf693546bc

Download Submit
C:\Users\Admin\Desktop\SyncConvertTo.7z

Filesize
402KB

MD5
650b451070e2bdf74a4cc0d87422bf72

SHA1
a175df789d91f12543df40e860e3ed329c6296b3

SHA256
a56615ae6ddac26d078f875765aac0655254957e18ca55970a3999de514a2187

SHA512
cf33ccb2e788656a410991261464a014b130eb9d1f01e99b556c32e2b5e496c4b6207490a4e3b1dc6fb28b80cb659eb4518c23d208541c9ac453757238af176e

Download Submit
C:\Users\Admin\Desktop\UnlockCopy.docx

Filesize
16KB

MD5
1ec9f3015fde0144a4c5fbf836c80730

SHA1
76a087cca2623513634b0daf5d463f629fec132a

SHA256
5e5e4402b02b55842511d6d42042f3297a1ac180fbec72dd5821c38a5824ced2

SHA512
e6bcf9b3d42f524fae8efd839554b4bda34fe06974a70758d2639cb11196a4f280621a78fb52dc5bd7bfe93f39ad06a69f721729d2a117e70024e50682a04ab5

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\LegionReadMe.txt

Filesize
1KB

MD5
9b26ab9e2305c98faf347c7fb8621cd2

SHA1
3eaf6b06ee8f3855f5d75515e6fe1376e9fc3534

SHA256
e05c07c747e6240efe578d36c221e043975f3b6f6ee71bafd8e8e34a49e479c4

SHA512
4e2b86b3edc38469f8510363383330151b3c7b32be44c229b2ec28c1e8c0c8977bc5d31622f55ce8d86fe60c1f07199ac5dfdcb6239c0f0b7677edfc6c753b07

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\LegionReadMe.txt

Filesize
1KB

MD5
f22e5b66a6e119ce3d8b0229b53a476e

SHA1
fc17614146ca5b9b18599aaf3c09ede64065caf0

SHA256
b433595cb5f53165537d2ad8b313762efcecccb24b4f40e8b71f9562d0dbf071

SHA512
6d7d2c7f38ca83f6b8675b86053d7fd5fb3ed27edeef6974598d49606a2125027c518b735dd376e142f4db61b2ed4bc427874a3f8bc3cca6f4f18a9f654cf67c

Download Submit
C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\LegionReadMe.txt.82uqjb1k5wya30pbb1nisyr68himefklnyhfdsfdrt8sbaxd2ju0

Filesize
1KB

MD5
57413430cb8bd40047f48b3e6ddd655d

SHA1
e71f69d80ece7c21db284882adeb172d12e8ea30

SHA256
74bc8f0f2a68de9be6345479739f153edbfcbc161d6db370fbf17ea74e51300e

SHA512
ad5b7237c4a95c956569a468aa0445d46717e1c26f25ea0a52e0c87e2b8bf71432c9172b4151f1e5aa91812805361ff8ededd62ec0c6a99ca7127ff785bdc0e2

Download Submit
C:\Users\Admin\Pictures\LegionReadMe.txt

Filesize
1KB

MD5
3206ea9e2fb1eac7d68b91284e73fe0f

SHA1
ecc72b20e5f18574c7694291f2fe02cbe7addbb6

SHA256
2937af3271f06635bc0b9fb4d37eb3f92228377b93407fcec23984e3b69c5890

SHA512
617dfee5d83ff14704b7e12ba67527ed6759d6dc19b1d442f42c088a3230df5159f84db5823448468d76439a680aab315dbbf24a504e0e78b0586752b40de34b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4h31xu21\4h31xu21.0.cs

Filesize
171B

MD5
6c07e96280d95b04b32b1a9c202569d7

SHA1
f839b0e0a90996fa7322780b456530d60be4b400

SHA256
156f662be30b207066b8795bc36a09ef76f06af9f9d452953b048a13777b49d3

SHA512
b75bbdc2b46c54c3e17892fde04f0b0721ac3e3bc0751f175f47a20da944e47a5510609be821fd82805d2d0134231f953d2b04e2e85338a8e61a3c54eaa04389

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4h31xu21\4h31xu21.cmdline

Filesize
576B

MD5
5a935a475fcf4c78cc31bd1015b380e5

SHA1
037e4375daf65c076adbee8883384dfd51401750

SHA256
490bb7c93a42ac98b96288582a07822829ee3a03e4a018223293203e52f89236

SHA512
d6035f36a0e0670209c2a52592db52c850e9deb35303d3897e79eccb5dd684a3af94b601c8bfc34f4a1ae039dfb3378830b043c31decd82d1c5d33798a4d2e5d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4h31xu21\CSC44423428B07F4E1EAB2B7FE9A3BCA379.TMP

Filesize
652B

MD5
07d616b3617437199cc4afe6e430b22a

SHA1
3782cfa2b3219b9215eec4a46d4827883ba9cddd

SHA256
5f0e10b548eebb031a650987a6ad5991f4165dca6d9b88e8fcc1d5ee109450a3

SHA512
a8bc8e14db40d758b848e35a6882929a25edeae30d1de652881de2d3161cb8a2020c8478cba1b72a484a79f6fac6f6cb8eeb528f2e1eb6f1c449398067be768e

Download Submit
memory/548-545-0x0000000006A10000-0x0000000006BA0000-memory.dmp

Filesize
1.6MB

Download
memory/548-546-0x0000000006930000-0x00000000069A2000-memory.dmp

Filesize
456KB

Download
memory/548-541-0x0000000006850000-0x0000000006878000-memory.dmp

Filesize
160KB

Download
memory/548-283-0x00000000008F0000-0x000000000095C000-memory.dmp

Filesize
432KB

Download
memory/548-1002-0x0000000006820000-0x0000000006842000-memory.dmp

Filesize
136KB

Download
memory/652-1676-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/652-1680-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/652-1627-0x000000001E110000-0x000000001E744000-memory.dmp

Filesize
6.2MB

Download
memory/652-1665-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/652-1666-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/652-1672-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/652-1654-0x000000001D8A0000-0x000000001D914000-memory.dmp

Filesize
464KB

Download
memory/652-265-0x0000000000970000-0x0000000000FD2000-memory.dmp

Filesize
6.4MB

Download
memory/652-1670-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/652-1668-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/652-1682-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/652-1674-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/652-1678-0x000000001D8A0000-0x000000001D90E000-memory.dmp

Filesize
440KB

Download
memory/1580-338-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1580-340-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1580-339-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1848-335-0x00000000004B0000-0x00000000004F8000-memory.dmp

Filesize
288KB

Download
memory/1848-397-0x0000000004F90000-0x0000000004FE6000-memory.dmp

Filesize
344KB

Download
memory/2328-1481-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/2328-810-0x0000000000400000-0x00000000005BB000-memory.dmp

Filesize
1.7MB

Download
memory/2588-272-0x0000000005500000-0x0000000005AA4000-memory.dmp

Filesize
5.6MB

Download
memory/2588-274-0x0000000005190000-0x000000000522C000-memory.dmp

Filesize
624KB

Download
memory/2588-273-0x0000000005050000-0x00000000050E2000-memory.dmp

Filesize
584KB

Download
memory/2588-270-0x0000000000600000-0x000000000066C000-memory.dmp

Filesize
432KB

Download
memory/2888-218-0x00007FF974640000-0x00007FF975101000-memory.dmp

Filesize
10.8MB

Download
memory/2888-253-0x000001585B4A0000-0x000001585B4BE000-memory.dmp

Filesize
120KB

Download
memory/2888-220-0x000001585D8D0000-0x000001585D946000-memory.dmp

Filesize
472KB

Download
memory/2888-249-0x00007FF974640000-0x00007FF975101000-memory.dmp

Filesize
10.8MB

Download
memory/2888-219-0x000001585B430000-0x000001585B474000-memory.dmp

Filesize
272KB

Download
memory/2888-216-0x0000015843060000-0x0000015843082000-memory.dmp

Filesize
136KB

Download
memory/2888-217-0x00007FF974640000-0x00007FF975101000-memory.dmp

Filesize
10.8MB

Download
memory/2888-248-0x00007FF974643000-0x00007FF974645000-memory.dmp

Filesize
8KB

Download
memory/2888-206-0x00007FF974643000-0x00007FF974645000-memory.dmp

Filesize
8KB

Download
memory/3388-314-0x0000000000520000-0x000000000053A000-memory.dmp

Filesize
104KB

Download
memory/3388-318-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

Filesize
40KB

Download
memory/3484-405-0x00000000005C0000-0x00000000005D2000-memory.dmp

Filesize
72KB

Download
memory/4020-322-0x0000000000B40000-0x0000000000B5A000-memory.dmp

Filesize
104KB

Download
memory/4080-311-0x0000000004ED0000-0x0000000004F36000-memory.dmp

Filesize
408KB

Download
memory/4080-303-0x0000000000310000-0x00000000005CA000-memory.dmp

Filesize
2.7MB

Download
memory/4080-309-0x0000000007370000-0x0000000007406000-memory.dmp

Filesize
600KB

Download
memory/4080-316-0x0000000004FD0000-0x0000000004FE6000-memory.dmp

Filesize
88KB

Download
memory/4080-315-0x0000000004FB0000-0x0000000004FCE000-memory.dmp

Filesize
120KB

Download
memory/4212-278-0x0000000000F40000-0x00000000015B4000-memory.dmp

Filesize
6.5MB

Download
memory/4212-1629-0x000000001E790000-0x000000001EDF6000-memory.dmp

Filesize
6.4MB

Download
memory/4340-1415-0x0000000000550000-0x0000000000712000-memory.dmp

Filesize
1.8MB

Download
memory/4484-229-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4484-228-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4484-233-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4484-221-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4484-223-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4484-232-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4484-227-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4484-222-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4484-231-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4484-230-0x00000217C3320000-0x00000217C3321000-memory.dmp

Filesize
4KB

Download
memory/4824-416-0x0000000000E80000-0x0000000000E98000-memory.dmp

Filesize
96KB

Download
memory/4824-421-0x0000000001750000-0x0000000001756000-memory.dmp

Filesize
24KB

Download
memory/4928-972-0x0000000000F00000-0x0000000000F22000-memory.dmp

Filesize
136KB

Download
memory/4928-307-0x00000000007D0000-0x0000000000802000-memory.dmp

Filesize
200KB

Download
memory/4928-926-0x0000000000EF0000-0x0000000000EF8000-memory.dmp

Filesize
32KB

Download
memory/5048-637-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/5048-1579-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/5048-627-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/5048-621-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/5048-1578-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/5048-1580-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/5048-1581-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/5048-622-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/5048-693-0x00007FF950B50000-0x00007FF950B60000-memory.dmp

Filesize
64KB

Download
memory/5048-664-0x00007FF950B50000-0x00007FF950B60000-memory.dmp

Filesize
64KB

Download
memory/5048-620-0x00007FF952CF0000-0x00007FF952D00000-memory.dmp

Filesize
64KB

Download
memory/5084-271-0x0000000000A40000-0x0000000000A46000-memory.dmp

Filesize
24KB

Download
memory/5084-269-0x0000000000280000-0x000000000029C000-memory.dmp

Filesize
112KB

Download
memory/5292-1509-0x00000270B9370000-0x00000270B9394000-memory.dmp

Filesize
144KB

Download
memory/5292-1508-0x00000270B9370000-0x00000270B939A000-memory.dmp

Filesize
168KB

Download