Overview

overview

10

Static

static

1

RNSM00458.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    96s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2024 11:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00458.7z

  • Size

    118.3MB

  • MD5

    aba1e47a960ba23d22d235f4aec6501f

  • SHA1

    05cb11ff2ed576f5822662e0d1a50bfb0b5cb191

  • SHA256

    af2a46b92d79251d328392ce1241fffc25acd6e797ff1e64859938e03c1e593b

  • SHA512

    f2d400dc63f50bb20b2cc07252ad21ce0254975a5daf26141806d6b60c75760051defda62e7d1f29986af891904b4eb4a2c7088c0ae756aee4b11354eb61bae0

  • SSDEEP

    3145728:US89S8h9S3iAuu9bPUMp2h0ylFEG/0QhiOb8k9C:Cl03iAB9rUv0ylFHW

Score
10/10
bitratconticrimsonratlockbitmakopvanillaratagilenetcredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

crimsonrat

C2

191.101.172.44

215.240.250.102

167.160.166.80

Extracted

Path

C:\Program Files\Crashpad\Restore-My-Files.txt

Ransom Note
LockBit 2.0 Ransomware Your data are stolen and encrypted The data will be published on TOR website http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion and https://bigblog.at if you do not pay the ransom You can contact us and decrypt one file for free on these TOR sites http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion OR https://decoding.at Decryption ID: B76B8F95C312A7FE54AC11108A36CD1B
URLs

http://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion

https://bigblog.at

http://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid.onion

http://lockbitsap2oaqhcun3syvbqt6n5nzt7fqosc6jdlmsfleu3ka4k2did.onion

https://decoding.at

Extracted

Family

bitrat

Version

1.38

C2

eewe.ddns.net:2880

Attributes
  • communication_password

    b18aba2f7c3bf981f4caba4a41e6b205

  • tor_process

    tor

Extracted

Path

C:\ProgramData\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.xyz/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- Tif628Qw8RPLQWBUdvKeIRrv9T1rYYGdtwoL7VRxcpMFw0k6B4Cw0Ycf59iDr84c ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.xyz/

Extracted

Path

C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt

Ransom Note
###### ####### # ###### # # ####### # # # # # # # ## ## # # # # # # # # # # # # # ###### ##### # # # # # # # ##### # # # ####### # # # # # # # # # # # # # # # # # ####### # # ###### # # ####### --------------------------------------------------------------- !!! ALL YOUR FILES ARE ENCRYPTED !!! Your important files, photos, videos and documents are encrypted and locked. They are no longer accessible. We understand how important your files are, so that is why we have written instructions below in order to restore your files: 1. | To access your files again, you will need a custom decryption key which is only generated and provided by us. Your files cannot be recovered without this. If you seek help from a computer technician, they will not be able to access your files without this decryption key. 2. | If you attempt to delete or remove the process it will result in permanent deletion of your files and these cannot be recovered. A custom decryptor key (that is generated by us) is the only way to access your files again. Furthermore, a portion of your files will eventually be deleted if you do not comply with our instructions. --------------------------------------------------------------- Payments are only accepted in Bitcoin: Payment information can be found below ・✼ | Step 1: Go to https://www.coinbase.com/ or another Bitcoin partner(https://bitcoin.org/en/exchanges). If you already have a Bitcoin wallet, go to step 3. ・✼ | Step 2: Create an account. ・✼ | Step 3: Buy Bitcoins for $150 ・✼ | Step 4: Send $150USD worth of Bitcoin to the Bitcoin address below. Make sure you transfer enough to cover the fee. For further information on how to send Bitcoin, please watch the following: https://www.youtube.com/watch?v=pRdUbNBsVgc ・✼ | Step 5: Send proof of payment to [email protected] with the Unique Identifier Key (found at the bottom of document). --------------------------------------------------------------- Bitcoin address (send $150USD worth of Bitcoin to:) --------------------------------------------------------------- further information: *Do not rename encrypted files. *Do not try to decrypt your data using third party software, it may cause permanent data loss *if you try to remove the process manually (by yourself or computer technician), this will result in permanent damage and data loss. We do not want that to happen to you, so please do not take this threat lightly as we understand how important your files are. We guarantee that your files will be safely restored upon payment with no further threat or harm to your computer. --------------------------------------------------------------- Unique Identifier Key (must be sent within email to [email protected]) 1BQjNiPUVA3RoEBypNtehvDCfqKDeo5zwK Unique Identifier Key (must be sent to us together with proof of payment): ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ o4idY0AZGVYUAjvfRZ1rCdc0dYEdsOKD1YwWV+Zym+MQnZteNv8MwoZCOL9FVdxLgmaZte2w43kDaIxscXvMKGVm33oPngAPUZZ0766XE8KP726lbIz+eNAQQcEG3CD4ioxJ2CfuPI71NRZLybcip3HY6sRX+UvbkfLQ+yJPwV7XvDS5HiY/6P0t/SRU20Kil4C0MO2jg49S1lzNzrDwAB/VX95LLPSEOc0rbal0CHVhk1BLDNJEJ5TcrAb42npvQpmYpQDukjZ5ucHRaWnJzN9+W1gkLM4/BvkSiTdQ8AWmrWSrupYFwoyStUhqMFharxhG/bxV2ZJCX2BFBJhMFw== ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Number of files that you could have potentially lost forever can be as high as: 160
Wallets

1BQjNiPUVA3RoEBypNtehvDCfqKDeo5zwK

Signatures

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat
  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti
  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Disables service(s) 3 TTPs
    evasionexecution
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • MAKOP ransomware payload 1 IoCs
  • Makop

    Ransomware family discovered by @VK_Intel in early 2020.

    ransomwaremakop
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

    ratvanillarat
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (1994) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Vanilla Rat payload 2 IoCs
    rat
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 6 IoCs
  • Executes dropped EXE 31 IoCs
  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Drops desktop.ini file(s) 25 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 34 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 16 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies registry class 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00458.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2184
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2524
      • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0b5bf824615068b40c84f4d32187348d1db9e2732a01077a7e8ed7b595c16ca4.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-0b5bf824615068b40c84f4d32187348d1db9e2732a01077a7e8ed7b595c16ca4.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:988
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
          4⤵
            PID:6980
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
            4⤵
              PID:276
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
              4⤵
                PID:6276
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                4⤵
                  PID:7952
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                  4⤵
                    PID:5964
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                    4⤵
                      PID:5232
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                      4⤵
                        PID:5248
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                        4⤵
                          PID:6380
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                          4⤵
                            PID:7480
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                            4⤵
                              PID:5568
                          • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-413806335478be174de0001def0b0c9635ba437fd5a7d66527c90cf9f35f1262.exe
                            HEUR-Trojan-Ransom.MSIL.Blocker.gen-413806335478be174de0001def0b0c9635ba437fd5a7d66527c90cf9f35f1262.exe
                            3⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3348
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4272
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                              4⤵
                                PID:5160
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                                4⤵
                                  PID:7612
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                                  4⤵
                                    PID:7148
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                                    4⤵
                                      PID:7860
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                                      4⤵
                                        PID:7440
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                                        4⤵
                                          PID:6832
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                                          4⤵
                                            PID:7672
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                                            4⤵
                                              PID:5984
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                                              4⤵
                                                PID:2420
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com
                                                4⤵
                                                  PID:6628
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection bing.com
                                                  4⤵
                                                    PID:2944
                                                • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-41a9129aecf7445340cf5d4db80c09e3fdc2516e49eb1d394d3ebc4ca18b6edb.exe
                                                  HEUR-Trojan-Ransom.MSIL.Blocker.gen-41a9129aecf7445340cf5d4db80c09e3fdc2516e49eb1d394d3ebc4ca18b6edb.exe
                                                  3⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4244
                                                  • C:\Users\Admin\AppData\Roaming\Client.exe
                                                    "C:\Users\Admin\AppData\Roaming\Client.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5344
                                                • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4.exe
                                                  HEUR-Trojan-Ransom.MSIL.Blocker.gen-7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4.exe
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3520
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\tglbin.exe,"
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:5320
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\tglbin.exe,"
                                                      5⤵
                                                      • Modifies WinLogon for persistence
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5904
                                                  • C:\Users\Admin\AppData\Roaming\tglbin.exe
                                                    "C:\Users\Admin\AppData\Roaming\tglbin.exe"
                                                    4⤵
                                                      PID:2912
                                                      • C:\Users\Admin\AppData\Local\Temp\AppLaunch.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\AppLaunch.exe"
                                                        5⤵
                                                          PID:7216
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 640
                                                            6⤵
                                                            • Program crash
                                                            PID:6344
                                                        • C:\Users\Admin\AppData\Local\Temp\AppLaunch.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\AppLaunch.exe"
                                                          5⤵
                                                            PID:7208
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 7208 -s 628
                                                              6⤵
                                                              • Program crash
                                                              PID:5208
                                                          • C:\Users\Admin\AppData\Local\Temp\bvt55.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\bvt55.exe"
                                                            5⤵
                                                              PID:8076
                                                              • C:\Users\Admin\AppData\Local\Temp\bvt55.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\bvt55.exe"
                                                                6⤵
                                                                  PID:7364
                                                          • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-8ee7ec743243b12d48e2ce24b14cfb475d9cd9bb03eccbfc7c8cd7a2c0582d0e.exe
                                                            HEUR-Trojan-Ransom.MSIL.Blocker.gen-8ee7ec743243b12d48e2ce24b14cfb475d9cd9bb03eccbfc7c8cd7a2c0582d0e.exe
                                                            3⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2652
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                              4⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3288
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                              4⤵
                                                                PID:4748
                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                                4⤵
                                                                  PID:6412
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                                  4⤵
                                                                    PID:2136
                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                                    4⤵
                                                                      PID:7732
                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                                      4⤵
                                                                        PID:3124
                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                                        4⤵
                                                                          PID:6396
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                                          4⤵
                                                                            PID:6188
                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                                            4⤵
                                                                              PID:5932
                                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                                              4⤵
                                                                                PID:112
                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection Google.com
                                                                                4⤵
                                                                                  PID:3684
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-92d129825bda8b18723026a90fcc19bed5614c7ba17b1a50e1ed91518fc93752.exe
                                                                                HEUR-Trojan-Ransom.MSIL.Blocker.gen-92d129825bda8b18723026a90fcc19bed5614c7ba17b1a50e1ed91518fc93752.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:4928
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-9d9b89bfce6c6b32110ce93187434a498d0b9dab95f4802cb427d73a89392568.exe
                                                                                HEUR-Trojan-Ransom.MSIL.Blocker.gen-9d9b89bfce6c6b32110ce93187434a498d0b9dab95f4802cb427d73a89392568.exe
                                                                                3⤵
                                                                                • Drops startup file
                                                                                • Executes dropped EXE
                                                                                • Adds Run key to start application
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:432
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /create /sc minute /mo 60 /tn "Client" /tr "C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-9d9b89bfce6c6b32110ce93187434a498d0b9dab95f4802cb427d73a89392568.exe"
                                                                                  4⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                  PID:5848
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-ae83d5c45126fde095a3f0cf169c92da5ca0492c28d081aa80a7dc8872428f61.exe
                                                                                HEUR-Trojan-Ransom.MSIL.Blocker.gen-ae83d5c45126fde095a3f0cf169c92da5ca0492c28d081aa80a7dc8872428f61.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2796
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-bf47fd8112e6b1bc72f28e2fc3917616ecb2e1849c9a05d9d521f0fef08349b8.exe
                                                                                HEUR-Trojan-Ransom.MSIL.Blocker.gen-bf47fd8112e6b1bc72f28e2fc3917616ecb2e1849c9a05d9d521f0fef08349b8.exe
                                                                                3⤵
                                                                                • Drops startup file
                                                                                • Executes dropped EXE
                                                                                • Adds Run key to start application
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:4140
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Encoder.gen-a1d5392103e9d83a618cfd0db7d62d2870e1ecf8cddc730322afa4e7db22fc67.exe
                                                                                HEUR-Trojan-Ransom.MSIL.Encoder.gen-a1d5392103e9d83a618cfd0db7d62d2870e1ecf8cddc730322afa4e7db22fc67.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:396
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Encoder.gen-c3cf385ef511782be2ab8c5347db1833555d446edf71cb3b8ffbb01d5d44083d.exe
                                                                                HEUR-Trojan-Ransom.MSIL.Encoder.gen-c3cf385ef511782be2ab8c5347db1833555d446edf71cb3b8ffbb01d5d44083d.exe
                                                                                3⤵
                                                                                • Drops startup file
                                                                                • Executes dropped EXE
                                                                                • Drops desktop.ini file(s)
                                                                                • Suspicious behavior: RenamesItself
                                                                                PID:4280
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Foreign.gen-67a225feedc5ce4adf75acb41e8b0e746e7daaec779225cd72f860a263b92a6e.exe
                                                                                HEUR-Trojan-Ransom.MSIL.Foreign.gen-67a225feedc5ce4adf75acb41e8b0e746e7daaec779225cd72f860a263b92a6e.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                PID:5052
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Foreign.gen-be8ad3c1c5d51fb5d29815a1b589f821ccb079649e4921c5925393c5a71b4540.exe
                                                                                HEUR-Trojan-Ransom.MSIL.Foreign.gen-be8ad3c1c5d51fb5d29815a1b589f821ccb079649e4921c5925393c5a71b4540.exe
                                                                                3⤵
                                                                                • Checks computer location settings
                                                                                • Executes dropped EXE
                                                                                PID:4496
                                                                                • C:\ProgramData\Hithviwia\trbgertrnion.exe
                                                                                  "C:\ProgramData\Hithviwia\trbgertrnion.exe"
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:6156
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Gen.gen-30083b7c6d8fe87351cb941c9ce718d2316436b93f4a5a7c7369787bf2c72d83.exe
                                                                                HEUR-Trojan-Ransom.MSIL.Gen.gen-30083b7c6d8fe87351cb941c9ce718d2316436b93f4a5a7c7369787bf2c72d83.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:5500
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.PolyRansom.gen-5126cfd21aeccb996cbaa5d7e4e418675ce1962cff65c5705691eb31d0df0aa5.exe
                                                                                HEUR-Trojan-Ransom.MSIL.PolyRansom.gen-5126cfd21aeccb996cbaa5d7e4e418675ce1962cff65c5705691eb31d0df0aa5.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:3640
                                                                              • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Crypmod.gen-fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.exe
                                                                                HEUR-Trojan-Ransom.Win32.Crypmod.gen-fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.exe
                                                                                3⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:7032
                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                  cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{58CC7F70-8E97-4893-889A-A699EF3C11A2}'" delete
                                                                                  4⤵
                                                                                    PID:6184
                                                                                    • C:\Windows\System32\wbem\WMIC.exe
                                                                                      C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{58CC7F70-8E97-4893-889A-A699EF3C11A2}'" delete
                                                                                      5⤵
                                                                                        PID:6520
                                                                                  • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-b18d0862487a22e2b286d0a695368811cc7f6bd4b9a216184061a927e41a4459.exe
                                                                                    HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-b18d0862487a22e2b286d0a695368811cc7f6bd4b9a216184061a927e41a4459.exe
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:5244
                                                                                  • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Encoder.gen-f7591ba2cf971a823996eadf8d1fc1c98c22b0cc2dfe571f78f89faf3632d9aa.exe
                                                                                    HEUR-Trojan-Ransom.Win32.Encoder.gen-f7591ba2cf971a823996eadf8d1fc1c98c22b0cc2dfe571f78f89faf3632d9aa.exe
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:6240
                                                                                  • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Generic-0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe
                                                                                    HEUR-Trojan-Ransom.Win32.Generic-0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe
                                                                                    3⤵
                                                                                    • Executes dropped EXE
                                                                                    • Adds Run key to start application
                                                                                    • Enumerates connected drives
                                                                                    • Drops file in System32 directory
                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                    • Drops file in Program Files directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry class
                                                                                    PID:6492
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
                                                                                      4⤵
                                                                                        PID:2340
                                                                                        • C:\Windows\system32\vssadmin.exe
                                                                                          vssadmin delete shadows /all /quiet
                                                                                          5⤵
                                                                                          • Interacts with shadow copies
                                                                                          PID:1368
                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                          wmic shadowcopy delete
                                                                                          5⤵
                                                                                            PID:6964
                                                                                          • C:\Windows\system32\bcdedit.exe
                                                                                            bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                            5⤵
                                                                                            • Modifies boot configuration data using bcdedit
                                                                                            PID:6276
                                                                                          • C:\Windows\system32\bcdedit.exe
                                                                                            bcdedit /set {default} recoveryenabled no
                                                                                            5⤵
                                                                                            • Modifies boot configuration data using bcdedit
                                                                                            PID:4440
                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                          "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit_Ransomware.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                                                          4⤵
                                                                                            PID:4048
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 1716
                                                                                              5⤵
                                                                                              • Program crash
                                                                                              PID:388
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Generic-0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe" & Del /f /q "C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Generic-0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe"
                                                                                            4⤵
                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                            PID:2752
                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                              ping 127.0.0.7 -n 3
                                                                                              5⤵
                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                              • Runs ping.exe
                                                                                              PID:3932
                                                                                            • C:\Windows\SysWOW64\fsutil.exe
                                                                                              fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Generic-0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe"
                                                                                              5⤵
                                                                                                PID:6184
                                                                                          • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Generic-7089e02c28f8fa84309b4538545cef44b167076ece4a433d0dce56e5a95671aa.exe
                                                                                            HEUR-Trojan-Ransom.Win32.Generic-7089e02c28f8fa84309b4538545cef44b167076ece4a433d0dce56e5a95671aa.exe
                                                                                            3⤵
                                                                                            • Checks computer location settings
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            PID:6516
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\firefox.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\firefox.exe"
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:5552
                                                                                              • C:\Windows\SYSTEM32\net.exe
                                                                                                "net.exe" stop avpsus /y
                                                                                                5⤵
                                                                                                  PID:1712
                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                    C:\Windows\system32\net1 stop avpsus /y
                                                                                                    6⤵
                                                                                                      PID:5788
                                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                                    "net.exe" stop McAfeeDLPAgentService /y
                                                                                                    5⤵
                                                                                                      PID:2148
                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                        C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
                                                                                                        6⤵
                                                                                                          PID:964
                                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                                        "net.exe" stop mfewc /y
                                                                                                        5⤵
                                                                                                          PID:6884
                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                            C:\Windows\system32\net1 stop mfewc /y
                                                                                                            6⤵
                                                                                                              PID:5576
                                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                                            "net.exe" stop BMR Boot Service /y
                                                                                                            5⤵
                                                                                                              PID:5920
                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                C:\Windows\system32\net1 stop BMR Boot Service /y
                                                                                                                6⤵
                                                                                                                  PID:6996
                                                                                                              • C:\Windows\SYSTEM32\net.exe
                                                                                                                "net.exe" stop NetBackup BMR MTFTP Service /y
                                                                                                                5⤵
                                                                                                                  PID:3192
                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                    C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
                                                                                                                    6⤵
                                                                                                                      PID:7064
                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                    "sc.exe" config SQLTELEMETRY start= disabled
                                                                                                                    5⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:2032
                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                    "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                                                                                                                    5⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:4144
                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                    "sc.exe" config SQLWriter start= disabled
                                                                                                                    5⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:6632
                                                                                                                  • C:\Windows\SYSTEM32\sc.exe
                                                                                                                    "sc.exe" config SstpSvc start= disabled
                                                                                                                    5⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:3836
                                                                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                    "taskkill.exe" /IM mspub.exe /F
                                                                                                                    5⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:5776
                                                                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                    "taskkill.exe" /IM mydesktopqos.exe /F
                                                                                                                    5⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:6520
                                                                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                                                                    "taskkill.exe" /IM mydesktopservice.exe /F
                                                                                                                    5⤵
                                                                                                                    • Kills process with taskkill
                                                                                                                    PID:6860
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" Delete Shadows /all /quiet
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:6676
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:7296
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:3052
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:2168
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:7672
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:7904
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:6600
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:6956
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:7916
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:5464
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:8000
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:4496
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:5320
                                                                                                                  • C:\Windows\SYSTEM32\vssadmin.exe
                                                                                                                    "vssadmin.exe" Delete Shadows /all /quiet
                                                                                                                    5⤵
                                                                                                                    • Interacts with shadow copies
                                                                                                                    PID:4572
                                                                                                                  • C:\Windows\System32\notepad.exe
                                                                                                                    "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
                                                                                                                    5⤵
                                                                                                                    • Opens file in notepad (likely ransom note)
                                                                                                                    PID:5148
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\firefox.exe
                                                                                                                    5⤵
                                                                                                                      PID:6416
                                                                                                                      • C:\Windows\system32\choice.exe
                                                                                                                        choice /C Y /N /D Y /T 3
                                                                                                                        6⤵
                                                                                                                          PID:7384
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Generic-7089e02c28f8fa84309b4538545cef44b167076ece4a433d0dce56e5a95671aa.exe
                                                                                                                      4⤵
                                                                                                                        PID:5412
                                                                                                                        • C:\Windows\system32\choice.exe
                                                                                                                          choice /C Y /N /D Y /T 3
                                                                                                                          5⤵
                                                                                                                            PID:3684
                                                                                                                      • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Makop.vho-c648f1cae038bc878bc5f41fc7696112dcdb953cc2af59235c3c9708bd562f7a.exe
                                                                                                                        HEUR-Trojan-Ransom.Win32.Makop.vho-c648f1cae038bc878bc5f41fc7696112dcdb953cc2af59235c3c9708bd562f7a.exe
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Adds Run key to start application
                                                                                                                        PID:6552
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe
                                                                                                                          4⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Enumerates connected drives
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:5444
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe" n5444
                                                                                                                            5⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:6292
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            "C:\Windows\system32\cmd.exe"
                                                                                                                            5⤵
                                                                                                                              PID:5672
                                                                                                                              • C:\Windows\system32\vssadmin.exe
                                                                                                                                vssadmin delete shadows /all /quiet
                                                                                                                                6⤵
                                                                                                                                • Interacts with shadow copies
                                                                                                                                PID:5800
                                                                                                                              • C:\Windows\system32\wbadmin.exe
                                                                                                                                wbadmin delete catalog -quiet
                                                                                                                                6⤵
                                                                                                                                • Deletes backup catalog
                                                                                                                                PID:2832
                                                                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                wmic shadowcopy delete
                                                                                                                                6⤵
                                                                                                                                  PID:5176
                                                                                                                          • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-f1e6bc8fe038f830ddc353139f3bf0ca840f879c7ef45a9fafcf1e75a8c03e9d.exe
                                                                                                                            HEUR-Trojan-Ransom.Win32.PolyRansom.gen-f1e6bc8fe038f830ddc353139f3bf0ca840f879c7ef45a9fafcf1e75a8c03e9d.exe
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:6564
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 6564 -s 236
                                                                                                                              4⤵
                                                                                                                              • Program crash
                                                                                                                              PID:6848
                                                                                                                          • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Sodin.vho-d68a553bdc49920a0442ddb71f84d46f5274d15a3174bdc08940de2e27e663ea.exe
                                                                                                                            HEUR-Trojan-Ransom.Win32.Sodin.vho-d68a553bdc49920a0442ddb71f84d46f5274d15a3174bdc08940de2e27e663ea.exe
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Adds Run key to start application
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:1932
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd.exe /c type "C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Sodin.vho-d68a553bdc49920a0442ddb71f84d46f5274d15a3174bdc08940de2e27e663ea.exe" > "C:\Users\Admin\AppData\Local\Route0\route.exe"
                                                                                                                              4⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5124
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd.exe /c type "C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Sodin.vho-d68a553bdc49920a0442ddb71f84d46f5274d15a3174bdc08940de2e27e663ea.exe" > "C:\Users\Admin\AppData\Local\Route0\zroute.exe"
                                                                                                                              4⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:6812
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd.exe /c pushd C:\Users\Admin\AppData\Local\Route0 & start route.exe & popd
                                                                                                                              4⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2988
                                                                                                                              • C:\Users\Admin\AppData\Local\Route0\route.exe
                                                                                                                                route.exe
                                                                                                                                5⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:6012
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  taskkill /F /IM zroute.exe
                                                                                                                                  6⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  PID:5812
                                                                                                                          • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Stop.gen-09df08b715bf11a0bc6cb5cdc5cd724927ba6c6a18ca2896f153d9b424196767.exe
                                                                                                                            HEUR-Trojan-Ransom.Win32.Stop.gen-09df08b715bf11a0bc6cb5cdc5cd724927ba6c6a18ca2896f153d9b424196767.exe
                                                                                                                            3⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:6284
                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Stop.gen-09df08b715bf11a0bc6cb5cdc5cd724927ba6c6a18ca2896f153d9b424196767.exe
                                                                                                                              HEUR-Trojan-Ransom.Win32.Stop.gen-09df08b715bf11a0bc6cb5cdc5cd724927ba6c6a18ca2896f153d9b424196767.exe
                                                                                                                              4⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:1488
                                                                                                                      • C:\Windows\system32\taskmgr.exe
                                                                                                                        "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                        1⤵
                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:2712
                                                                                                                        • C:\Windows\system32\taskmgr.exe
                                                                                                                          "C:\Windows\system32\taskmgr.exe" /1
                                                                                                                          2⤵
                                                                                                                          • Checks SCSI registry key(s)
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                          PID:2188
                                                                                                                      • C:\Windows\system32\vssvc.exe
                                                                                                                        C:\Windows\system32\vssvc.exe
                                                                                                                        1⤵
                                                                                                                          PID:6008
                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6564 -ip 6564
                                                                                                                          1⤵
                                                                                                                            PID:6768
                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                            1⤵
                                                                                                                              PID:6340
                                                                                                                            • C:\Windows\system32\wbengine.exe
                                                                                                                              "C:\Windows\system32\wbengine.exe"
                                                                                                                              1⤵
                                                                                                                                PID:6240
                                                                                                                              • C:\Windows\System32\vdsldr.exe
                                                                                                                                C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:3780
                                                                                                                                • C:\Windows\System32\vds.exe
                                                                                                                                  C:\Windows\System32\vds.exe
                                                                                                                                  1⤵
                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                  PID:7072
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                                                                                  1⤵
                                                                                                                                    PID:7820
                                                                                                                                  • C:\Windows\system32\printfilterpipelinesvc.exe
                                                                                                                                    C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
                                                                                                                                    1⤵
                                                                                                                                      PID:7164
                                                                                                                                      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
                                                                                                                                        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{AA3F4B4F-016F-447E-93F8-DD9328E64652}.xps" 133731201211410000
                                                                                                                                        2⤵
                                                                                                                                          PID:5592
                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
                                                                                                                                            OfficeC2RClient.exe /error PID=5592 ProcessName="Microsoft OneNote" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x80004005 ShowUI=1
                                                                                                                                            3⤵
                                                                                                                                            • Process spawned unexpected child process
                                                                                                                                            PID:2200
                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 7216 -ip 7216
                                                                                                                                        1⤵
                                                                                                                                          PID:316
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 7208 -ip 7208
                                                                                                                                          1⤵
                                                                                                                                            PID:7012
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4048 -ip 4048
                                                                                                                                            1⤵
                                                                                                                                              PID:5884

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Reconnaissance

                                                                                                                                            Resource Development

                                                                                                                                            Initial Access

                                                                                                                                            Execution

                                                                                                                                            Command and Scripting Interpreter

                                                                                                                                            1
                                                                                                                                            T1059

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            System Services

                                                                                                                                            1
                                                                                                                                            T1569

                                                                                                                                            Service Execution

                                                                                                                                            1
                                                                                                                                            T1569.002

                                                                                                                                            Windows Management Instrumentation

                                                                                                                                            1
                                                                                                                                            T1047

                                                                                                                                            Persistence

                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                            2
                                                                                                                                            T1547

                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                            1
                                                                                                                                            T1547.001

                                                                                                                                            Winlogon Helper DLL

                                                                                                                                            1
                                                                                                                                            T1547.004

                                                                                                                                            Create or Modify System Process

                                                                                                                                            1
                                                                                                                                            T1543

                                                                                                                                            Windows Service

                                                                                                                                            1
                                                                                                                                            T1543.003

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Privilege Escalation

                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                            2
                                                                                                                                            T1547

                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                            1
                                                                                                                                            T1547.001

                                                                                                                                            Winlogon Helper DLL

                                                                                                                                            1
                                                                                                                                            T1547.004

                                                                                                                                            Create or Modify System Process

                                                                                                                                            1
                                                                                                                                            T1543

                                                                                                                                            Windows Service

                                                                                                                                            1
                                                                                                                                            T1543.003

                                                                                                                                            Scheduled Task/Job

                                                                                                                                            1
                                                                                                                                            T1053

                                                                                                                                            Scheduled Task

                                                                                                                                            1
                                                                                                                                            T1053.005

                                                                                                                                            Defense Evasion

                                                                                                                                            Direct Volume Access

                                                                                                                                            1
                                                                                                                                            T1006

                                                                                                                                            Indicator Removal

                                                                                                                                            3
                                                                                                                                            T1070

                                                                                                                                            File Deletion

                                                                                                                                            3
                                                                                                                                            T1070.004

                                                                                                                                            Modify Registry

                                                                                                                                            2
                                                                                                                                            T1112

                                                                                                                                            Credential Access

                                                                                                                                            Credentials from Password Stores

                                                                                                                                            2
                                                                                                                                            T1555

                                                                                                                                            Credentials from Web Browsers

                                                                                                                                            1
                                                                                                                                            T1555.003

                                                                                                                                            Windows Credential Manager

                                                                                                                                            1
                                                                                                                                            T1555.004

                                                                                                                                            Unsecured Credentials

                                                                                                                                            1
                                                                                                                                            T1552

                                                                                                                                            Credentials In Files

                                                                                                                                            1
                                                                                                                                            T1552.001

                                                                                                                                            Discovery

                                                                                                                                            Browser Information Discovery

                                                                                                                                            1
                                                                                                                                            T1217

                                                                                                                                            Network Service Discovery

                                                                                                                                            1
                                                                                                                                            T1046

                                                                                                                                            Peripheral Device Discovery

                                                                                                                                            2
                                                                                                                                            T1120

                                                                                                                                            Query Registry

                                                                                                                                            4
                                                                                                                                            T1012

                                                                                                                                            Remote System Discovery

                                                                                                                                            1
                                                                                                                                            T1018

                                                                                                                                            System Information Discovery

                                                                                                                                            4
                                                                                                                                            T1082

                                                                                                                                            System Location Discovery

                                                                                                                                            1
                                                                                                                                            T1614

                                                                                                                                            System Language Discovery

                                                                                                                                            1
                                                                                                                                            T1614.001

                                                                                                                                            System Network Configuration Discovery

                                                                                                                                            1
                                                                                                                                            T1016

                                                                                                                                            Internet Connection Discovery

                                                                                                                                            1
                                                                                                                                            T1016.001

                                                                                                                                            Lateral Movement

                                                                                                                                            Collection

                                                                                                                                            Data from Local System

                                                                                                                                            1
                                                                                                                                            T1005

                                                                                                                                            Command and Control

                                                                                                                                            Web Service

                                                                                                                                            1
                                                                                                                                            T1102

                                                                                                                                            Exfiltration

                                                                                                                                            Impact

                                                                                                                                            Inhibit System Recovery

                                                                                                                                            4
                                                                                                                                            T1490

                                                                                                                                            Service Stop

                                                                                                                                            1
                                                                                                                                            T1489

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Program Files\7-Zip\7-zip.chm.exe
                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              MD5

                                                                                                                                              cfa12cf513116d1411f9adf42b4a2531

                                                                                                                                              SHA1

                                                                                                                                              afd740e2d1e30d552bfd88686da1bf64643d2a00

                                                                                                                                              SHA256

                                                                                                                                              a603322b2441790491ce1a16972065a2d5b25973fffcd2a9e4e373b5d531fcb5

                                                                                                                                              SHA512

                                                                                                                                              c90c2a1b66187fe3e285e4a70cf7db28a2311821938646bbab933ba4abcb2080949b8ffed9f4e82c4e5d72ba29b660f58bf6ed3820962ab4e9122b77611eaf2b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Program Files\Crashpad\Restore-My-Files.txt
                                                                                                                                              Filesize

                                                                                                                                              512B

                                                                                                                                              MD5

                                                                                                                                              fd6bf76cd5ac9f5632b61333dfe7364c

                                                                                                                                              SHA1

                                                                                                                                              4926e982ec3e9e7456ba7a88b31ee2e69bfb1728

                                                                                                                                              SHA256

                                                                                                                                              0835e8f4cb0fa31e9a5ea667bad62b96543373877bb6744d439039efa8101273

                                                                                                                                              SHA512

                                                                                                                                              3992bd61870893f966c9fa6e41425eede33bcb943ab90133b65412990f9d4fe1028815773331a3c0d2b0cffbda918b180433d9fae60f6bf726b2c0e2495a8e1f

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\Hithviwia\trbgertrnion.exe
                                                                                                                                              Filesize

                                                                                                                                              10.3MB

                                                                                                                                              MD5

                                                                                                                                              7166fef6f67c86b0325f9e714ceb79ed

                                                                                                                                              SHA1

                                                                                                                                              df2b04b6a4442f2a27355ac8e569f1dcdb4f3019

                                                                                                                                              SHA256

                                                                                                                                              8cfe39f5ff3d8430844896409457c8c17d67ab9dec47f819cb0545b7b5c261ee

                                                                                                                                              SHA512

                                                                                                                                              5e4f8e4260f59eaa12b0bf558b07f37716fa2d4062bfc69749b56c78756e5ab49a79dac7d98a75363ea558de0fe12c282a3ee513ef69bb960a1749ac8c542fdf

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\Hithviwia\trbgertrnion.zip
                                                                                                                                              Filesize

                                                                                                                                              63KB

                                                                                                                                              MD5

                                                                                                                                              04dcfbeeee13294575d93dca37e0f115

                                                                                                                                              SHA1

                                                                                                                                              f21a4c80e5597ba41fd86e3da5f5594984506a69

                                                                                                                                              SHA256

                                                                                                                                              47ec5e52d78781477527c29f4300eb0b3b9808041ed4bcea536ced7a2d477ad1

                                                                                                                                              SHA512

                                                                                                                                              6c9bdebab37a676d09e5132bfab8e26f9cf692675649f917455c88bf5eb279086d6945ab8aa291177e9f7477948760594c50d09668ea986f6abd6f6fc2dad0bf

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\Microsoft\ClickToRun\ProductReleases\012A0661-537C-4802-8019-082A4972EEBC\readme-warning.txt.HR2-C47-KX2
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              9268bf61a3f395df31c35f1280142c33

                                                                                                                                              SHA1

                                                                                                                                              bd0f6abe3b155bd1b786418a4cd62cbffc6d9d07

                                                                                                                                              SHA256

                                                                                                                                              17a5f75d47f9681c9cf71bc41169d26632f41540e5dd7794171e1209d563db71

                                                                                                                                              SHA512

                                                                                                                                              0ad05cccb7894c1734948f0448cd619d26bb27143992edd22871309f35973376e902a53a5f82b75f74e81431d546a0bfcbf0554b1210bd9018bc727a97f8ed0c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\ProgramData\readme.txt
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              35c0e8aacd17e72c2b25418a0bcf8db4

                                                                                                                                              SHA1

                                                                                                                                              5696937d407e02ec0c54c4fb0c226ca829850c0e

                                                                                                                                              SHA256

                                                                                                                                              1bf3c7a175f42b83f4ee18b1f66a5657424f10bd1422204742ea75eff593a9d6

                                                                                                                                              SHA512

                                                                                                                                              24f9424537b0e1fcfc7012fd6c23d632874bc673c745ada672007e5c0d0caccd2c0e137da5d658ccd582a498b0bc777f45a23eae9c06a8c72eef8d4b061c2ada

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local:11-10-2024
                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              517758f55e29d50f23d3edf822f48c41

                                                                                                                                              SHA1

                                                                                                                                              cf667018e45620f78aef31f9a6f297429d01b0e5

                                                                                                                                              SHA256

                                                                                                                                              5ec0fbfcb7951231d7ffa11f157f559299a917e0114dca4bf8490bf920415141

                                                                                                                                              SHA512

                                                                                                                                              177ef54b17569cae6adfbd83841c0d071ad258a7e7e9506d1cb94a702288a5cd407b31eb5ee2e1c036f598fab23d73fb8ff8fc98bf2a12696ceca111af1ac1d1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx
                                                                                                                                              Filesize

                                                                                                                                              4.0MB

                                                                                                                                              MD5

                                                                                                                                              4a31ac3594cb245c08e134ec06b3057e

                                                                                                                                              SHA1

                                                                                                                                              4e17f9afa83f9e90d8dc56f823bca1e6801d5592

                                                                                                                                              SHA256

                                                                                                                                              a58789e910e5f939afc433a00fef5930702927dc192cb237fd9e7449bd6ffe1d

                                                                                                                                              SHA512

                                                                                                                                              8a8b7ed4e02345ec29b652718a8289a337e36b22f54034cd842fdd2ccb1a2cbb5982802d901e72c41e0776fdd0c88bd1cc918efc4a3e99a79a9be0d65534e143

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                              MD5

                                                                                                                                              d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                              SHA1

                                                                                                                                              2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                              SHA256

                                                                                                                                              b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                              SHA512

                                                                                                                                              c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                              Filesize

                                                                                                                                              4B

                                                                                                                                              MD5

                                                                                                                                              f49655f856acb8884cc0ace29216f511

                                                                                                                                              SHA1

                                                                                                                                              cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                              SHA256

                                                                                                                                              7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                              SHA512

                                                                                                                                              599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                              Filesize

                                                                                                                                              8B

                                                                                                                                              MD5

                                                                                                                                              b1b1b5d2c686e10fa9a67011beff56dc

                                                                                                                                              SHA1

                                                                                                                                              a2ad55ddbe58c680d6e870ff4fa4feda6b8ee6db

                                                                                                                                              SHA256

                                                                                                                                              2a885fb8125ae2e498e329b82c600d5664fab3c5450152aadfe934eaea8ba814

                                                                                                                                              SHA512

                                                                                                                                              10a4b182407e9a19736b1519cc98619de77798374ccb1a85563411f789f096e0868d23fc33f380b2792edb5335ce4ef5a5e84b938beb675093479a1727c5d801

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                              Filesize

                                                                                                                                              944B

                                                                                                                                              MD5

                                                                                                                                              6bd369f7c74a28194c991ed1404da30f

                                                                                                                                              SHA1

                                                                                                                                              0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                              SHA256

                                                                                                                                              878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                              SHA512

                                                                                                                                              8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\CURRENT
                                                                                                                                              Filesize

                                                                                                                                              24B

                                                                                                                                              MD5

                                                                                                                                              736d8c37c00c4eda1d7d7e69dd25743e

                                                                                                                                              SHA1

                                                                                                                                              353e52c7db8226074fd0a59eb99f80c3fc73cf76

                                                                                                                                              SHA256

                                                                                                                                              7ae5b4ac4e67557a2ec40f78e406adfd23fdc3941f507074e58427e702c6650a

                                                                                                                                              SHA512

                                                                                                                                              aaf52617910fd1759e84bd44d38ce3c01fbb10d71d6806b99c049aa886cd4c6d3767560f1311146590a87f45c1b23881c09a5488ec73e0e5393f6bcfd8e92211

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\MANIFEST-000001
                                                                                                                                              Filesize

                                                                                                                                              56B

                                                                                                                                              MD5

                                                                                                                                              d16ccab0ae7d878e7cdf8dd63df35122

                                                                                                                                              SHA1

                                                                                                                                              d5c95715b379e1a23577ec1467400eecee84aa31

                                                                                                                                              SHA256

                                                                                                                                              239c3dd7774f3cfade7aecfa3f99fd7b27746dc8f1773e2ea17992bfcb845dcf

                                                                                                                                              SHA512

                                                                                                                                              9bd6210e3387e84373f1e859828c52ebdf58d50862974e2c6c08735dcd3f7d80497b802e5451461ecda25fc73677bbc856cccc996b813ca1593a0f038c090d8a

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index
                                                                                                                                              Filesize

                                                                                                                                              32B

                                                                                                                                              MD5

                                                                                                                                              f5ae98776c7cbf63ab53e953542835a3

                                                                                                                                              SHA1

                                                                                                                                              105ade7d6eb968442c6a58a14f7a4e20dcf1dcff

                                                                                                                                              SHA256

                                                                                                                                              9964312696ec8067bc53477a85b872e6f40786e062b5d206e228f609116647fe

                                                                                                                                              SHA512

                                                                                                                                              a46474623358df8ea9d804fab0e600916cd3ef8c3d7369d4c27134531975b66f411d7fdc0d5c385e73722409c8b9340b0eae066075c39b7b3da769b8f60969db

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0
                                                                                                                                              Filesize

                                                                                                                                              10KB

                                                                                                                                              MD5

                                                                                                                                              7429334d2f0579cde976dcef10ec7527

                                                                                                                                              SHA1

                                                                                                                                              76a512ef38b89d97ba354479ec1695519978b2d2

                                                                                                                                              SHA256

                                                                                                                                              fd5e1edd55d9e42c582b82291d4b3cf09e3a8044c104c07f40bb91e7cbbaaf56

                                                                                                                                              SHA512

                                                                                                                                              1697cdb237a22fe151855f36fac9738ef908533c36d4fc224f9cfd70f739b8e98251fc18ab63664e60da00b48a5b04c549e3834803e60ea1dde00e6d545ba374

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1
                                                                                                                                              Filesize

                                                                                                                                              352KB

                                                                                                                                              MD5

                                                                                                                                              89b4d843d78139981ae11054441ec70d

                                                                                                                                              SHA1

                                                                                                                                              6989712d6c5ef5b13db0b5875ceb7cadf2000f2e

                                                                                                                                              SHA256

                                                                                                                                              ee64f4895fc80ae6b1d2432241307b94203eb618277ff2a708bdd06057f82c72

                                                                                                                                              SHA512

                                                                                                                                              e4fd73fc71eb1eb05db833c5efd2af1adbd0d3174d0de1965cc7245de04f3642f5099911cbb4678172276b0186d69af59364e44dca2c197eb86ec2066c0a338d

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_2
                                                                                                                                              Filesize

                                                                                                                                              10KB

                                                                                                                                              MD5

                                                                                                                                              895033bba3858a14648d3325f750fc06

                                                                                                                                              SHA1

                                                                                                                                              8930bebfe79d009d019669b2a2d554359c90719c

                                                                                                                                              SHA256

                                                                                                                                              5f87eb82a057207bcb9582b4b5c5caf8fd5dc4ba9c0a1b91b2d2cc9802197f2d

                                                                                                                                              SHA512

                                                                                                                                              67190f5b6b5c09a24741cbc99e94720a03a37483ecba54e7d8544d2271618182313e4edd51332c2773b266de9fd4f506683e0f2ea3452107b8aff35e671d0a89

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_3
                                                                                                                                              Filesize

                                                                                                                                              10KB

                                                                                                                                              MD5

                                                                                                                                              db284f8e09d3ffea7b776801b294b75f

                                                                                                                                              SHA1

                                                                                                                                              a90c08ace0c65c001da426706551f6185a7fd9d9

                                                                                                                                              SHA256

                                                                                                                                              42a2d23f6c5c7cecadaab14aeb73c2087d200096a35df287445df9fdace869dd

                                                                                                                                              SHA512

                                                                                                                                              2585a736859fc680679e9b9fc55955b276e65f680d42a6b504efae893252f2ae55ab09dfc461573edf47d005481c5780d7387f68bb4e5b0f7afa469fe6751ec4

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
                                                                                                                                              Filesize

                                                                                                                                              441KB

                                                                                                                                              MD5

                                                                                                                                              971212f29d0aa320fceb3782fac284bb

                                                                                                                                              SHA1

                                                                                                                                              b22a422e9d3008be7c474c7119b3d17cc41447ce

                                                                                                                                              SHA256

                                                                                                                                              8bb04e6a8770449d3d9bce8f2afa4e2788344a31dfd6ecc53bbbb8a5e8e48382

                                                                                                                                              SHA512

                                                                                                                                              41f3f58d07d8f59d9c40cf9897766ab09823ff1577c447776b425b2779a4152b274dd193e021e85a6dd1dc12ce2c90b1e9aec53658d3ae3a766e8cc299d00d68

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\onenote.exe.db
                                                                                                                                              Filesize

                                                                                                                                              32KB

                                                                                                                                              MD5

                                                                                                                                              0077126e55a1e3d545f2f2a8a02a6758

                                                                                                                                              SHA1

                                                                                                                                              713fbbe800ba2bc9212530d9bd059387e61da9cb

                                                                                                                                              SHA256

                                                                                                                                              3c9828d589b0d3df56cdea775964c9ff763f98ac19ef5186439a2664ece85134

                                                                                                                                              SHA512

                                                                                                                                              c670a0fb3c3f56d21b15e4e99ec2db41e2d31d44c748ee9fbb2dae1bb7e04e069102f67ecf77c0a6d10f02c2d082e64206ef615504140a9bbceac4f3c4a82283

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                              Filesize

                                                                                                                                              53KB

                                                                                                                                              MD5

                                                                                                                                              a26df49623eff12a70a93f649776dab7

                                                                                                                                              SHA1

                                                                                                                                              efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                              SHA256

                                                                                                                                              4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                              SHA512

                                                                                                                                              e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              b12c1106c8abd5a3afc2ce78c48eb9d8

                                                                                                                                              SHA1

                                                                                                                                              71729df3f95e9680a268c9fa50fc33eb9af18d66

                                                                                                                                              SHA256

                                                                                                                                              fbee9d20ff949a1c1d73b52caa72707461a0dfc4d1420cb6e24b08ce1b15b2df

                                                                                                                                              SHA512

                                                                                                                                              5b707f2e33db6adb676844c6359ab605d62abfced85c07208bd467fe9ca17ec95cff7e81caa4d1697b21f53b9260ffb413762a308109627908c79ef93e230fbf

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
                                                                                                                                              Filesize

                                                                                                                                              10KB

                                                                                                                                              MD5

                                                                                                                                              84617a221143c095b103db45bc5aeee2

                                                                                                                                              SHA1

                                                                                                                                              5fb3d74d814cdd1f76a7daa082ae413485a5f6ef

                                                                                                                                              SHA256

                                                                                                                                              3f93524924441c6817beaafcb2d6840255962cf6e40e555ebe2e03f0a41903d7

                                                                                                                                              SHA512

                                                                                                                                              1aebaba7478bf3c17847e4b3e2f0a46cafff62e8bf98f7a54cc835b2b4753b22a8353b567aaaa94ef6828273ce0e865e6336ef6281de02e6f8ff91021efd503b

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                              MD5

                                                                                                                                              8a4b97225d2f6e5ea4dbb47d9be161e8

                                                                                                                                              SHA1

                                                                                                                                              0c83d844caf666535b9d9f650c602d5110a7fce1

                                                                                                                                              SHA256

                                                                                                                                              bda9cad71791cd0fd8edd6b08b624ff68094725dabc334852faa15d59260db6c

                                                                                                                                              SHA512

                                                                                                                                              c4adbb53a0f6f0f78aeb16c8112273e52a9c95bf5e14a67a2b8b58a34fcb25aa5727a05acdc9362e88b55da6609bbfe2ba2f6034e2b691f8a898720dc8538e99

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help
                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                              MD5

                                                                                                                                              adf1f3ccd9a6f3456180c2136c53da39

                                                                                                                                              SHA1

                                                                                                                                              2883579b5de929995d43abbd0e15217a60ebe23f

                                                                                                                                              SHA256

                                                                                                                                              77ddbd4e4173f73bb2f1f55c12626dfca4f15c6a8d90309e9e0d1788660c3ac8

                                                                                                                                              SHA512

                                                                                                                                              30f78e5ec11f958eb29ebd45fd46e1e910d2be62608ae32af2042cdf4b50b62223ac77d85319a54476d99acddad0c141ce697f352e139c1414b99a6ab3e9ac30

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url
                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                              MD5

                                                                                                                                              8aee018fa49bea1e183adcb2bf371650

                                                                                                                                              SHA1

                                                                                                                                              d17e8249ab1dd6f20edce24fca712d75d6ae2a99

                                                                                                                                              SHA256

                                                                                                                                              b8d1babf4639546b7b2045e53ccc298dca3f376ffd942a293e915ddd925eba37

                                                                                                                                              SHA512

                                                                                                                                              6e20dbc5e8752de17f927f3029465ac7c47746167fa50704f979a7ec2f1989ac776c89163e664da9a60971366333ef25b9c29ea87dc82e1c1ec1ac921dd514be

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                              MD5

                                                                                                                                              c35ac660c59d8f77bddaed3850af52a1

                                                                                                                                              SHA1

                                                                                                                                              ec566f0061bdc3083ae91c2c5bcb3bf0944cb265

                                                                                                                                              SHA256

                                                                                                                                              d942f99a8ab47d8428d3751bcf526e5d98325ba785e95413eeeffa02358b2320

                                                                                                                                              SHA512

                                                                                                                                              a218c197f05f35f23c9c1641c810c458480ea55b0f7d09532d3519bebf64015d2ac43a4041410dfe5e714d6ae7d81649081fc624e189bea6f0365b35431848a1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aa497220-05d7-46d2-8bd5-43ed8794e4be}\0.1.filtertrie.intermediate.txt
                                                                                                                                              Filesize

                                                                                                                                              8B

                                                                                                                                              MD5

                                                                                                                                              bcf9080f43da5df78c9256a8bbc52bfd

                                                                                                                                              SHA1

                                                                                                                                              3c1cc80a244116d5c4481e7bb04ac616be024177

                                                                                                                                              SHA256

                                                                                                                                              506f657014a26b170c781d5f45d3404eb8545bc4fd7cd2b33707d17fcdcd0d96

                                                                                                                                              SHA512

                                                                                                                                              d5d95f89175c172c2b781a15be9e81103fdf85606d460c38eb17adac80e1410a26489e170bf64e70d23f1effd93000ec7550fdaf6b582d532f8efd27f5421016

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aa497220-05d7-46d2-8bd5-43ed8794e4be}\0.2.filtertrie.intermediate.txt
                                                                                                                                              Filesize

                                                                                                                                              8B

                                                                                                                                              MD5

                                                                                                                                              e3466c94a83ae164c6ba9b37c240218e

                                                                                                                                              SHA1

                                                                                                                                              1e6349fffdf6687e9e2009b1d1a793c95f51c01a

                                                                                                                                              SHA256

                                                                                                                                              40955245d90158879480ad2001bb64c732ec548428227f61653dca843cd03af3

                                                                                                                                              SHA512

                                                                                                                                              89443633353e0d9566199386c0be7fd05fa7f70cc2c90512a47321ae2b4a3fa601098f7fda58c8200af3669ac7ad0ba63c05c44842d32415083a43c12af4c854

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{aa497220-05d7-46d2-8bd5-43ed8794e4be}\Apps.index
                                                                                                                                              Filesize

                                                                                                                                              1.4MB

                                                                                                                                              MD5

                                                                                                                                              82b634462ceebee454287d7e95d42b33

                                                                                                                                              SHA1

                                                                                                                                              5f585b0604b916177758a1ea168b3d2b6ff5e34d

                                                                                                                                              SHA256

                                                                                                                                              a8a1eda7de943e95189408ff249fcb6521d4bb5b517629a0c46330143813e6c5

                                                                                                                                              SHA512

                                                                                                                                              de1b0cfcaa0f98a559b3e36afeeb81b9c6a3d7d8f379c69c0e1024f38ad60dffa7cc98332f907fcebbf036a02fdba65bad754e2aacfb846aec553a7de399bbb9

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662721799026.txt
                                                                                                                                              Filesize

                                                                                                                                              103KB

                                                                                                                                              MD5

                                                                                                                                              d1e6de3cbb3660e889ab87614659d23e

                                                                                                                                              SHA1

                                                                                                                                              8ced73be91a544d9706f0636eece45c0ba661057

                                                                                                                                              SHA256

                                                                                                                                              d2f459db9476c345212bb1b53e9497176ba94200400d7b66d6016a1ed28f6b3a

                                                                                                                                              SHA512

                                                                                                                                              d66403ccc92a0f7f89cdaa348a25d371eb4bea70f77d0bbdbd09fa647b5ed96862959f3719b246e4d3deab65e8ca0bf7c8d765a11cd82d57df21147fb2f5e57f

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663191189319.txt
                                                                                                                                              Filesize

                                                                                                                                              62KB

                                                                                                                                              MD5

                                                                                                                                              7516b80125ce036da984dd880f384ea6

                                                                                                                                              SHA1

                                                                                                                                              3eb51d90547ec766619b37f245fed22f645153f2

                                                                                                                                              SHA256

                                                                                                                                              c46922b29f89bf6f01fded5b486f81f16b130be3aa78c64dc8458ea3562568ff

                                                                                                                                              SHA512

                                                                                                                                              a9ff8179a4be97e5ce05d0fb640a06888400d49c76fa0a4ea55a6b6d9cf1cabad571ec2a29c19c9c9a3d8b8837a7a30aa5d16e03884303cdef80ed6cef861842

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727670188807600.txt
                                                                                                                                              Filesize

                                                                                                                                              84KB

                                                                                                                                              MD5

                                                                                                                                              f011fb69fb2b3ba4c9ba4210d8cfdbbf

                                                                                                                                              SHA1

                                                                                                                                              2ad7b72f68bb6a2cf908a8466cece01fbc75b4cc

                                                                                                                                              SHA256

                                                                                                                                              8530767dd15fee78875b040d63e3ef0d3a1352b5dc58d762345cab8fac179e2b

                                                                                                                                              SHA512

                                                                                                                                              ca0ef8d96cbf2a5fcf378f0d30cb129425db8852ad1998d9c2e366495f6c0f2dd408c550e956c402b7e4ad72004e50eef071f1fb5deee9c831830b0e0dfa54e1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727672984949051.txt
                                                                                                                                              Filesize

                                                                                                                                              99KB

                                                                                                                                              MD5

                                                                                                                                              b43ecde39f6ab57122d13fe9abf59b87

                                                                                                                                              SHA1

                                                                                                                                              5c168183ff775fd12d6a45175ce7126bf78ba6fd

                                                                                                                                              SHA256

                                                                                                                                              6c063cad24b4d2ba2d15086800dbff93616a1da3a995e9c160b072dfa4ff12f8

                                                                                                                                              SHA512

                                                                                                                                              189e1faca9ba889928e81e9605d9c068bc2cd6199852cf1ff37a46c10d44879de665280b7b703a9d48f361d647368db04bc7a8546b184c45b2214a5bd2108c26

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zE888A6B97\00458\VHO-Trojan-Ransom.Win32.Gen.gen-c04dcc680d6d39835f7a98201dd920989e78bbfaeec41cec4df36747e9f548b2.exe
                                                                                                                                              Filesize

                                                                                                                                              7.5MB

                                                                                                                                              MD5

                                                                                                                                              03c14a09e54aa3209de3ee733cf8aa8e

                                                                                                                                              SHA1

                                                                                                                                              104d6f82cd3b2b5334494f7f91c1c8748361b309

                                                                                                                                              SHA256

                                                                                                                                              c04dcc680d6d39835f7a98201dd920989e78bbfaeec41cec4df36747e9f548b2

                                                                                                                                              SHA512

                                                                                                                                              ca67baefb6961429985a2e92c5a7e48f2f108e73d266aa7f5d113442aaf54e9367053af507e43f8bbfbaef4acb99a2d21ee0be64ebba8b15084331912591b510

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\o.exe
                                                                                                                                              Filesize

                                                                                                                                              34KB

                                                                                                                                              MD5

                                                                                                                                              951dce6731c5f3d2dae570597bc19d59

                                                                                                                                              SHA1

                                                                                                                                              cb32d6679e51d454bc9b3aa5ceb071302cbe2147

                                                                                                                                              SHA256

                                                                                                                                              eee8150ba918a7ed099074a1b87a97b3c7f6648a763eedd7096acf16f40e0a73

                                                                                                                                              SHA512

                                                                                                                                              3ea6dca684a7671e3371740f9d91f8bc6b10119ae492949585e1bc8789b56f6d110f833f8684489fbfc4dda3d733fc127c242ae840cd262a89b44952dcc4fb09

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dv3tuvd5.ouo.ps1
                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\bvt55.exe
                                                                                                                                              Filesize

                                                                                                                                              76KB

                                                                                                                                              MD5

                                                                                                                                              0e362e7005823d0bec3719b902ed6d62

                                                                                                                                              SHA1

                                                                                                                                              590d860b909804349e0cdc2f1662b37bd62f7463

                                                                                                                                              SHA256

                                                                                                                                              2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

                                                                                                                                              SHA512

                                                                                                                                              518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\wct8553.tmp
                                                                                                                                              Filesize

                                                                                                                                              84KB

                                                                                                                                              MD5

                                                                                                                                              deab676f0a4efbe1550d3b0a09213e0b

                                                                                                                                              SHA1

                                                                                                                                              16ed5ec265f53bbf1fedf9a98c77f346e85b18f9

                                                                                                                                              SHA256

                                                                                                                                              3249b91f56905162a6ada6750686e783950e4903a38515681165ec4f405b2b31

                                                                                                                                              SHA512

                                                                                                                                              f8cc34f24349032db2ceb15a7bd85747f407f8afadd4bad0dc62c4e4215d68e2210d435c2b3cb601ead7a979ae2d60b6a0227afc27f93b3af887d91d7b5a09b2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\firefox.exe
                                                                                                                                              Filesize

                                                                                                                                              54KB

                                                                                                                                              MD5

                                                                                                                                              86c2dba786b4090db17f7613bc6c88be

                                                                                                                                              SHA1

                                                                                                                                              d217e3aa3aca98a68460ff4f9f473e1de8a4f256

                                                                                                                                              SHA256

                                                                                                                                              7089e02c28f8fa84309b4538545cef44b167076ece4a433d0dce56e5a95671aa

                                                                                                                                              SHA512

                                                                                                                                              a5bbab3189cc5d10a1a04e255b4a82671d9d0ed3ad18fdac1996050ffff888c877fd3a42727c211fd9872d58905e0b083cc9bd32231ccdc7f8c77b845faab263

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\data.zip
                                                                                                                                              Filesize

                                                                                                                                              65KB

                                                                                                                                              MD5

                                                                                                                                              58bb8eac1f3b88d703f72c182c12ffe1

                                                                                                                                              SHA1

                                                                                                                                              6abd5a836d400edccadedff2878f7f3a581d5c6d

                                                                                                                                              SHA256

                                                                                                                                              7769437bbe55ff4f377ade33472c67dba2527c82c830bb2e41a2512f1c906913

                                                                                                                                              SHA512

                                                                                                                                              33e1a4b47e0321acd6f8a60f105cf905bf6be52ba995be17b89053f1dba71f87d1d176b969d64556f469a389575955d48414be6b4015178633150d6c05cedb43

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\places.sqlite-shm
                                                                                                                                              Filesize

                                                                                                                                              42KB

                                                                                                                                              MD5

                                                                                                                                              c830d1a87b8129e5ab0dc9325c6b4d19

                                                                                                                                              SHA1

                                                                                                                                              f2caa11ad697d7ddd7b8c59ee996eea786b878c1

                                                                                                                                              SHA256

                                                                                                                                              c8c3bdbb0908e6db9c32b61a82f73837d0a641894dab500b84c07eeb61a1c03f

                                                                                                                                              SHA512

                                                                                                                                              d9d2358fc38bacba68e52f2b3814fe1baa13264db65fe06d7180548d4264eeb841d9bb9ddb50742d3aa2a3783f6b4d0f35d730b437836d312b274f55be7adf4e

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                              MD5

                                                                                                                                              a3b320ad621e45f10790732c3728381f

                                                                                                                                              SHA1

                                                                                                                                              b302934b78a323720464f550aed2830e6004afd6

                                                                                                                                              SHA256

                                                                                                                                              3a482bed80e117c3a30915cae8111c94a2b12cb52fd4ae571d3d385c9c5e44de

                                                                                                                                              SHA512

                                                                                                                                              177afe2d78a6420c1a07b110e585e9146998199a95243b97df07266da937ac28183efea47156ea8aabbc22b0d3541314ea4e8355f906bb1668e743e01840f204

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0b5bf824615068b40c84f4d32187348d1db9e2732a01077a7e8ed7b595c16ca4.exe
                                                                                                                                              Filesize

                                                                                                                                              13.5MB

                                                                                                                                              MD5

                                                                                                                                              c51b0bf0fb0ea326f21c0c2210327295

                                                                                                                                              SHA1

                                                                                                                                              bda806abbbdbd7886b75f9f219849013e3a22b30

                                                                                                                                              SHA256

                                                                                                                                              0b5bf824615068b40c84f4d32187348d1db9e2732a01077a7e8ed7b595c16ca4

                                                                                                                                              SHA512

                                                                                                                                              e1dfd22fd7f2f1c6ede1b185ac0bfcf6c721c7e14cbe4a3b03e4d4dbb823ace57bbba8fa5fc15469148a3d9fce8dfb495537333f4e69fc7943ed2abf3aa703c3

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-413806335478be174de0001def0b0c9635ba437fd5a7d66527c90cf9f35f1262.exe
                                                                                                                                              Filesize

                                                                                                                                              9.4MB

                                                                                                                                              MD5

                                                                                                                                              f76dc131e9fecc386646523edd9e1cf9

                                                                                                                                              SHA1

                                                                                                                                              884c9abec1761e09a9c3fba7610b823b2b5727a5

                                                                                                                                              SHA256

                                                                                                                                              413806335478be174de0001def0b0c9635ba437fd5a7d66527c90cf9f35f1262

                                                                                                                                              SHA512

                                                                                                                                              b4a7108b3592996010e752be2424da5845e3cc2df053484782973c0f53b3a9f2cf23412b1c094ec31e761c3020cb88cbb3cfb2a925af9b6330276e462ce37981

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-41a9129aecf7445340cf5d4db80c09e3fdc2516e49eb1d394d3ebc4ca18b6edb.exe
                                                                                                                                              Filesize

                                                                                                                                              56KB

                                                                                                                                              MD5

                                                                                                                                              466818dc52a3872e06bf76b664b7b825

                                                                                                                                              SHA1

                                                                                                                                              c23927487a181256fe1c01395747b472ff49bed0

                                                                                                                                              SHA256

                                                                                                                                              41a9129aecf7445340cf5d4db80c09e3fdc2516e49eb1d394d3ebc4ca18b6edb

                                                                                                                                              SHA512

                                                                                                                                              167f972f994f228a50c9a69b0c022f575da6bb7dcb98d35693f8ea3968575a56452a0230dc0d89c5f1debed07122c60d97ecc27edd9f019fe9db3578f8aab1ca

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4.exe
                                                                                                                                              Filesize

                                                                                                                                              717KB

                                                                                                                                              MD5

                                                                                                                                              1e8d607206d7c754e9303151f126c224

                                                                                                                                              SHA1

                                                                                                                                              1919478674e42a28de4d7604bab84de201a38556

                                                                                                                                              SHA256

                                                                                                                                              7a3ec0235f9c26bb8fd1502574ed67eaab479fa81e5d80d7b6f5b5cc230ec7f4

                                                                                                                                              SHA512

                                                                                                                                              e118a9e26144fcee57bcee87aa3484edce3983be08f9dc7e8a1863be7ee88b5b5bdeceb57f031cf4b42715e59ed214383141afd93c6c644f907ce1244c1b57b9

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-8ee7ec743243b12d48e2ce24b14cfb475d9cd9bb03eccbfc7c8cd7a2c0582d0e.exe
                                                                                                                                              Filesize

                                                                                                                                              899KB

                                                                                                                                              MD5

                                                                                                                                              8c0dd5fef85ac206418b12b897b0d9bd

                                                                                                                                              SHA1

                                                                                                                                              931243c9b2c8857e016458fcc8ecdd60eb298bff

                                                                                                                                              SHA256

                                                                                                                                              8ee7ec743243b12d48e2ce24b14cfb475d9cd9bb03eccbfc7c8cd7a2c0582d0e

                                                                                                                                              SHA512

                                                                                                                                              0ccf84d5b6602c9b96c83b5d7ccd76b3af93c40e8247b21ce459804fbc59cbd524352870fd7e80b70c9104b05502962d961d1d14f762dc767d82898d0fd7788e

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-92d129825bda8b18723026a90fcc19bed5614c7ba17b1a50e1ed91518fc93752.exe
                                                                                                                                              Filesize

                                                                                                                                              114KB

                                                                                                                                              MD5

                                                                                                                                              3e82d4b205d458e65db00eb0f4231546

                                                                                                                                              SHA1

                                                                                                                                              6047758f81a94f3738f0901f9d04cb4e25abbe34

                                                                                                                                              SHA256

                                                                                                                                              92d129825bda8b18723026a90fcc19bed5614c7ba17b1a50e1ed91518fc93752

                                                                                                                                              SHA512

                                                                                                                                              99804e70e2901414db122096f6ef72c5cc652fefbfe129d2b5e91dd11e33b94e878d090971f890e2b335200823f441464263f959e7574a47a9afcbda3a2102bf

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-9d9b89bfce6c6b32110ce93187434a498d0b9dab95f4802cb427d73a89392568.exe
                                                                                                                                              Filesize

                                                                                                                                              55KB

                                                                                                                                              MD5

                                                                                                                                              9f11a2723e14e099d96976751d83a9ba

                                                                                                                                              SHA1

                                                                                                                                              42cdcda442248e05085220250389e01dc699152e

                                                                                                                                              SHA256

                                                                                                                                              9d9b89bfce6c6b32110ce93187434a498d0b9dab95f4802cb427d73a89392568

                                                                                                                                              SHA512

                                                                                                                                              557aa0a46a38c6bb9f97c998f591aaee9c45059d4ec957d744855ee4743efda2278b53150728abb61998d960a8f48dded22f5b66a4747c9d94f765e5ae87490d

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-ae83d5c45126fde095a3f0cf169c92da5ca0492c28d081aa80a7dc8872428f61.exe
                                                                                                                                              Filesize

                                                                                                                                              6.0MB

                                                                                                                                              MD5

                                                                                                                                              d270cfed3fbb7a57a6dae16412ab99ca

                                                                                                                                              SHA1

                                                                                                                                              14696d6ea468516859b534b48f888bc0bda4ec7a

                                                                                                                                              SHA256

                                                                                                                                              ae83d5c45126fde095a3f0cf169c92da5ca0492c28d081aa80a7dc8872428f61

                                                                                                                                              SHA512

                                                                                                                                              76e360f0fb3b0094e0969a4127453202eb3387fba891cb892e9f36c82192dbb00c51058e8a2b7c22b5b8ad7c901ec32f7ecf757b36c81c523d84303c4dee9f58

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Blocker.gen-bf47fd8112e6b1bc72f28e2fc3917616ecb2e1849c9a05d9d521f0fef08349b8.exe
                                                                                                                                              Filesize

                                                                                                                                              55KB

                                                                                                                                              MD5

                                                                                                                                              7f6ff6cab40283e143efad48cda98926

                                                                                                                                              SHA1

                                                                                                                                              0270abdd1a0ef40bfe8692d6a35868232658fc64

                                                                                                                                              SHA256

                                                                                                                                              bf47fd8112e6b1bc72f28e2fc3917616ecb2e1849c9a05d9d521f0fef08349b8

                                                                                                                                              SHA512

                                                                                                                                              c1d6527e4006faef859c05c5bf792df68f5dd3888bbea96fe620711dd576babd4ca047fa20eba37d70a4f4219b7bfb209ea94eb4601a90f4e11996706b331c24

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Encoder.gen-a1d5392103e9d83a618cfd0db7d62d2870e1ecf8cddc730322afa4e7db22fc67.exe
                                                                                                                                              Filesize

                                                                                                                                              827KB

                                                                                                                                              MD5

                                                                                                                                              53173756bf9f142c4ce77f572a38dd20

                                                                                                                                              SHA1

                                                                                                                                              102748e40feb848cd5bbb703fb6648775285cfaf

                                                                                                                                              SHA256

                                                                                                                                              a1d5392103e9d83a618cfd0db7d62d2870e1ecf8cddc730322afa4e7db22fc67

                                                                                                                                              SHA512

                                                                                                                                              49fe0443a20320386f1ba92588506492c3c46f720fba21a3201f0b2cc507c4f98e38be468e88f9385ba1152eca76235312662bcb4ae6a01af892556d12ddecd7

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Encoder.gen-c3cf385ef511782be2ab8c5347db1833555d446edf71cb3b8ffbb01d5d44083d.exe
                                                                                                                                              Filesize

                                                                                                                                              241KB

                                                                                                                                              MD5

                                                                                                                                              7eade97e254fb07eb85f28d5fe29b722

                                                                                                                                              SHA1

                                                                                                                                              de507abf5bb3d976ccea64a31a6b1a93173e525a

                                                                                                                                              SHA256

                                                                                                                                              c3cf385ef511782be2ab8c5347db1833555d446edf71cb3b8ffbb01d5d44083d

                                                                                                                                              SHA512

                                                                                                                                              d68177b6116392234a324f6dae8a552622bb53ab49e9bc1b85a2a72f560f4064d427252a2d22d6913a4939990cd86979578fbb2b857aa50135b49761707630c4

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Foreign.gen-67a225feedc5ce4adf75acb41e8b0e746e7daaec779225cd72f860a263b92a6e.exe
                                                                                                                                              Filesize

                                                                                                                                              9.7MB

                                                                                                                                              MD5

                                                                                                                                              0d8eeacca6e4a8237f17da724b237da2

                                                                                                                                              SHA1

                                                                                                                                              1b0e8bb4f86aa1c8126019faafd2c68f7ac13d52

                                                                                                                                              SHA256

                                                                                                                                              67a225feedc5ce4adf75acb41e8b0e746e7daaec779225cd72f860a263b92a6e

                                                                                                                                              SHA512

                                                                                                                                              89175b826866b0e3ca3c4644f5cae591fa7645c1c0459eda35c76335fb8e78c3282918a65a1f5444409fa26992514cdbce58595b2557946ff0bf8fa4a28d6ecd

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Foreign.gen-be8ad3c1c5d51fb5d29815a1b589f821ccb079649e4921c5925393c5a71b4540.exe
                                                                                                                                              Filesize

                                                                                                                                              102KB

                                                                                                                                              MD5

                                                                                                                                              2866daf2b59d9c34c891838c6bc10fb9

                                                                                                                                              SHA1

                                                                                                                                              40ed0748dd9302a36ad6ea579f9ebffa2bacd7c4

                                                                                                                                              SHA256

                                                                                                                                              be8ad3c1c5d51fb5d29815a1b589f821ccb079649e4921c5925393c5a71b4540

                                                                                                                                              SHA512

                                                                                                                                              6a8325d07798d5475ef22d11a37a43105e006f0e88d1176e8e61cce5e8ab4c2f9a4f3c1c824839bf4f817d1f2fa22940ec0756f5da394ba63705f66f1f182616

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.Gen.gen-30083b7c6d8fe87351cb941c9ce718d2316436b93f4a5a7c7369787bf2c72d83.exe
                                                                                                                                              Filesize

                                                                                                                                              12.9MB

                                                                                                                                              MD5

                                                                                                                                              bafa6b22dc19a5fbe92e536e575087d6

                                                                                                                                              SHA1

                                                                                                                                              051e01b37b313ee0f05c7f449a2b9c7ec2ad8a39

                                                                                                                                              SHA256

                                                                                                                                              30083b7c6d8fe87351cb941c9ce718d2316436b93f4a5a7c7369787bf2c72d83

                                                                                                                                              SHA512

                                                                                                                                              0aa4d32fa6de037bcd15b0721ff3ebbd14e0612f7bd28e08f9e72b7a9c79b28fbab0cd0ecb6236a039ad19fe3b6447e4563d3a3bdca089cfb3bb833832dca2e5

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.MSIL.PolyRansom.gen-5126cfd21aeccb996cbaa5d7e4e418675ce1962cff65c5705691eb31d0df0aa5.exe
                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              MD5

                                                                                                                                              4f1cba3f701ae05e3234268cf17de70d

                                                                                                                                              SHA1

                                                                                                                                              151a1100e999dccbe94b33f75d48fdc0592165bd

                                                                                                                                              SHA256

                                                                                                                                              5126cfd21aeccb996cbaa5d7e4e418675ce1962cff65c5705691eb31d0df0aa5

                                                                                                                                              SHA512

                                                                                                                                              e134b61321130230149c99f515800597ef95359ecee363d4121d9ae21a91bdd2a9d6b2e81289d58480dea22500024ce8723a939907e0e0181c8fbbd960ba9ceb

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Crypmod.gen-fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864.exe
                                                                                                                                              Filesize

                                                                                                                                              195KB

                                                                                                                                              MD5

                                                                                                                                              912f6ba823937d9f1f3b0cef3f5c4986

                                                                                                                                              SHA1

                                                                                                                                              42ab240af3bded9cabe5338ac812b81d39862726

                                                                                                                                              SHA256

                                                                                                                                              fe1652f4b828c9f98ff4a37829f4a988ad3c1601fc0dff7f99fe941ae4e81864

                                                                                                                                              SHA512

                                                                                                                                              1338386cb15ad88ee9505bfc71388bc46d70c7fb1d5ce1312dd2cbe156f99b6ef2b8c1ca3a7f9ab95d0670892a1e340a51df995adc60f617cd90c173e7ab83f2

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-b18d0862487a22e2b286d0a695368811cc7f6bd4b9a216184061a927e41a4459.exe
                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              MD5

                                                                                                                                              07859321af9cb8b8b3afde4da1801a13

                                                                                                                                              SHA1

                                                                                                                                              1e107b9438764d8a71018cc778f0d374721e20c3

                                                                                                                                              SHA256

                                                                                                                                              b18d0862487a22e2b286d0a695368811cc7f6bd4b9a216184061a927e41a4459

                                                                                                                                              SHA512

                                                                                                                                              e998b5e1ba60c0f4e2c60fbb6c6a22a4b4d39ee637e1da94a3637286ba1d468432d7a9347695ef3d9ea80601db42eabeab06c87c9d648cd254fa3238f36f90c1

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Encoder.gen-f7591ba2cf971a823996eadf8d1fc1c98c22b0cc2dfe571f78f89faf3632d9aa.exe
                                                                                                                                              Filesize

                                                                                                                                              246KB

                                                                                                                                              MD5

                                                                                                                                              f36f5bbf5d5c91aa24af074ccbc9d433

                                                                                                                                              SHA1

                                                                                                                                              f7077aa4e636a6a14297dcb901474e3ccf94aeac

                                                                                                                                              SHA256

                                                                                                                                              f7591ba2cf971a823996eadf8d1fc1c98c22b0cc2dfe571f78f89faf3632d9aa

                                                                                                                                              SHA512

                                                                                                                                              4f13d7483cd02d009078314667a9658938e82bbd65ab7bea746dc89a435f47a20a6c709bbf8392753a40a1a0768549dcbcd083896799e6f901a33793a05bfd38

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Generic-0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049.exe
                                                                                                                                              Filesize

                                                                                                                                              959KB

                                                                                                                                              MD5

                                                                                                                                              6fc418ce9b5306b4fd97f815cc9830e5

                                                                                                                                              SHA1

                                                                                                                                              95838a8beb04cfe6f1ded5ecbd00bf6cf97cd564

                                                                                                                                              SHA256

                                                                                                                                              0545f842ca2eb77bcac0fd17d6d0a8c607d7dbc8669709f3096e5c1828e1c049

                                                                                                                                              SHA512

                                                                                                                                              7b9e17dc75d83f6b6ac458f29e07faf30e50d88d283cb50fd64b44730622da48702059e416649455c082ff28328fd70e3acea61527e86a7972978219a7bfcc06

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Makop.vho-c648f1cae038bc878bc5f41fc7696112dcdb953cc2af59235c3c9708bd562f7a.exe
                                                                                                                                              Filesize

                                                                                                                                              171KB

                                                                                                                                              MD5

                                                                                                                                              5ac385a18e905a102641064be708783f

                                                                                                                                              SHA1

                                                                                                                                              dda176956d5df2fda89aa567c610dd73141a509f

                                                                                                                                              SHA256

                                                                                                                                              c648f1cae038bc878bc5f41fc7696112dcdb953cc2af59235c3c9708bd562f7a

                                                                                                                                              SHA512

                                                                                                                                              088f28fd4757b2d35110c3088231a7d2d0c95817172cf72a62daf5e8f850ff62a2204208848f9ed0f7ec8a7b145e44497658649a45bf898c4886abd76a0b443d

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-f1e6bc8fe038f830ddc353139f3bf0ca840f879c7ef45a9fafcf1e75a8c03e9d.exe
                                                                                                                                              Filesize

                                                                                                                                              1.0MB

                                                                                                                                              MD5

                                                                                                                                              3aaf71f1b881d8ae27feddcc5a1d49ff

                                                                                                                                              SHA1

                                                                                                                                              4877eda3a75e29dec32971c955b8598e78c1802e

                                                                                                                                              SHA256

                                                                                                                                              f1e6bc8fe038f830ddc353139f3bf0ca840f879c7ef45a9fafcf1e75a8c03e9d

                                                                                                                                              SHA512

                                                                                                                                              b19971da9331f5066d5f39ea4f32f9b4aace7a677e4984ac3db773b82b007bbf510045590442bcfc4391f26c0be39aa0084431abf1510a2d954e8b2ca5e11dea

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\HEUR-Trojan-Ransom.Win32.Sodin.vho-d68a553bdc49920a0442ddb71f84d46f5274d15a3174bdc08940de2e27e663ea.exe
                                                                                                                                              Filesize

                                                                                                                                              436KB

                                                                                                                                              MD5

                                                                                                                                              ee789430391e7eccc3fee6d6dd766c63

                                                                                                                                              SHA1

                                                                                                                                              c0de55aacb7d12f18b0931f3fd74cdfaad68e4a9

                                                                                                                                              SHA256

                                                                                                                                              d68a553bdc49920a0442ddb71f84d46f5274d15a3174bdc08940de2e27e663ea

                                                                                                                                              SHA512

                                                                                                                                              8a082c754f8ca6710df6b35f80d763c8ad7ed40bb17503bdf43ecf372967189dc0738d541dee8affd95d8ab5e11d5990840d0595aeb1b4843c86f776fcf3a041

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\00458\VHO-Trojan-Ransom.Win32.Gen.gen-c04dcc680d6d39835f7a98201dd920989e78bbfaeec41cec4df36747e9f548b2.exe
                                                                                                                                              Filesize

                                                                                                                                              10.0MB

                                                                                                                                              MD5

                                                                                                                                              860c2e50c538543713259a311dc51e55

                                                                                                                                              SHA1

                                                                                                                                              64e81e9244be3ecd2fd9a4c6a27d283fba528151

                                                                                                                                              SHA256

                                                                                                                                              af8198c8a5c0f11e4edc6d5fffefac7c7f88d7bc0f588bd08be3f46dfe5b320e

                                                                                                                                              SHA512

                                                                                                                                              2adb07e4af92e1d0cac3d5eebd9d1e06b3c3d736d7df658b0a2a8534599a5b1abb14b36594b8e6d1bb34bbf16bee552dfc4ee633b788030cd3274d68fa84ba46

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
                                                                                                                                              Filesize

                                                                                                                                              3KB

                                                                                                                                              MD5

                                                                                                                                              c7805c04b187f66b73621fad2878077f

                                                                                                                                              SHA1

                                                                                                                                              6e168cb4bcca06007b9d52e058c80c8dda759c34

                                                                                                                                              SHA256

                                                                                                                                              bd859536a0363bab6245f32ea4ab64729c2a5da686f38286bb18572921bead0b

                                                                                                                                              SHA512

                                                                                                                                              6336fbc65f45f2867b5e28d5517e68d7cf0c52912aa4ea55ef67d525fb9d087de44be364704b9a93d88dacf9f39a9acf5f96af0a288094f256f971e55b8a221d

                                                                                                                                              Download Submit

                                                                                                                                            • C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Restore-My-Files.txt.HR2-C47-KX2
                                                                                                                                              Filesize

                                                                                                                                              512B

                                                                                                                                              MD5

                                                                                                                                              ab5858f773d01644fce9fd4986903108

                                                                                                                                              SHA1

                                                                                                                                              1c88ea5b670562ab74f5c9463735d533bd075219

                                                                                                                                              SHA256

                                                                                                                                              c973471ecff7aca160bbcb30d708e4aabd44be888e61438ae19b917a3c1a0d82

                                                                                                                                              SHA512

                                                                                                                                              afb8aabf4663884ad36a628c236f8891350095e8cb1d4c4b7564a14f3f8c3a61b10938ede4ba7cdd1d242994b8a86fa52370b3259ce880147470531c4ed8de3d

                                                                                                                                              Download Submit

                                                                                                                                            • C:\program files\7-zip\7-zip.chm
                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              MD5

                                                                                                                                              2e4b24a4fc9fb1fa62b6c40bda26cc8a

                                                                                                                                              SHA1

                                                                                                                                              04109820a2d186e16737a6bc46f937718ac7243b

                                                                                                                                              SHA256

                                                                                                                                              b020d4bb17defaa9b51d1f350bdc911a399ef1246ccd68edcefb1536161e3e16

                                                                                                                                              SHA512

                                                                                                                                              232f0a5d07daa2bd1d8095a5197daeecd932d4936ccbc5f8f1c900e16528772532661f5d11ea28d54810cc90320c53ee6be7d12de5759599e4dcedb4497ac3d6

                                                                                                                                              Download Submit

                                                                                                                                            • C:\program files\7-zip\7z.sfx
                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              MD5

                                                                                                                                              a094126f5cfc1a75902f2bfef01517e8

                                                                                                                                              SHA1

                                                                                                                                              bcaf4be009e2f29cf117f981de94df5dea4b6462

                                                                                                                                              SHA256

                                                                                                                                              aee93269181ec8fb2eeede9199ddc067298d488210f4f3a09aa633a5194a4e3a

                                                                                                                                              SHA512

                                                                                                                                              46c58714ddcbf40cd8eec3519787c64968faf40ef75db2472de2b37fd63bc3502182c468e642677f59c65e72325626c8f19746fdefcd28e9b6ede956bde698e9

                                                                                                                                              Download Submit

                                                                                                                                            • C:\program files\7-zip\7zcon.sfx
                                                                                                                                              Filesize

                                                                                                                                              1.8MB

                                                                                                                                              MD5

                                                                                                                                              feaac7cb7330bf96f064ae4c51120f42

                                                                                                                                              SHA1

                                                                                                                                              f1eda0f94316928bc27227c9b71c59389f33989c

                                                                                                                                              SHA256

                                                                                                                                              e25fb5b26a10e3bff0e43b5bda3c72dc58126d25a2193d6c4a3f8d1b645be37e

                                                                                                                                              SHA512

                                                                                                                                              003deaab543bbdd15789bf4bdd7dad730c55adf3d576bb9a958664b2ec96c40cdd9544a084b5db8ad891412cf6714e00ede5c7e8897d8b983470c3a93d3e7476

                                                                                                                                              Download Submit

                                                                                                                                            • memory/396-354-0x0000022B622E0000-0x0000022B623B4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              848KB

                                                                                                                                              Download

                                                                                                                                            • memory/432-333-0x0000000004EB0000-0x0000000004F16000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                              Download

                                                                                                                                            • memory/432-330-0x0000000000310000-0x0000000000324000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              80KB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18300-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18445-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-20212-0x000000006CFF0000-0x000000006D029000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              228KB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19998-0x000000006C9E0000-0x000000006CA19000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              228KB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19247-0x000000006CCF0000-0x000000006CD29000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              228KB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19098-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19090-0x000000006CCF0000-0x000000006CD29000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              228KB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19089-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19088-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19044-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19039-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19037-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19036-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-19034-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18497-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18518-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18516-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18421-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18397-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18320-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18064-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-18028-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-17779-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-17763-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-16060-0x000000006CCF0000-0x000000006CD29000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              228KB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-15801-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-15802-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-10705-0x000000006CA00000-0x000000006CA39000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              228KB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-10524-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-10508-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-9902-0x000000006C950000-0x000000006C989000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              228KB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-9241-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-9258-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-9368-0x000000006CA30000-0x000000006CA69000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              228KB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-7474-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-7624-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-7482-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1488-7480-0x0000000000400000-0x00000000007E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.9MB

                                                                                                                                              Download

                                                                                                                                            • memory/1932-11834-0x0000000000400000-0x0000000000C49000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/1932-8502-0x0000000000400000-0x0000000000C49000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/1968-294-0x0000000000F70000-0x0000000001CFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              13.5MB

                                                                                                                                              Download

                                                                                                                                            • memory/2652-332-0x0000000005AF0000-0x0000000005B3E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              312KB

                                                                                                                                              Download

                                                                                                                                            • memory/2652-309-0x0000000000E70000-0x0000000000F56000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              920KB

                                                                                                                                              Download

                                                                                                                                            • memory/2652-331-0x00000000058D0000-0x00000000058DA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-258-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-266-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-269-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-259-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-263-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-264-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-265-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-257-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-267-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2712-268-0x000001B164DF0000-0x000001B164DF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                              Download

                                                                                                                                            • memory/2796-346-0x0000000000CA0000-0x00000000012A4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.0MB

                                                                                                                                              Download

                                                                                                                                            • memory/2796-3421-0x000000001BFC0000-0x000000001C5BA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.0MB

                                                                                                                                              Download

                                                                                                                                            • memory/2912-19327-0x0000000006730000-0x0000000006744000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              80KB

                                                                                                                                              Download

                                                                                                                                            • memory/2912-19411-0x0000000004350000-0x0000000004364000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              80KB

                                                                                                                                              Download

                                                                                                                                            • memory/2912-19328-0x0000000006AA0000-0x0000000006AA6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              24KB

                                                                                                                                              Download

                                                                                                                                            • memory/3288-357-0x0000000005150000-0x0000000005778000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/3288-368-0x0000000005980000-0x00000000059E6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                              Download

                                                                                                                                            • memory/3288-355-0x0000000002620000-0x0000000002656000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              216KB

                                                                                                                                              Download

                                                                                                                                            • memory/3288-1746-0x0000000006F20000-0x0000000006FB6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              600KB

                                                                                                                                              Download

                                                                                                                                            • memory/3288-1277-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                              Download

                                                                                                                                            • memory/3288-1749-0x0000000006420000-0x000000000643A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                              Download

                                                                                                                                            • memory/3288-1350-0x00000000062B0000-0x00000000062FC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/3288-3266-0x00000000081D0000-0x000000000884A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.5MB

                                                                                                                                              Download

                                                                                                                                            • memory/3288-367-0x00000000058E0000-0x0000000005902000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/3348-298-0x0000000000D60000-0x00000000016DA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              9.5MB

                                                                                                                                              Download

                                                                                                                                            • memory/3520-308-0x0000000000D80000-0x0000000000E3A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              744KB

                                                                                                                                              Download

                                                                                                                                            • memory/3520-313-0x00000000056F0000-0x0000000005782000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              584KB

                                                                                                                                              Download

                                                                                                                                            • memory/3520-1391-0x0000000007110000-0x0000000007138000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              160KB

                                                                                                                                              Download

                                                                                                                                            • memory/3520-317-0x0000000006160000-0x00000000064B4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/3520-310-0x0000000005BB0000-0x0000000006154000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.6MB

                                                                                                                                              Download

                                                                                                                                            • memory/3520-1396-0x0000000007190000-0x00000000071B2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/3520-315-0x0000000005830000-0x00000000058CC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              624KB

                                                                                                                                              Download

                                                                                                                                            • memory/3640-1654-0x00000000002F0000-0x000000000042E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.2MB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-253-0x00007FFB25130000-0x00007FFB25BF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-242-0x00007FFB25133000-0x00007FFB25135000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-255-0x0000011EB0E80000-0x0000011EB0EC4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              272KB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-256-0x0000011EB0F50000-0x0000011EB0FC6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              472KB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-243-0x0000011EB09C0000-0x0000011EB09E2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-288-0x0000011EB0EF0000-0x0000011EB0F0E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-270-0x00007FFB25133000-0x00007FFB25135000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-254-0x00007FFB25130000-0x00007FFB25BF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/4156-285-0x00007FFB25130000-0x00007FFB25BF1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/4280-360-0x00000212BCE00000-0x00000212BCE42000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              264KB

                                                                                                                                              Download

                                                                                                                                            • memory/4496-1072-0x000001D1D2A00000-0x000001D1D2A22000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/4928-316-0x0000000000F00000-0x0000000000F22000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                              Download

                                                                                                                                            • memory/5052-638-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              32KB

                                                                                                                                              Download

                                                                                                                                            • memory/5052-482-0x000000001CA40000-0x000000001CF0E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4.8MB

                                                                                                                                              Download

                                                                                                                                            • memory/5052-485-0x000000001CF10000-0x000000001CFAC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              624KB

                                                                                                                                              Download

                                                                                                                                            • memory/5244-3213-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/5244-4156-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              1.7MB

                                                                                                                                              Download

                                                                                                                                            • memory/5500-1655-0x0000024F82BB0000-0x0000024F82BC8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              96KB

                                                                                                                                              Download

                                                                                                                                            • memory/5500-1657-0x0000024F9D6A0000-0x0000024F9D6EA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              296KB

                                                                                                                                              Download

                                                                                                                                            • memory/5500-1583-0x0000024F9CE20000-0x0000024F9D5A6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.5MB

                                                                                                                                              Download

                                                                                                                                            • memory/5500-1656-0x0000024F9D720000-0x0000024F9D7A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              512KB

                                                                                                                                              Download

                                                                                                                                            • memory/5500-1651-0x0000024F9E430000-0x0000024F9E4EC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              752KB

                                                                                                                                              Download

                                                                                                                                            • memory/5500-1544-0x0000024F81AA0000-0x0000024F82796000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              13.0MB

                                                                                                                                              Download

                                                                                                                                            • memory/5500-1658-0x0000024F9E4F0000-0x0000024F9E580000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              576KB

                                                                                                                                              Download

                                                                                                                                            • memory/5500-1584-0x0000024F84530000-0x0000024F845A6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              472KB

                                                                                                                                              Download

                                                                                                                                            • memory/5932-20099-0x0000000006B00000-0x0000000006B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/6012-13393-0x0000000000400000-0x0000000000C49000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              8.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/6156-3412-0x000001BB6C510000-0x000001BB6CF60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.3MB

                                                                                                                                              Download

                                                                                                                                            • memory/6188-20024-0x0000000006720000-0x000000000676C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                              Download

                                                                                                                                            • memory/6516-3433-0x00000000003D0000-0x00000000003E4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              80KB

                                                                                                                                              Download

                                                                                                                                            • memory/8076-19977-0x0000000000360000-0x000000000037A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              104KB

                                                                                                                                              Download