Overview

overview

10

Static

static

1

RNSM00453.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    58s
  • max time network
    260s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2024 17:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00453.7z

  • Size

    124.4MB

  • MD5

    476f712361418b566450de6542746a33

  • SHA1

    ecb5554071fdbed5fc9ce8bf4c7f05377864e8c4

  • SHA256

    7b09cbca6d171aa7f46ae5abd6830f16f29b20ec26021b5d45ee8e51747e2141

  • SHA512

    3513bff42f8b0de2138512e8bff1e44f721816d8130c4a7030095097770d8bf2bc910e65c7aab6bd3ebfd6b9d4164b0cb18e1849f1bcda855f1b36102364e03b

  • SSDEEP

    3145728:k2k+SMixLEhqcaA6zSP0aoZpjvQ/qFISVBueFYVkcItr7SFy:k2k+SMQKqccSP+pzwqFIcFS01SFy

Score
10/10
agentteslacontidjvugandcrablatentbotnanocorenjratquasarredlinesectopratzgrathackedoffice04terrornaxagilenetaspackv2backdoordefense_evasiondiscoveryevasionexecutioninfostealerkeyloggerpersistenceransomwareratspywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

djvu

C2

http://astdg.top/nddddhsspen6/get.php

Attributes
  • extension

    .gujd

  • offline_id

    NcBG8wI6Q1WFhUNlCRyjmrWGeGew2vvCKtJgKot1

  • payload_url

    http://securebiz.org/dl/build2.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-mNr1oio2P6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0316ewgfDd

rsa_pubkey.plain

Extracted

Family

nanocore

Version

1.2.2.0

C2

62.109.11.164:2346

Mutex

7b5cc397-d08c-4533-acb0-e661fb0000dd

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    62.109.11.164

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2018-08-30T06:50:10.862172036Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    2346

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    29994

  • keyboard_logging

    true

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    7b5cc397-d08c-4533-acb0-e661fb0000dd

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    62.109.11.164

  • primary_dns_server

    8.8.8.8

  • request_elevation

    false

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Path

C:\ProgramData\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI strain. As you know (if you don't - just "google it"), all of the data that has been encrypted by our software cannot be recovered by any means without contacting our team directly. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN get your data back - we offer you to decrypt 2 random files completely free of charge. You can contact our team directly for further instructions through our website : TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.xyz/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded a pack of your internal data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us as soon as possible. ---BEGIN ID--- k8YFPCgpUPCstbXQJ5w7yn7BMwdjIJirvjxMNOUny5INNUgHXGYkhd42AvbcUC3B ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.xyz/

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:5552
Mutex

90cdc4299e3838b5249c33e1c7a2dd25

Attributes
  • reg_key

    90cdc4299e3838b5249c33e1c7a2dd25

  • splitter

    |'|'|

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

192.168.1.2:4444

Mutex

b2ec2a58-c128-4e0f-a41e-e57162b3d7ff

Attributes
  • encryption_key

    1D5CDB2FA3BC76D3356F72927A44B5934F473655

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

redline

Botnet

terrornax

C2

45.88.3.176:17033

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1833231669:AAGi09Fqux60ktahLhT8D677G7uISE3okog/sendDocument

Extracted

Path

C:\Users\Public\Pictures\recover.txt

Ransom Note
!!! IMPORTANT INFORMATION !!! All your files are encrypted. Decrypting of your files is only possible with the private key, which is on our secret server. To receive your private key follow one of the links: 1. http://s3clm4lufbmfhmeb.tor2web.org/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d 2. http://s3clm4lufbmfhmeb.onion.to/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d 3. http://s3clm4lufbmfhmeb.onion.cab/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d 4. http://s3clm4lufbmfhmeb.onion.link/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d If all addresses are not available, follow these steps: 1. Download and install Tor Browser: https://torproject.org/download/download-easy.html 2. After successfull installation, run the browser and wait for initialization. 3. Type in the address bar: s3clm4lufbmfhmeb.onion/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d 4. Follow the instructions on the site. !!! Your personal identification ID: AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ== !!!
URLs

http://s3clm4lufbmfhmeb.tor2web.org/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d

http://s3clm4lufbmfhmeb.onion.to/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d

http://s3clm4lufbmfhmeb.onion.cab/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d

http://s3clm4lufbmfhmeb.onion.link/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d

http://s3clm4lufbmfhmeb.onion/?id=AstHzPrd62I6AQzATGyQGSXmFuQmbxiPPgl4bd32t4kfdQ%3d%3d

Extracted

Path

C:\yunbox\driver\_readme.txt

Family

djvu

Ransom Note
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-mNr1oio2P6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0316ewgfDd
URLs

https://we.tl/t-mNr1oio2P6

Extracted

Family

latentbot

C2

hhhhhhhhhhq1.zapto.org

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti
  • Detect ZGRat V2 1 IoCs
  • Detected Djvu ransomware 2 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • GandCrab payload 4 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot
  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • AgentTesla payload 2 IoCs
  • Clears Windows event logs 1 TTPs 8 IoCs
    evasionransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 30 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 12 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 3 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00453.7z"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4628
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2336
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4184
      • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0d4bf92c3500426d3b79612b7da5a173f3b25edc7c65a33e25e6a3dde1c5fe9f.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-0d4bf92c3500426d3b79612b7da5a173f3b25edc7c65a33e25e6a3dde1c5fe9f.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3004
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "PrimeTest" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TimerUpdater\DXVPLAINE.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:748
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "PrimeTest" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TimerUpdater\DXVPLAINE.exe"
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:5844
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TimerUpdater\DXVPLAINE.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TimerUpdater\DXVPLAINE.exe"
          4⤵
            PID:7180
        • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-1dc556e37f06a18d2ab36615b3452f781f2a8e4ef70b07db8358737c0633bb23.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-1dc556e37f06a18d2ab36615b3452f781f2a8e4ef70b07db8358737c0633bb23.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3464
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1568
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4792
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3144
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
            4⤵
              PID:3956
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
              4⤵
                PID:5252
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                4⤵
                  PID:5732
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                  4⤵
                    PID:5444
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                    4⤵
                      PID:6028
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                      4⤵
                        PID:6024
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                        4⤵
                          PID:6588
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                          4⤵
                            PID:7192
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                            4⤵
                              PID:6528
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                              4⤵
                                PID:8708
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                4⤵
                                  PID:6628
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                  4⤵
                                    PID:7676
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                    4⤵
                                      PID:8404
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                      4⤵
                                        PID:6520
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                        4⤵
                                          PID:6040
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                          4⤵
                                            PID:9988
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                            4⤵
                                              PID:11116
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                              4⤵
                                                PID:1876
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                                4⤵
                                                  PID:11032
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                                  4⤵
                                                    PID:9776
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                                    4⤵
                                                      PID:9632
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com
                                                      4⤵
                                                        PID:5892
                                                      • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-1dc556e37f06a18d2ab36615b3452f781f2a8e4ef70b07db8358737c0633bb23.exe
                                                        C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-1dc556e37f06a18d2ab36615b3452f781f2a8e4ef70b07db8358737c0633bb23.exe
                                                        4⤵
                                                          PID:5492
                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-5d35385545b904e031114d34dcaf43a7a6ec529c353b274fb9350db37a371434.exe
                                                        HEUR-Trojan-Ransom.MSIL.Blocker.gen-5d35385545b904e031114d34dcaf43a7a6ec529c353b274fb9350db37a371434.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Adds Run key to start application
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1968
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 1828
                                                          4⤵
                                                          • Program crash
                                                          PID:4328
                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-6a05d81206eb43c79d99676dc8a20c06aa0f486c15c3c3d9b01a25e84532ebe9.exe
                                                        HEUR-Trojan-Ransom.MSIL.Blocker.gen-6a05d81206eb43c79d99676dc8a20c06aa0f486c15c3c3d9b01a25e84532ebe9.exe
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4420
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "exploered" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\exploered.exe"
                                                          4⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:5724
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "exploered" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\exploered.exe"
                                                            5⤵
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5960
                                                        • C:\Users\Admin\AppData\Roaming\exploered.exe
                                                          "C:\Users\Admin\AppData\Roaming\exploered.exe"
                                                          4⤵
                                                            PID:11080
                                                            • C:\Users\Admin\AppData\Roaming\ammero.exe
                                                              "C:\Users\Admin\AppData\Roaming\ammero.exe"
                                                              5⤵
                                                                PID:13304
                                                              • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
                                                                5⤵
                                                                  PID:5676
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    "schtasks.exe" /create /f /tn "SMTP Subsystem" /xml "C:\Users\Admin\AppData\Local\Temp\tmp842A.tmp"
                                                                    6⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:11468
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    "schtasks.exe" /create /f /tn "SMTP Subsystem Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp8796.tmp"
                                                                    6⤵
                                                                    • Scheduled Task/Job: Scheduled Task
                                                                    PID:9488
                                                                • C:\Users\Admin\AppData\Local\Temp\exploered.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\exploered.exe"
                                                                  5⤵
                                                                    PID:12876
                                                                    • C:\Users\Admin\AppData\Local\Temp\exploered.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\exploered.exe"
                                                                      6⤵
                                                                        PID:9796
                                                                • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-77e1bd3500fc49b0fba0eb509194ebec214ed2b6897d005f4c8c44f547cce08d.exe
                                                                  HEUR-Trojan-Ransom.MSIL.Blocker.gen-77e1bd3500fc49b0fba0eb509194ebec214ed2b6897d005f4c8c44f547cce08d.exe
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:816
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-77e1bd3500fc49b0fba0eb509194ebec214ed2b6897d005f4c8c44f547cce08d.exe" -Force
                                                                    4⤵
                                                                      PID:12072
                                                                    • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-77e1bd3500fc49b0fba0eb509194ebec214ed2b6897d005f4c8c44f547cce08d.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Ransom.MSIL.Blocker.gen-77e1bd3500fc49b0fba0eb509194ebec214ed2b6897d005f4c8c44f547cce08d.exe
                                                                      4⤵
                                                                        PID:9352
                                                                    • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-d57e6673c55c54c3b889ba42cb6f19cb2dd7df88edc0196f09f13cb5b6db925b.exe
                                                                      HEUR-Trojan-Ransom.MSIL.Blocker.gen-d57e6673c55c54c3b889ba42cb6f19cb2dd7df88edc0196f09f13cb5b6db925b.exe
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4504
                                                                      • C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"
                                                                        4⤵
                                                                          PID:7700
                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-d66ad74a267acf60def107f94b5277bb457de77fc34f1ebb21fc738388714ac8.exe
                                                                        HEUR-Trojan-Ransom.MSIL.Blocker.gen-d66ad74a267acf60def107f94b5277bb457de77fc34f1ebb21fc738388714ac8.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:3928
                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-4a1144075b9d0b0a9a445c09157248e7d0b9ae7613eede560402d92176e238ab.exe
                                                                        HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-4a1144075b9d0b0a9a445c09157248e7d0b9ae7613eede560402d92176e238ab.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        PID:2600
                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Cryptor.gen-af8dd6db724af64a438357fd5aaeb4598d7e2ce1efa49f3b9ddfaf5faf990c9e.exe
                                                                        HEUR-Trojan-Ransom.Win32.Cryptor.gen-af8dd6db724af64a438357fd5aaeb4598d7e2ce1efa49f3b9ddfaf5faf990c9e.exe
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:116
                                                                        • C:\Windows\SYSTEM32\cmd.exe
                                                                          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{11EA0D82-0DAC-4BC2-825A-B6B9A24F3A46}'" delete
                                                                          4⤵
                                                                            PID:4432
                                                                            • C:\Windows\System32\wbem\WMIC.exe
                                                                              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{11EA0D82-0DAC-4BC2-825A-B6B9A24F3A46}'" delete
                                                                              5⤵
                                                                                PID:5608
                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-57c9afd24206814049e8adfe20b4516b87f7ac5c1ae239782f348181c525a911.exe
                                                                            HEUR-Trojan-Ransom.Win32.GandCrypt.gen-57c9afd24206814049e8adfe20b4516b87f7ac5c1ae239782f348181c525a911.exe
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:4344
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 480
                                                                              4⤵
                                                                              • Program crash
                                                                              PID:5340
                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-57cc11a4eedfd631a54e4cc13949e319fc22c07116497fe3331d3d8b8c2f6769.exe
                                                                            HEUR-Trojan-Ransom.Win32.GandCrypt.gen-57cc11a4eedfd631a54e4cc13949e319fc22c07116497fe3331d3d8b8c2f6769.exe
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3088
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 21112
                                                                              4⤵
                                                                              • Program crash
                                                                              PID:676
                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Gen.gen-272cf31377e61a442abc83a05c2c24aca40155460cd0565b3ded8332341fbb96.exe
                                                                            HEUR-Trojan-Ransom.Win32.Gen.gen-272cf31377e61a442abc83a05c2c24aca40155460cd0565b3ded8332341fbb96.exe
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3656
                                                                            • C:\Users\Admin\AppData\Local\Temp\is-IQ0S1.tmp\HEUR-Trojan-Ransom.Win32.Gen.gen-272cf31377e61a442abc83a05c2c24aca40155460cd0565b3ded8332341fbb96.tmp
                                                                              "C:\Users\Admin\AppData\Local\Temp\is-IQ0S1.tmp\HEUR-Trojan-Ransom.Win32.Gen.gen-272cf31377e61a442abc83a05c2c24aca40155460cd0565b3ded8332341fbb96.tmp" /SL5="$3050C,15957492,66048,C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Gen.gen-272cf31377e61a442abc83a05c2c24aca40155460cd0565b3ded8332341fbb96.exe"
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:212
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\system32\cmd.exe" /C ""C:\yunbox\install-tap-x64.bat""
                                                                                5⤵
                                                                                  PID:9928
                                                                                  • C:\yunbox\devcon_x64.exe
                                                                                    devcon_x64 find tap0901
                                                                                    6⤵
                                                                                      PID:300
                                                                                    • C:\Windows\SysWOW64\find.exe
                                                                                      find "No matching devices found"
                                                                                      6⤵
                                                                                        PID:5324
                                                                                      • C:\yunbox\devcon_x64.exe
                                                                                        devcon_x64 install driver\OemWin2k.inf tap0901
                                                                                        6⤵
                                                                                          PID:5336
                                                                                      • C:\yunbox\usb_driver\setup_server_ung.exe
                                                                                        "C:\yunbox\usb_driver\setup_server_ung.exe"
                                                                                        5⤵
                                                                                          PID:9668
                                                                                        • C:\yunbox\UsbService64.exe
                                                                                          "C:\yunbox\UsbService64.exe" REG "Etung Technology Co.,Ltd" "000GYC-FFGH4K-6GJWTD-2GNFN2-1FY94N-B6Z47R-4EE06B-FC1E1C-F0057E-57E8F1-B559BE-26DF5F"
                                                                                          5⤵
                                                                                            PID:12240
                                                                                          • C:\yunbox\UsbService64.exe
                                                                                            "C:\yunbox\UsbService64.exe" INSTALL
                                                                                            5⤵
                                                                                              PID:8984
                                                                                            • C:\yunbox\UsbService64.exe
                                                                                              "C:\yunbox\UsbService64.exe" ENABLE
                                                                                              5⤵
                                                                                                PID:7620
                                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Generic-56627c61e7ce4f8073326fa9de1b2a249edfa0da9b59133224b2b9a7805b59f9.exe
                                                                                            HEUR-Trojan-Ransom.Win32.Generic-56627c61e7ce4f8073326fa9de1b2a249edfa0da9b59133224b2b9a7805b59f9.exe
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2748
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe"
                                                                                              4⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:4320
                                                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                wmic csproduct get uuid
                                                                                                5⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:5240
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 2404
                                                                                              4⤵
                                                                                              • Program crash
                                                                                              PID:2972
                                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Generic-58af017787140b35cab5c99f0974eddd49a3ff7fa04753f54b0b85ec7c772f78.exe
                                                                                            HEUR-Trojan-Ransom.Win32.Generic-58af017787140b35cab5c99f0974eddd49a3ff7fa04753f54b0b85ec7c772f78.exe
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            • Adds Run key to start application
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:64
                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                              dw20.exe -x -s 1268
                                                                                              4⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Checks processor information in registry
                                                                                              • Enumerates system info in registry
                                                                                              PID:6016
                                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Instructions.gen-34c068bcf39488069915770fb82b3343ad9bf1725ef10d8d7e65588cedc98bda.exe
                                                                                            HEUR-Trojan-Ransom.Win32.Instructions.gen-34c068bcf39488069915770fb82b3343ad9bf1725ef10d8d7e65588cedc98bda.exe
                                                                                            3⤵
                                                                                            • Drops startup file
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4068
                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UltraViewer.exe
                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UltraViewer.exe"
                                                                                              4⤵
                                                                                              • Drops startup file
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:5164
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd /c call "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\temp.bat"
                                                                                                5⤵
                                                                                                  PID:10844
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                cmd /c call "C:\Users\Admin\Desktop\00453\temp.bat"
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:5192
                                                                                            • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.JSWorm.gen-04f76d44db4c3a8d810348f65e539f8d65af3ee764c058290033da8f5c508fc5.exe
                                                                                              HEUR-Trojan-Ransom.Win32.JSWorm.gen-04f76d44db4c3a8d810348f65e539f8d65af3ee764c058290033da8f5c508fc5.exe
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              • Enumerates connected drives
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:3972
                                                                                            • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Redeemer.gen-7c0d4431fe5a730e588c6fa7a51f7c1f10063ab1cb91d4e7c74407cd12f60639.exe
                                                                                              HEUR-Trojan-Ransom.Win32.Redeemer.gen-7c0d4431fe5a730e588c6fa7a51f7c1f10063ab1cb91d4e7c74407cd12f60639.exe
                                                                                              3⤵
                                                                                              • Checks computer location settings
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Drops file in Windows directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry class
                                                                                              PID:5500
                                                                                              • C:\Windows\WIN_TEMP\svchost.exe
                                                                                                "C:\Windows\WIN_TEMP\svchost.exe" HEUR-Trojan-Ransom.Win32.Redeemer.gen-7c0d4431fe5a730e588c6fa7a51f7c1f10063ab1cb91d4e7c74407cd12f60639.exe
                                                                                                4⤵
                                                                                                  PID:5748
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /Quiet
                                                                                                    5⤵
                                                                                                      PID:7800
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c wevtutil clear-log Application
                                                                                                      5⤵
                                                                                                        PID:7888
                                                                                                        • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                          wevtutil clear-log Application
                                                                                                          6⤵
                                                                                                          • Clears Windows event logs
                                                                                                          PID:8168
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c wevtutil clear-log Security
                                                                                                        5⤵
                                                                                                          PID:8000
                                                                                                          • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                            wevtutil clear-log Security
                                                                                                            6⤵
                                                                                                            • Clears Windows event logs
                                                                                                            PID:11492
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c wevtutil clear-log Setup
                                                                                                          5⤵
                                                                                                            PID:12364
                                                                                                            • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                              wevtutil clear-log Setup
                                                                                                              6⤵
                                                                                                              • Clears Windows event logs
                                                                                                              PID:11812
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c wevtutil clear-log System
                                                                                                            5⤵
                                                                                                              PID:10212
                                                                                                              • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                wevtutil clear-log System
                                                                                                                6⤵
                                                                                                                • Clears Windows event logs
                                                                                                                PID:6272
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Windows\WIN_TEMP\rem.bat" "
                                                                                                              5⤵
                                                                                                                PID:2800
                                                                                                                • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                  wevtutil clear-log Application
                                                                                                                  6⤵
                                                                                                                  • Clears Windows event logs
                                                                                                                  PID:2460
                                                                                                                • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                  wevtutil clear-log Security
                                                                                                                  6⤵
                                                                                                                  • Clears Windows event logs
                                                                                                                  PID:13072
                                                                                                                • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                  wevtutil clear-log Setup
                                                                                                                  6⤵
                                                                                                                  • Clears Windows event logs
                                                                                                                  PID:7848
                                                                                                                • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                  wevtutil clear-log System
                                                                                                                  6⤵
                                                                                                                  • Clears Windows event logs
                                                                                                                  PID:12840
                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                  ping -n 5 127.0.0.1
                                                                                                                  6⤵
                                                                                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                  • Runs ping.exe
                                                                                                                  PID:14252
                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                  attrib -h -r -s *.*
                                                                                                                  6⤵
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:9436
                                                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe
                                                                                                            HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:5832
                                                                                                            • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe
                                                                                                              HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe
                                                                                                              4⤵
                                                                                                                PID:5720
                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                  icacls "C:\Users\Admin\AppData\Local\179beace-a7da-42d5-baa7-0c6842d7e4f0" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                  5⤵
                                                                                                                  • Modifies file permissions
                                                                                                                  PID:5744
                                                                                                                • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe
                                                                                                                  "C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                  5⤵
                                                                                                                    PID:9356
                                                                                                                    • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe
                                                                                                                      "C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                      6⤵
                                                                                                                        PID:7264
                                                                                                                • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Stop.gen-ec53d6c450d6b6c7cdc3655056128f0c6454eddf9e86e39793800214e16cb215.exe
                                                                                                                  HEUR-Trojan-Ransom.Win32.Stop.gen-ec53d6c450d6b6c7cdc3655056128f0c6454eddf9e86e39793800214e16cb215.exe
                                                                                                                  3⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5592
                                                                                                                • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-11c918def783a81e623897abe4977610d51bda2bcdd71004ccf2c7e02a8258db.exe
                                                                                                                  HEUR-Trojan.MSIL.Crypt.gen-11c918def783a81e623897abe4977610d51bda2bcdd71004ccf2c7e02a8258db.exe
                                                                                                                  3⤵
                                                                                                                    PID:6036
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-11c918def783a81e623897abe4977610d51bda2bcdd71004ccf2c7e02a8258db.exe"
                                                                                                                      4⤵
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      PID:8196
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qoPzOClK.exe"
                                                                                                                      4⤵
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      PID:3012
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qoPzOClK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3114.tmp"
                                                                                                                      4⤵
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:5668
                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qoPzOClK.exe"
                                                                                                                      4⤵
                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                      PID:9460
                                                                                                                    • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-11c918def783a81e623897abe4977610d51bda2bcdd71004ccf2c7e02a8258db.exe
                                                                                                                      "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-11c918def783a81e623897abe4977610d51bda2bcdd71004ccf2c7e02a8258db.exe"
                                                                                                                      4⤵
                                                                                                                        PID:12064
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                          dw20.exe -x -s 788
                                                                                                                          5⤵
                                                                                                                            PID:5568
                                                                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-11d865bb83565e4a5c248033ba2695daf00cfa6a3434fdc3fd4ee6ce238e631a.exe
                                                                                                                        HEUR-Trojan.MSIL.Crypt.gen-11d865bb83565e4a5c248033ba2695daf00cfa6a3434fdc3fd4ee6ce238e631a.exe
                                                                                                                        3⤵
                                                                                                                          PID:6052
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\allord.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\allord.exe"
                                                                                                                            4⤵
                                                                                                                              PID:11876
                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\allord.exe" "allord.exe" ENABLE
                                                                                                                                5⤵
                                                                                                                                • Modifies Windows Firewall
                                                                                                                                PID:8928
                                                                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-123fb2d18126d6bf04becd0184ee8c306211f6cc32a6dd099f33bf91caec58b1.exe
                                                                                                                            HEUR-Trojan.MSIL.Crypt.gen-123fb2d18126d6bf04becd0184ee8c306211f6cc32a6dd099f33bf91caec58b1.exe
                                                                                                                            3⤵
                                                                                                                              PID:6068
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\installutil.exe" /logtoconsole=false /logfile= /u "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-123fb2d18126d6bf04becd0184ee8c306211f6cc32a6dd099f33bf91caec58b1.exe"
                                                                                                                                4⤵
                                                                                                                                  PID:1508
                                                                                                                              • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-39206992b85eed86e84fece2d17c17d50dc950ba2466aed6986d5e8f9aff6621.exe
                                                                                                                                HEUR-Trojan.MSIL.Crypt.gen-39206992b85eed86e84fece2d17c17d50dc950ba2466aed6986d5e8f9aff6621.exe
                                                                                                                                3⤵
                                                                                                                                  PID:5200
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                    dw20.exe -x -s 900
                                                                                                                                    4⤵
                                                                                                                                      PID:5800
                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-54825845d63970436bf2a478a7fc8b23d49059ff0689884d310416d0fdf00df3.exe
                                                                                                                                    HEUR-Trojan.MSIL.Crypt.gen-54825845d63970436bf2a478a7fc8b23d49059ff0689884d310416d0fdf00df3.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:5632
                                                                                                                                      • C:\Users\Admin\AppData\Local\Tempj4dmjz31glv.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Tempj4dmjz31glv.exe"
                                                                                                                                        4⤵
                                                                                                                                          PID:8828
                                                                                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-58e4f159cf92476a1e7f452f9632ac320dbca9ef797cc6f11c6d171754eff016.exe
                                                                                                                                        HEUR-Trojan.MSIL.Crypt.gen-58e4f159cf92476a1e7f452f9632ac320dbca9ef797cc6f11c6d171754eff016.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:5996
                                                                                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-58e4f159cf92476a1e7f452f9632ac320dbca9ef797cc6f11c6d171754eff016.exe
                                                                                                                                            C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-58e4f159cf92476a1e7f452f9632ac320dbca9ef797cc6f11c6d171754eff016.exe
                                                                                                                                            4⤵
                                                                                                                                              PID:8832
                                                                                                                                            • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-58e4f159cf92476a1e7f452f9632ac320dbca9ef797cc6f11c6d171754eff016.exe
                                                                                                                                              C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-58e4f159cf92476a1e7f452f9632ac320dbca9ef797cc6f11c6d171754eff016.exe
                                                                                                                                              4⤵
                                                                                                                                                PID:8564
                                                                                                                                            • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe
                                                                                                                                              HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe
                                                                                                                                              3⤵
                                                                                                                                                PID:6048
                                                                                                                                                • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe
                                                                                                                                                  "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:13528
                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe
                                                                                                                                                    "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:13756
                                                                                                                                                    • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe
                                                                                                                                                      "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:12652
                                                                                                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe
                                                                                                                                                        "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:12116
                                                                                                                                                        • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe
                                                                                                                                                          "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-5adb53ca4445f20c2a26f896b636ad86b87ddff1aa85866a73a877f6ad1a51bc.exe"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:8184
                                                                                                                                                        • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-60200fdc37dec75226160d54f445926323b86a4cb4b2d47abfbe4cf70d0915de.exe
                                                                                                                                                          HEUR-Trojan.MSIL.Crypt.gen-60200fdc37dec75226160d54f445926323b86a4cb4b2d47abfbe4cf70d0915de.exe
                                                                                                                                                          3⤵
                                                                                                                                                            PID:5156
                                                                                                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-6275527e99e315350639d15b23daa1437f42aae5b3babe70a9457e92c407b5e9.exe
                                                                                                                                                            HEUR-Trojan.MSIL.Crypt.gen-6275527e99e315350639d15b23daa1437f42aae5b3babe70a9457e92c407b5e9.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:6104
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:10012
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:8176
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:6972
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:5756
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:7856
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:10972
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:7804
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:12128
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:6072
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:2412
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:13112
                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-705aca6a7344d554d001225e18db1e6e6e07111920908a63bc40b76b5330db3c.exe
                                                                                                                                                                                    HEUR-Trojan.MSIL.Crypt.gen-705aca6a7344d554d001225e18db1e6e6e07111920908a63bc40b76b5330db3c.exe
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:3900
                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Roaming\svhost.exe"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:6980
                                                                                                                                                                                          • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
                                                                                                                                                                                            5⤵
                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                            PID:8268
                                                                                                                                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-75c870b6143a75cd6794f043ae64ac7aa5d14db07666e479eb9850979509c610.exe
                                                                                                                                                                                        HEUR-Trojan.MSIL.Crypt.gen-75c870b6143a75cd6794f043ae64ac7aa5d14db07666e479eb9850979509c610.exe
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5452
                                                                                                                                                                                        • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-7a9d4df7a883709ff034b5f0e3eeb7130eea4710b8139287747b8304a27f6fad.exe
                                                                                                                                                                                          HEUR-Trojan.MSIL.Crypt.gen-7a9d4df7a883709ff034b5f0e3eeb7130eea4710b8139287747b8304a27f6fad.exe
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5952
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                              dw20.exe -x -s 860
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:6328
                                                                                                                                                                                            • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-7bb0f3485812173fec7e4e1ffda148631de33438cc9ece5bfb6f3ea0dc912a16.exe
                                                                                                                                                                                              HEUR-Trojan.MSIL.Crypt.gen-7bb0f3485812173fec7e4e1ffda148631de33438cc9ece5bfb6f3ea0dc912a16.exe
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:3612
                                                                                                                                                                                              • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-a8b4c75a35214f92f1f66e0558ce413bca2c6a2e72c81b9aa4cca5cf591d7f76.exe
                                                                                                                                                                                                HEUR-Trojan.MSIL.Crypt.gen-a8b4c75a35214f92f1f66e0558ce413bca2c6a2e72c81b9aa4cca5cf591d7f76.exe
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5912
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                    dw20.exe -x -s 956
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:8260
                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-a9559a774f3f0033860572648a32590e1a9cede55e446b74f99cfee164f913c3.exe
                                                                                                                                                                                                    HEUR-Trojan.MSIL.Crypt.gen-a9559a774f3f0033860572648a32590e1a9cede55e446b74f99cfee164f913c3.exe
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\yahoo.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\yahoo.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:8328
                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\yahoo.exe" "yahoo.exe" ENABLE
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Modifies Windows Firewall
                                                                                                                                                                                                            PID:10192
                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-acd08f6936a469469682ea71c509095bc8fbacc45bd3c0a0635bf537576e0da6.exe
                                                                                                                                                                                                        HEUR-Trojan.MSIL.Crypt.gen-acd08f6936a469469682ea71c509095bc8fbacc45bd3c0a0635bf537576e0da6.exe
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4888
                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Delegation-Visit.pdf"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:6948
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Postman\svchost.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Postman\svchost.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:7640
                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-bc0442b2ba19c60624cebf0db1f59bab8bcda2def780a10fc9122e8787961ff8.exe
                                                                                                                                                                                                              HEUR-Trojan.MSIL.Crypt.gen-bc0442b2ba19c60624cebf0db1f59bab8bcda2def780a10fc9122e8787961ff8.exe
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:6040
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 1036
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                  PID:7172
                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-d8b6a1df9cc1ed4e5ea14c1faa9e26b75138e2165f59d07fca89d3a1586fadfc.exe
                                                                                                                                                                                                                HEUR-Trojan.MSIL.Crypt.gen-d8b6a1df9cc1ed4e5ea14c1faa9e26b75138e2165f59d07fca89d3a1586fadfc.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4476
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                                                                                                                                                                                                                    dw20.exe -x -s 980
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:6488
                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-de75aa3380a8d5c6cf499fd5228decee0bd64ccbc4409267086c818e2b349c2d.exe
                                                                                                                                                                                                                    HEUR-Trojan.MSIL.Crypt.gen-de75aa3380a8d5c6cf499fd5228decee0bd64ccbc4409267086c818e2b349c2d.exe
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1876
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Payload.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:7708
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                          attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                                                                                          PID:5400
                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-e6b31514a1e9bd18ffcc77107d99efee5254756cfa9a3b03d99c18c9291b006f.exe
                                                                                                                                                                                                                        HEUR-Trojan.MSIL.Crypt.gen-e6b31514a1e9bd18ffcc77107d99efee5254756cfa9a3b03d99c18c9291b006f.exe
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:5348
                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-e6b31514a1e9bd18ffcc77107d99efee5254756cfa9a3b03d99c18c9291b006f.exe
                                                                                                                                                                                                                            "{path}"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:7988
                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-e6b31514a1e9bd18ffcc77107d99efee5254756cfa9a3b03d99c18c9291b006f.exe
                                                                                                                                                                                                                              "{path}"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:11104
                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-e6b31514a1e9bd18ffcc77107d99efee5254756cfa9a3b03d99c18c9291b006f.exe
                                                                                                                                                                                                                                "{path}"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:12832
                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-e85fed8e91f3a6eb07aaff42dec5aa4867078118399265c73f62de0f39f28ba4.exe
                                                                                                                                                                                                                                HEUR-Trojan.MSIL.Crypt.gen-e85fed8e91f3a6eb07aaff42dec5aa4867078118399265c73f62de0f39f28ba4.exe
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:7160
                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-e97a0c5b53e5a09050199bbcfb6a5abcf5037bef795fe0f034781e2d262287d5.exe
                                                                                                                                                                                                                                  HEUR-Trojan.MSIL.Crypt.gen-e97a0c5b53e5a09050199bbcfb6a5abcf5037bef795fe0f034781e2d262287d5.exe
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:7600
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 7600 -s 1232
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                      PID:7124
                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-f02e149d50c016213aa5831585fcc2cc5c7e9b2a345665540b9c0fcd41c12599.exe
                                                                                                                                                                                                                                    HEUR-Trojan.MSIL.Crypt.gen-f02e149d50c016213aa5831585fcc2cc5c7e9b2a345665540b9c0fcd41c12599.exe
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:8572
                                                                                                                                                                                                                                      • C:\Windows\SYSTEM32\netsh.exe
                                                                                                                                                                                                                                        netsh firewall add allowedprogram "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-f02e149d50c016213aa5831585fcc2cc5c7e9b2a345665540b9c0fcd41c12599.exe" "HEUR-Trojan.MSIL.Crypt.gen-f02e149d50c016213aa5831585fcc2cc5c7e9b2a345665540b9c0fcd41c12599.exe" ENABLE
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                        • Modifies Windows Firewall
                                                                                                                                                                                                                                        PID:8804
                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-fb58795f13ed862433bcd07344d12d26f423995b0ac6e1b91284a610bfaed04a.exe
                                                                                                                                                                                                                                      HEUR-Trojan.MSIL.Crypt.gen-fb58795f13ed862433bcd07344d12d26f423995b0ac6e1b91284a610bfaed04a.exe
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:7768
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-fb58795f13ed862433bcd07344d12d26f423995b0ac6e1b91284a610bfaed04a.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                          PID:13764
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jKPvDEUSgUffE.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                          PID:10884
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jKPvDEUSgUffE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE759.tmp"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                          PID:5508
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jKPvDEUSgUffE.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                          PID:2420
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:4988
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Cryptos.gen-61923d41809f54cd9e5fcf269b091b48b014a66eb57ab9756d0867f9fbec0665.exe
                                                                                                                                                                                                                                          HEUR-Trojan.MSIL.Cryptos.gen-61923d41809f54cd9e5fcf269b091b48b014a66eb57ab9756d0867f9fbec0665.exe
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:9176
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:7864
                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                  "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                    PID:7136
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:8244
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:13108
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:10460
                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                      PID:13180
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"c:\windows\system32\services32.exe"' & exit
                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                      PID:9668
                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"c:\windows\system32\services32.exe"'
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                        PID:7872
                                                                                                                                                                                                                                                    • C:\windows\system32\services32.exe
                                                                                                                                                                                                                                                      "C:\windows\system32\services32.exe"
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:11652
                                                                                                                                                                                                                                                        • C:\windows\system32\cmd.exe
                                                                                                                                                                                                                                                          "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:6004
                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                              PID:9608
                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                              PID:10880
                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                              PID:5672
                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                              powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                              PID:10172
                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"c:\windows\system32\services32.exe"' & exit
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:12628
                                                                                                                                                                                                                                                              • \??\c:\windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"c:\windows\system32\services32.exe"'
                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                PID:6488
                                                                                                                                                                                                                                                            • C:\windows\system32\microsoft\telemetry\sihost32.exe
                                                                                                                                                                                                                                                              "C:\windows\system32\microsoft\telemetry\sihost32.exe"
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:2944
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                                                                                                                                                                                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\00453\ERROR REPORT.txt
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:8140
                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Cryptos.gen-71c39017f5bb3201f0c5c8a3209a0f657ee089b469b03fbe8a042eb723b36619.exe
                                                                                                                                                                                                                                                            HEUR-Trojan.MSIL.Cryptos.gen-71c39017f5bb3201f0c5c8a3209a0f657ee089b469b03fbe8a042eb723b36619.exe
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:7636
                                                                                                                                                                                                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:2624
                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                    PID:7536
                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                    PID:14092
                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                    PID:13580
                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                    PID:9700
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"c:\windows\system32\services64.exe"' & exit
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:9656
                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Cryptos.gen-780385185c6d2071302bd13e74b5da57f79cb566fade841cce9ccc2c8a141e7b.exe
                                                                                                                                                                                                                                                                  HEUR-Trojan.MSIL.Cryptos.gen-780385185c6d2071302bd13e74b5da57f79cb566fade841cce9ccc2c8a141e7b.exe
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:6680
                                                                                                                                                                                                                                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:8868
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                          PID:6996
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                          PID:9932
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                          PID:6160
                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"c:\windows\system32\services32.exe"' & exit
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:1496
                                                                                                                                                                                                                                                                        • C:\windows\system32\services32.exe
                                                                                                                                                                                                                                                                          "C:\windows\system32\services32.exe"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:12720
                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Cryptos.gen-89b969d9fedd1111f5e62c55c6a8784b6bb445fdaf2895304916a219754d88b6.exe
                                                                                                                                                                                                                                                                          HEUR-Trojan.MSIL.Cryptos.gen-89b969d9fedd1111f5e62c55c6a8784b6bb445fdaf2895304916a219754d88b6.exe
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2804
                                                                                                                                                                                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                              "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:10964
                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                  PID:9928
                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                  PID:10044
                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                  PID:11900
                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                  PID:14104
                                                                                                                                                                                                                                                                            • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Cryptos.gen-ca541071c28f66421cab35b1019c784ad97ff98d16dd92ab60bb748e3605769a.exe
                                                                                                                                                                                                                                                                              HEUR-Trojan.MSIL.Cryptos.gen-ca541071c28f66421cab35b1019c784ad97ff98d16dd92ab60bb748e3605769a.exe
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:3472
                                                                                                                                                                                                                                                                                • C:\Windows\SYSTEM32\cmd.exe
                                                                                                                                                                                                                                                                                  "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:8996
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                      PID:10084
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                      PID:12184
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                      PID:13196
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                      • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                                                                                      PID:5804
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"c:\windows\system32\services32.exe"' & exit
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:8320
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                                                                                                                                                                                                        schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"c:\windows\system32\services32.exe"'
                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                                                                                                                                        PID:12980
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.Win32.Crypt.gen-4051eb7216e002cc6d827d781527d7556f4eb0f47bf092fc1a58b41b365252ec.exe
                                                                                                                                                                                                                                                                                    HEUR-Trojan.Win32.Crypt.gen-4051eb7216e002cc6d827d781527d7556f4eb0f47bf092fc1a58b41b365252ec.exe
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:3132
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:6876
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\setup_install.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\setup_install.exe"
                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                              PID:9532
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sahiba_1.exe
                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                  PID:1184
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\sahiba_1.exe
                                                                                                                                                                                                                                                                                                    sahiba_1.exe
                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                      PID:3168
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\sahiba_1.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\sahiba_1.exe" -a
                                                                                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                                                                                          PID:7880
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sahiba_2.exe
                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                        PID:10532
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sahiba_3.exe
                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                          PID:9000
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\sahiba_3.exe
                                                                                                                                                                                                                                                                                                            sahiba_3.exe
                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                              PID:12032
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 12032 -s 1840
                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                PID:1580
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sahiba_4.exe
                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                              PID:7520
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sahiba_5.exe
                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                PID:3020
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c sahiba_6.exe
                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                  PID:9316
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\sahiba_6.exe
                                                                                                                                                                                                                                                                                                                    sahiba_6.exe
                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                      PID:8480
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c sahiba_7.exe
                                                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                                                      PID:10116
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\sahiba_7.exe
                                                                                                                                                                                                                                                                                                                        sahiba_7.exe
                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                          PID:8968
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c sahiba_8.exe
                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                          PID:10224
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 9532 -s 552
                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                          PID:12268
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.Win32.Crypt.gen-48cf4a87a2514b23349fe3e9f943948e027c17292eb43d15833afd9a066f2f5c.exe
                                                                                                                                                                                                                                                                                                                    HEUR-Trojan.Win32.Crypt.gen-48cf4a87a2514b23349fe3e9f943948e027c17292eb43d15833afd9a066f2f5c.exe
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:9680
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan.Win32.Crypt.gen-48cf4a87a2514b23349fe3e9f943948e027c17292eb43d15833afd9a066f2f5c.exe
                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Desktop\00453\HEUR-Trojan.Win32.Crypt.gen-48cf4a87a2514b23349fe3e9f943948e027c17292eb43d15833afd9a066f2f5c.exe" -a
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:2304
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\00453\HEUR-Trojan.Win32.Crypt.gen-5c8ec8cd9735304b6c6bd23b8584272d1e746d325025e9213a99cc880ffa2b06.exe
                                                                                                                                                                                                                                                                                                                        HEUR-Trojan.Win32.Crypt.gen-5c8ec8cd9735304b6c6bd23b8584272d1e746d325025e9213a99cc880ffa2b06.exe
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:10436
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 10436 -s 256
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00453\HEUR-Trojan.Win32.Crypt.gen-a65e8cca4d7424ebda6db2a1b8dc9ae880aaf05bfa841bf5644e761b9deda75a.exe
                                                                                                                                                                                                                                                                                                                          HEUR-Trojan.Win32.Crypt.gen-a65e8cca4d7424ebda6db2a1b8dc9ae880aaf05bfa841bf5644e761b9deda75a.exe
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:9484
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:7900
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCDEA1C49\setup_install.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zSCDEA1C49\setup_install.exe"
                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                    PID:6916
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sahiba_1.exe
                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                        PID:12920
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCDEA1C49\sahiba_1.exe
                                                                                                                                                                                                                                                                                                                                          sahiba_1.exe
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                            PID:7652
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zSCDEA1C49\sahiba_1.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zSCDEA1C49\sahiba_1.exe" -a
                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                PID:7360
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sahiba_2.exe
                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                              PID:12936
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sahiba_3.exe
                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                PID:12964
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSCDEA1C49\sahiba_3.exe
                                                                                                                                                                                                                                                                                                                                                  sahiba_3.exe
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                    PID:10756
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 10756 -s 224
                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                                      PID:11332
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 10756 -s 232
                                                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                                                                                                                      PID:11096
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c sahiba_4.exe
                                                                                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                                                                                    PID:12972
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSCDEA1C49\sahiba_4.exe
                                                                                                                                                                                                                                                                                                                                                      sahiba_4.exe
                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                        PID:9960
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c sahiba_5.exe
                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                        PID:12984
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zSCDEA1C49\sahiba_5.exe
                                                                                                                                                                                                                                                                                                                                                          sahiba_5.exe
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                            PID:9588
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sahiba_6.exe
                                                                                                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                                                                                                            PID:12996
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sahiba_7.exe
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:13004
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c sahiba_8.exe
                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                PID:13020
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6916 -s 552
                                                                                                                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                                                                                                                • Program crash
                                                                                                                                                                                                                                                                                                                                                                PID:11432
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\00453\Trojan-Ransom.Win32.Bart.y-b9a9fe3e366d02858b19bce7fd5271ac4807a61b7b69b2cae85f40d9eddaddf5.exe
                                                                                                                                                                                                                                                                                                                                                          Trojan-Ransom.Win32.Bart.y-b9a9fe3e366d02858b19bce7fd5271ac4807a61b7b69b2cae85f40d9eddaddf5.exe
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:7624
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\notepad.exe
                                                                                                                                                                                                                                                                                                                                                              notepad.exe "C:\Users\Admin\Desktop\recover.txt"
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                              • Opens file in notepad (likely ransom note)
                                                                                                                                                                                                                                                                                                                                                              PID:10904
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Desktop\00453\Trojan-Ransom.Win32.Blocker.jboe-fc2ce30aad7514f646ad3d45e446ce4c5d3887830eb11c383579d247a1ca67a4.exe
                                                                                                                                                                                                                                                                                                                                                            Trojan-Ransom.Win32.Blocker.jboe-fc2ce30aad7514f646ad3d45e446ce4c5d3887830eb11c383579d247a1ca67a4.exe
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5948
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1968 -ip 1968
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:2024
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                            PID:2096
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3088 -ip 3088
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2224
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4344 -ip 4344
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5224
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6040 -ip 6040
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:6468
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 7600 -ip 7600
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:9096
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 10436 -ip 10436
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:9412
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 9532 -ip 9532
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:12020
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2304 -ip 2304
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:11912
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2748 -ip 2748
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:12224
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 10756 -ip 10756
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:64
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                              PID:5348
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:9136
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                PID:9304
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:11236
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:11356
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 10756 -ip 10756
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:10556
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 12032 -ip 12032
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:9412
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\recover.txt
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Opens file in notepad (likely ransom note)
                                                                                                                                                                                                                                                                                                                                                                                        PID:13864
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\recover.txt
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Opens file in notepad (likely ransom note)
                                                                                                                                                                                                                                                                                                                                                                                        PID:1416
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3504
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:13224
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:7688
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{cf093561-f293-4b42-a7bb-3d29fa60506f}\oemwin2k.inf" "9" "4d14a44ff" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "c:\yunbox\driver"
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:8440
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{4b92633c-16e6-5b47-a962-3aada2ea1731} Global\{9f768746-d9a1-334a-a366-93d06804fe05} C:\Windows\System32\DriverStore\Temp\{318eb2c0-a161-6647-937f-fba2e25a7bd2}\oemwin2k.inf C:\Windows\System32\DriverStore\Temp\{318eb2c0-a161-6647-937f-fba2e25a7bd2}\tap0901.cat
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:8700
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                    DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.9:tap0901," "4d14a44ff" "0000000000000154"
                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:12280
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{025c7ef2-db98-9d47-9ca8-16323a0c190f}\UsbStub.inf" "9" "46e3c610b" "0000000000000154" "WinSta0\Default" "0000000000000138" "208" "C:\yunbox\usb_driver"
                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:6916
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0ae604b1-24a5-b04a-8909-cc09598189f9}\vuh.inf" "9" "425e1bb63" "0000000000000138" "WinSta0\Default" "00000000000000B0" "208" "c:\yunbox\usb_driver"
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:13044
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                          DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem5.inf" "oem5.inf:741f41b5ee77f2a1:VUHUB_Device:7.0.1420.0:vuhub," "425e1bb63" "0000000000000138"
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                            DrvInst.exe "1" "0" "UsbEStub\Devices\0000" "" "" "455b45ca3" "0000000000000000"
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:12772
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                                                                                                                                                                                              DrvInst.exe "1" "0" "UsbEStub\Devices\0004" "" "" "4c5c6bf7f" "0000000000000000"
                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\179beace-a7da-42d5-baa7-0c6842d7e4f0\HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\179beace-a7da-42d5-baa7-0c6842d7e4f0\HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe --Task
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:8408
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x504 0x4f0
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7232
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\yunbox\UsbService64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\yunbox\UsbService64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2272

                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                                                                                                                                                  Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1059

                                                                                                                                                                                                                                                                                                                                                                                                                  PowerShell

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1059.001

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1547.001

                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.005

                                                                                                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                  File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1222

                                                                                                                                                                                                                                                                                                                                                                                                                  Hide Artifacts

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1564

                                                                                                                                                                                                                                                                                                                                                                                                                  Hidden Files and Directories

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1564.001

                                                                                                                                                                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                                                                                                                                                                  Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1562.004

                                                                                                                                                                                                                                                                                                                                                                                                                  Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1070

                                                                                                                                                                                                                                                                                                                                                                                                                  Clear Windows Event Logs

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1070.001

                                                                                                                                                                                                                                                                                                                                                                                                                  File Deletion

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1070.004

                                                                                                                                                                                                                                                                                                                                                                                                                  Modify Registry

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1112

                                                                                                                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                  Credentials from Password Stores

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1555

                                                                                                                                                                                                                                                                                                                                                                                                                  Credentials from Web Browsers

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1555.003

                                                                                                                                                                                                                                                                                                                                                                                                                  Unsecured Credentials

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1552

                                                                                                                                                                                                                                                                                                                                                                                                                  Credentials In Files

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1552.001

                                                                                                                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                                                                                                                                                  Remote System Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1018

                                                                                                                                                                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  6
                                                                                                                                                                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1016

                                                                                                                                                                                                                                                                                                                                                                                                                  Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                                                                                                                  Data from Local System

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1005

                                                                                                                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                  Web Service

                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                  T1102

                                                                                                                                                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\7-Zip\7-zip.chm.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    40b30d7ad8d0f7d082305baa4fc3efdc

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    878767ef2ba63d22d98f26fa2fb5787c3d3b1f41

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    102d994632d763903018414edfc95bcc78df6ea54077de25c4d0881dde6f4ed4

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    58b432ebeb87e69110bc3504057dcfc223d2f4737e0914365e7fdbb514a9d11d7fcfddb1ef5c7c16864f9c02d679c3945833256fade83b48678cc67bd5370ef9

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Program Files\7-Zip\7-zip32.dll
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    3da0b557b2d03c5a98856e558b20eee4

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    158c335509c74064def8946a968a1f4ecafeb32d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    66a894697446c440dcd2f34e95c7f92fa3d170b4aa05e5b361d592515fd782b3

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    fe6551cecdb97fa59bbce60242d0aa1a4428e37feff5a182bfabdbccc16217dd69d9930cde7ae08950f2ab899ec179f057d74c841714410bd430ae0d72b2bf0c

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Adobe\Setup\Read Me.TXT.bart
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    503cf823d94d859e361e7a9ecbd3230e

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    76167163ef8bf254cb91af2183e5e232474289e7

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    7d1759b12fa25f343b57dcca1edb50976571f2de1b62f4befa8362a3735e4422

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    6caf60aac382e8529d68c36c3a9c412bc317ac1244f0a3674dd263aa2f1d44a5f0eb365ffc816f9bb1a10ee814ab5eec5788f59103e2af136d72e227893532af

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Licenses\017EFB1F93C863837.Lic
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    247B

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    080bb326fad34ac6bfe933bde0d236e7

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    ba4233992d23ac99faa58c3061a145298b6c261c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    59583f8b398452f61be33059b8d9f2221d8e20eed107cdbdd2299f32d2237c48

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    a927fbb004328ff7fa7406c515dc226092bf7c8de01d6a6661d3df79fca7f94655324003fdd09c8403e84bdfe9f7e2ace1673ddb5ba3461493f280351731c868

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\Microsoft\AppV\readme.txt
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    efd2a14251a7fff6ec67a06d89ce476f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    085917c221753f3dac81d86b3bd009b838fd3da8

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    f31dbecd3d0f4bf253bb7be0f3395f477feead061f3d17829cfa1a0ce4ae110f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    87f4c16491a7f6a663f374c1c238ea3a821369d4f6f4f65f7e9692ba5d6b773cb244513cb3a76f25a8640a218ed8284c3223674c15d1b5e9486aba2a37bcf2ce

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\ProgramData\readme.txt
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    209bebca44f1680db30e0cde52e1227f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    b822c99aa478f5b05398e6fd901a8fa39bca9214

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    8c3c55f27100b177c7180df9adbaa6204ae1a08ef5cd6f339d8abc61d8d11d8a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    c1c45c5083f6f810c85e0e58a0e315b21a2a4b3b880089268e41516eb54d29f1697c35b61cd152f086bc6e34917c5bc0c039a265cd926c9fa77cbdb8d5c464c4

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Read Me.TXT
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    1adc49e786f79097b94731c1e39953e7

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    3c24f0f8915a25c06a9b001fbba71939de2acdfd

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    7fb86ba9a570d0baa3db24be7686fe7e061aba12df00b3c549ff77260ad9e0eb

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    35a803cfb60fd22ccf696c56192aada4089cc77686dede18b98d033161cd3c50364a66b686544813dcad772183bbad8d567bf062e55f81b7f561ef321c397214

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    64KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4B

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    944B

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    6bd369f7c74a28194c991ed1404da30f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    53KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    a26df49623eff12a70a93f649776dab7

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Postman\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    190KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    235b717eff6789b9f4b1f31d023782c2

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    fd4f716309c80be81e8eb2be788dd3b44dc62a6c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    0d75d20702f164618a8ffa8bb27da47eff5e03b06f2621621117d39aceb3325b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    76824a4cfec6f0414b25e2b0d248d7219551053f2e2dca4f3e0d7cf2eb4010987c16bb77ed0f1385804bd012277097b5cfc5d660976f4d4cb751f407d62afafe

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\sahiba_1.txt
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    712KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    6e43430011784cff369ea5a5ae4b000f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    5999859a9ddfcc66e41ff301b0eeb92ef0ce5b9f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    a5ab29e6fc308d1fe9fd056e960d7ccd474e2d22fb6a799d07086ec715a89d9a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    33ef732056182b9ab073d2eacfd71d3f1cb969ee038a19336fb5e0263a4e870742082c756a57010a26e7eab747a2332523d638f2570b8070b933bf957d2dea96

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSCDA42EB9\setup_install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    287KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    d26bf9aaed419111cf224888e2152c82

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    6de079fe56b4688b8b42cbe7d87aa29b0d03617b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    4fd3e74d5da8c634a3644e6c4506b6304b26d9611daf9378d4888a514c2b454e

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    0f0adf8ed88d1bf82981fec8899b2072ca3be6ce0af7daaad7fbcbd41df274eb03398d11644a35493c8f6033aa6c19708ae9894f4edc84fea5679279d0276fea

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Payload.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    217KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    07ce1773af95ad01769afbb1c8dc58d0

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    27c5f50a77ee8d45a109df14eab6ddbe3334f9db

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    de75aa3380a8d5c6cf499fd5228decee0bd64ccbc4409267086c818e2b349c2d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    38f6d771932b4e5317527c0368d1313f1d0871a6bc1298e368459c6bd30b9fa765d01ee192b88648f9ae0ecd17452e96d7f01531436b533347930127824306a4

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    415KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    ed32c38c66476e935cfc6c8f57a30c0f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    17f9ae68f8370af2e574c8779ea943407d80199d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    8e2e3ea04c25b94acb9eb2280b06910da3def8aff31a811cd87117c2db6d0f69

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    d51acec21ccc8e18309297930798e18a13c8438b613f530f5fc3ebefc1ff88bec147d88bbdcd456eab106fba0ad588e6780fb60163a1d2b228349b7d5eb7270e

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ohl41spw.c3s.ps1
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    60B

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\exploered.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    76KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    0e362e7005823d0bec3719b902ed6d62

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    590d860b909804349e0cdc2f1662b37bd62f7463

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-IQ0S1.tmp\HEUR-Trojan-Ransom.Win32.Gen.gen-272cf31377e61a442abc83a05c2c24aca40155460cd0565b3ded8332341fbb96.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    705KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    f0ba0a49113fd4878ac39f22eda5f23a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    3283addc6027ef5d00fd0cdc0da4a5073250543e

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    2e90ddeeb5d2b61d0940cb1a989b975f53b9cdc5bddbe2fabae2afdca905d34f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    0bfb7fbeaa884a4e880c26cc58272ed26aa6d9e1ccf913bc2c1d07159577184c8b959888efd2c20fcf7f59b7914588815ce44c8076e7b91f640194a90348157b

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nfq343.log
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    c72e02ea6e306f9528e29042952332e3

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    d4c25773a9f4a77ca3333ff6dac70d2716336e60

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    0775647eb752bd76feacf88813c03bad72d49dcfb5181fa47cf8f66f4a767ec9

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    067c0add82d911bc15be4463a7351eff6eb9102029bf4850581ca8c8b93cfa793b06ecdac87ab6fd10ad534be1bab357b298f2842ee117342449825b8a577c76

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nfq343.log
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    4f0b74926c53cdcec933a9a1973d9a9a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    fe47ee57605a25905056074b153fcb284436915a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    a446537f47936df972f14a03055ddc35230033da1e9381783be85a7704aee6f8

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    3621a818b9d443c076593bcd1ed04da620bf401b2e9971450fc84df9605185c5c9161d1146635d176c55ca65031838be6277a5422309afaea545c3932a25fad4

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nfq343.log
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    904B

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    a4e1a740b465f9ee233f94347aa8972c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    3d6dc51a781d945dbc22fba71e404c01bee67ce8

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    fbc79ec33f3e5a3aca67093b639656fc24939b24f3c2afb849ec8e0f5def4562

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    2337d6c698442a5820c8199b0e63b7032c5a42666b199d7e460d8c4a2223ef95cc1b8a9ab2d4491fa0e628aadf2d62b2a44c3685e19c5e3e49715c6483d9a6d3

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nfq343.log
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    778B

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    31cf02baf8cd366c7f2733f825dd43ad

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    b362b33742506e32b5705e962457e40531a6d256

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    b54f06350faa5c73fc0e0887ae03c8c85c50c1cde945a35c061246db9734360c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    02613fcb13c394be3f9866ba9ecc834b4ee89572bee0697f26789c80b2ecd1b66ae5236dca1d9fca854c29f363a044ed5067765225b9ab3a247434061dd58f9c

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nfq343.log
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    77d7079708ed65256d51c5597472adfc

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    37dc4ad5c9bff7978333412b8bec6f165e5fc823

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    6be948e1ce2aed74bfadfca4947fdf609064b510a8131d3f689a3f6f03a301a0

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    3ab5baf4bc57c046d530fd6bed941ec9cb2cac691ed0837a4f7ad2df6c108c2e09a8af60f6c72185770bcfbcf4df028ea7f39caff15751f5305163b0831db156

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nfq343.log
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    3KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    136b0f2ef06540fdeab26267fe86bb71

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    7077ce1630a3af182db497d78c3c33b1881c764e

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    df68e27a27a51ed953fef2cc22fd0b92a99ef8f37607f3f74e978bc2484d784a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    acc70acf51bfc237750ce7bc60fdabe4ce1c97907f4d09373784935bb1932c8308639c8eee3cb2a015934ffb4ff3061cd53b3d1dd1e746a33b495cd0636c3460

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\nfq343.log
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    fee608f332abd56064113b77c13637b3

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    0ced91ba5491813666cbb9af041d1fafe3f6c9a3

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    ff08bd776ebdd27eef6b3f7e1c9155ee3b168c484f47ee3785b12b8eb98cb184

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    b26a9fa01e6677b8e500b1e1bcaced95eb8d55169b55103646064153ed3f33aee9349a4366b48f995379e7f6c3f32f107107b848989d73905ee62835711b5b92

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    2.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    ed30f82e8a501dc7eda852317a3800ad

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    43a6be569f98441b1058f727e1db6e3b0a470b00

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    ad1e176431a2b8f76a4ef9504b36e20e9b0613337646ae181cca2122feb869c3

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    bf06998894d9d38b57ce5b78545f6d528352c8cc26ae3542ec09ea5c815ce8c3ae5297c289e07c0a4ac3d3c5f82d5dab014b0b4cc8f7c92aab43fba4d57d679c

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\yahoo.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    114KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    f3b1297853a8116a77680bfd07ca3395

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    cb415068a70e250d3ed96b822046be8db2b64a5c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    a9559a774f3f0033860572648a32590e1a9cede55e446b74f99cfee164f913c3

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    e13c6540da3c936758e4d44774a577111d1b9e49b24361617f38545aca005526895227172525f0b5a8f41760850dffa06b6ba8730a9623b4a3a2c33578947f34

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{025c7ef2-db98-9d47-9ca8-16323a0c190f}\UsbOverTcp.cat
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    b6b3bd28f89360ac0072effa9e11b197

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    b9013094bc54a306e7f9ce06aba056405e8be64e

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    c020dc93d497e4da8b96e6fbc39fd19fd1a066b42d1105a57a08679bcb27f2b9

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    85d6723647584afaf2fdf57435a4ad4cf07e607446d09787627dd96c44187dcdd48dfdc856819da20822fe94f77c4fcb1eb69d81ac014a35091179cf6761c991

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{025c7ef2-db98-9d47-9ca8-16323a0c190f}\UsbStub.inf
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    5748c4aa645aa77afaca660b44490568

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    e453c8d89c31df9935cfcefa91096362bdb22f0f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    40918d4deb7755190e895584db4b7d628fa7cba6a438cf8f729909a576a33f37

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    0dcbb6d5aceab7e2d296f63ec518b01804b2da3d80e109e2b61ec2aab7b71d7fb1f4616b4a5745bf3202bb4d17d2ba56088bf8ecc910c061148cf32ea55b8c9b

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{025c7ef2-db98-9d47-9ca8-16323a0c190f}\eusbstub.sys
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    38KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    684f15100146e82b4e2c4dd16f2b84da

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    3bf32badc2571ab2c3e80494a797dcdfed8f9b55

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    fe6a14fd54cf43a319bd8bc18a60eeb815e2a219b0325caac05cc1de45c6648a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    ed2b9e1c850eccc6427632df731e7429196ce242173cf4d06ee31b55591d43af7792bfce08c73b63dc789dd52a0f39379badcc600531f0e1422101f06ae5893e

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{0ae604b1-24a5-b04a-8909-cc09598189f9}\vuh.inf
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    0ea3e9c794607680bd0129c3b8091b04

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    74452b32c63e043be01cdbf6772a60d8539aef77

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    b6c6613f56de2cc26975871c12d182f1bb0916c2d783e639afb9c183697f65ac

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    fb3f1e4c9be3a63ea107e84f5d432ecc8973aa9b5cafce4d94b5cbf2ffd1d833da6bdde0ed0beb89932e1fe18fb450f9f838d0e62d3b897ffe7132e56f061eaf

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{0ae604b1-24a5-b04a-8909-cc09598189f9}\vuhub.sys
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    141KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    338f5da71d06d14d7079ad441e7d295f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    c6b67166f658f3dfdc0dbde3862e15e4e98cffc4

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    effed029765f7044abd34b17e2034c895ff5503123b371a356e274db5d6c61f9

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    2366923b60f25c004371f0ac5965bd2bdd7d7942552b6cfc4150fb89611b6932d6999b16c4e68e9a98cf18ed1977c546c530c6eacc5c75f0a4519bd4dde533c7

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{cf093561-f293-4b42-a7bb-3d29fa60506f}\oemwin2k.inf
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    7KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    b6aada0cbed06889053a05b66f146979

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    823025f02b355b37df7d7657b0f2b4d3584891a5

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    a6e72b88e42d2b478615c5a16bbedb3fd02b0dd3def3a79840fc6a5df8312707

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    9f8a6b0ad5ae4ea4c14043d663fd5aca2f1884ece0975b13c0533eb93103eb89120c1884121d71c8f9d09f5d210926fdba3b29fc6cf87f601bbc0f359c31d4ad

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{cf093561-f293-4b42-a7bb-3d29fa60506f}\tap0901.cat
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    10KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    0365c95d5be2b3d314dcc019380c0e11

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    c269cee763f580e890d2eae42a8e98116e04a232

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    6f997d53abfc991e23f08256fbde3eb21a1680af2e504b7accfef0f1d8909503

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    9acfc1ce0b46d3edc9708c16ae39a0707dcfc86fc6ba66f7e1712c383babde4c4cfb25338abe511429b67c39f2c2e30e0eb4c94e9987a7919e9b5cae53b4d24c

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{cf093561-f293-4b42-a7bb-3d29fa60506f}\tap0901.sys
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    39KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    3c32ff010f869bc184df71290477384e

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    9dec39ca0d13cd4aadf4120de29665c426be9f2b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    55cfcec7f026c6e2e96a2fbe846ab513bb12bb0348735274fe1b71af019c837b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    2443368fa5b93ebe112a169d1fff625a9a1a26f206dfeb6b85b4a2f9acec6ccfc7e821d15b69e93848cbad58b86c83114c83338162ea0fedd1a0798fab1700ff

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Tempj4dmjz31glv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    605KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    29352ba652ed1819e25a5a86410ee6a9

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    6a00a7b5ee6557d7f301765b6003fbdb24317481

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    ceab2fd26d664f585d45a828b1c6a42dcffd425fb6e0d5f2f7bac77f5268ea8f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    705ea631e51fac8c70182b7e2b2094350996040df83364f215f606fb6c3cab47e31f323413881b61769926950d5a06695c001f41e5705423e62a4bf477b43dec

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UltraViewer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    381KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    dee75e047bdddd928364874f3e6e2ff1

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    ec7f0058aac64af3bedf1aa5c5bb6d397d16cc4a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    ecfeae9d098a34aa6e4caac5af71c5a94ffa41b80eb183935355e845591746bc

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    60578402d5cca232b473402cfa47ff09f6fceeccb1e98e0f00585698a70ef6cf763736e05d544991e1283ba0eea1b202494cd65be42edba3f3d4d13d08f11a45

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\ammero.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    605e939e44cd9b02c55ce0a09019ad47

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    9ac8ff474631ed0c3d27a7290979b4880b9784f6

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    5ab99263d0101e00809c2fe1f068bbcb601208c3fb0efd753b36169a3a69c589

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    5196b9b698a71dc4510a57acabaee22ec2cd3f35c7c82c0ccbc00673ee97b471019a79e4cdb1ec6b5765ef70f1b5aebc19f56b0fa6a9932844c8ae07ba8b2b9d

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\jKPvDEUSgUffE.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    655KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    0457733ee1407154b5beaaaf616d528b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    67610e3e064c647fe33ae5db6313229eff3da673

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    fb58795f13ed862433bcd07344d12d26f423995b0ac6e1b91284a610bfaed04a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    44fafa6f4d6b83d95f2b2321762c69e158796614ec43cf5f2a7e623fd15bc7c003e28a0e40c4c618baf51b5f8d06dede4895b563db9c4495289adf4b9dbf3875

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\svhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    7b8a74f10af74e67ba0501396856c051

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    27bcb6dcb72a4447f523932df7ff0b6d6349df33

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    705aca6a7344d554d001225e18db1e6e6e07111920908a63bc40b76b5330db3c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    cd97a195b5c568b45a4e9598feb119495f1f875e55e771da83f10cfa33c3a1af444fee03eb540c185fd821ca6401bd3960217cf780c05d7beaeb8831bd44877f

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0d4bf92c3500426d3b79612b7da5a173f3b25edc7c65a33e25e6a3dde1c5fe9f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    844KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    664dc9604cf2fd1f410f3870f2d9f068

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    e196007389eadaa5f3c51df128cb908badf6a38f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    0d4bf92c3500426d3b79612b7da5a173f3b25edc7c65a33e25e6a3dde1c5fe9f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    3dbe91c2eb7424ca08fafd97345af704c7d36f2f0f8f4589beb30075f1a1f931ff20dd22fd0d6ff4cb8b17c0327b722c859d59737c7263525cfc14741d51330f

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-1dc556e37f06a18d2ab36615b3452f781f2a8e4ef70b07db8358737c0633bb23.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    6.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    cdde79b0e9580d47f8f6dc67fc46a4da

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    b4db212305ed3bfdd6b6e17da84c0a5577ccd173

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    1dc556e37f06a18d2ab36615b3452f781f2a8e4ef70b07db8358737c0633bb23

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    36a38ed25465373f9f00f368dea4fc56ae4a342879721a2f563384dda20be37514fa5d24126cc68e0ef5f0300e000013dc1f55800f9ad5877b5193cd8f257309

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-5d35385545b904e031114d34dcaf43a7a6ec529c353b274fb9350db37a371434.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    485KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    4a57c5bf2f9ce960e9389f5954dff958

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    51cb2549890d5e92a87a6eb7b24a40b69893440a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    5d35385545b904e031114d34dcaf43a7a6ec529c353b274fb9350db37a371434

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    494228e4195dc667a8d342912799b1d4c97fbb3a55f6a17a847e1c26f160079bee785e4f6d540a72b6c2969544567757af7e49828641fad4b5cfc9427ba763a3

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-6a05d81206eb43c79d99676dc8a20c06aa0f486c15c3c3d9b01a25e84532ebe9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    ad9a6ade1d8602474bf7eb34a0046e97

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    2c544ee597c6694edf5dd5628e6be58f90e86c77

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    6a05d81206eb43c79d99676dc8a20c06aa0f486c15c3c3d9b01a25e84532ebe9

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    abe5006baec71bc5e2fc245b600708aed1714348b282923fa62bc01a41f4970c5590a8ca38e4c01f0f3c93e8010220876984b5a6668aad1bbe8d8d8cba5327ab

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-77e1bd3500fc49b0fba0eb509194ebec214ed2b6897d005f4c8c44f547cce08d.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    5.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    5766abe6be756b57dbaafd9bd7e4f169

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    e2db8b21c72737e60f41cecec8a119f6693ad9c7

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    77e1bd3500fc49b0fba0eb509194ebec214ed2b6897d005f4c8c44f547cce08d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    c9fd102419e433f88560a94178a8e9010025a8c8df16dec36e50a109f1795d2c9c967174cc38f3f89efc85aeda5a30bc6b88fa83b9e365959f2288811031bd94

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-d57e6673c55c54c3b889ba42cb6f19cb2dd7df88edc0196f09f13cb5b6db925b.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    787KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    dfcd6737e5ad3f9ec87b80408a6f4801

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    c7e8fbf779f7d5b71a0d48d7d57bf0ed6ec2d170

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    d57e6673c55c54c3b889ba42cb6f19cb2dd7df88edc0196f09f13cb5b6db925b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    ebb6b0b1e066dd838349d3c9c293b2b780535fbda84bac781177f74955de28e8ba7c649fabc682067677ace58b8f8e90dab44f59dc21a2604b5a8213ae3aa22e

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.MSIL.Blocker.gen-d66ad74a267acf60def107f94b5277bb457de77fc34f1ebb21fc738388714ac8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    f56f3a9ff896c45c156b0c1c79f7588a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    c7637684c37641862a7eb082cbee0d08fcd29069

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    d66ad74a267acf60def107f94b5277bb457de77fc34f1ebb21fc738388714ac8

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    7b68a42c0b236719748b22bf161cd79bc3ae7704c66dc162a3a8f762c039faffb3acadb4658ef9f9ad37340f98b96a6cdb62ccead98214006de801b00d451573

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Crypmodadv.vho-4a1144075b9d0b0a9a445c09157248e7d0b9ae7613eede560402d92176e238ab.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    007d276dc0b42dd7881da2be5b08adf5

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    3fa7b181fc8cb8732104a1514c9c068303c2103f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    4a1144075b9d0b0a9a445c09157248e7d0b9ae7613eede560402d92176e238ab

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    23604076c92cfc82aa35d03d492829004f295b8d08ca608ce0c15e4575d74b2b49fd577bb5939f87d9a4562b80b12ddd567881461eb6c431bf52284e2e73069e

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Cryptor.gen-af8dd6db724af64a438357fd5aaeb4598d7e2ce1efa49f3b9ddfaf5faf990c9e.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    196KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    5b304155a6969a380ba19786e0f59d55

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    db474f5e0b0135430ce6b20b0c933b9a8bbdafe0

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    af8dd6db724af64a438357fd5aaeb4598d7e2ce1efa49f3b9ddfaf5faf990c9e

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    8f447c7cb366458f675d2527de73d26d20589603534201df11bc0a43775c6a613f13e1c15de25c2f62059f067775609ed38a939eb7c28f1176fcd1cdf1b18a70

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-57c9afd24206814049e8adfe20b4516b87f7ac5c1ae239782f348181c525a911.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    257KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    1d780209d6a2070d389ae6e617c0b262

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    1d01943a7c2fe839400a7c2cfbf77d4382bc5920

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    57c9afd24206814049e8adfe20b4516b87f7ac5c1ae239782f348181c525a911

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    27abe67cf5d46b3d3005d8c84540b1c9ab144116c974c71d9d038a75f9f410b2eccbb0f7da271591f92cc51a5335e4619f22606d8fbf291950b13c7bd7d6d9b3

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-57cc11a4eedfd631a54e4cc13949e319fc22c07116497fe3331d3d8b8c2f6769.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    176KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    ba8b9f11992b37c9408a98462cecd8b2

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    265b478f603e14ac8e95c353ed168ff9b49989ae

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    57cc11a4eedfd631a54e4cc13949e319fc22c07116497fe3331d3d8b8c2f6769

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    91862c4cccbec1890db9ab013e7164a7c7be91e4b59bdf45427e2ce675dc4760eeca838ca6f48d71f4f09ca5ed114d29f2bcfbd25b4ba5d35cdff80924debba4

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Gen.gen-272cf31377e61a442abc83a05c2c24aca40155460cd0565b3ded8332341fbb96.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    15.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    7ffb812af7466339759826b2c790c977

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    718ce2aaf1fdee571af4ffd735e63bc41a0aa2e7

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    272cf31377e61a442abc83a05c2c24aca40155460cd0565b3ded8332341fbb96

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    144adb5265402ddb1a45d95c32708f025c039775048d8773a2467fced663c9a0712c7dde97dc2f4af60e9c5c7569e5c363f497c40ae19b83299fbeef59bc9bd6

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Generic-56627c61e7ce4f8073326fa9de1b2a249edfa0da9b59133224b2b9a7805b59f9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    63KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    7d7fd9b5700e82db3f4bc42e23b80f0c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    e090ab8505838465a552b7589c73e769fb1cb744

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    56627c61e7ce4f8073326fa9de1b2a249edfa0da9b59133224b2b9a7805b59f9

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    34caf58eb78650f1f37ef029707af0ddcb9afd1d863a4db4c15b60e8b9e78b034ae9dffcf90d75d14fcd8e5ac976d3426d58d73dd4fdd811d3224bba13a38895

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Generic-58af017787140b35cab5c99f0974eddd49a3ff7fa04753f54b0b85ec7c772f78.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    7.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    f4756f0737300bf1873118b39ff4217a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    0c923b44a7ce85731a669806324b5f8a762c9658

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    58af017787140b35cab5c99f0974eddd49a3ff7fa04753f54b0b85ec7c772f78

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    e159c2ce9c3f0abc8d5c3b53a589fb5297d0a82df1ce5d053f1681004873399c15e496630f40fa85041ac47a0e0115f7f51b7446cd575e0637ead41a8025d930

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Instructions.gen-34c068bcf39488069915770fb82b3343ad9bf1725ef10d8d7e65588cedc98bda.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    558KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    e0cb0ba1518a438a3c243f63d93b7fbd

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    79777b4f0735d20e3e83b12f7c536cc39d8ed7d3

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    34c068bcf39488069915770fb82b3343ad9bf1725ef10d8d7e65588cedc98bda

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    9a544c69a2dc09b9ef2f79f9b69fbcae646d3860e011637c1ebcfac8d3c9797e2b42b2954e1deac4fde13b421f8fa6d404051bc5fb60a8fb68feab9080ee83e2

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.JSWorm.gen-04f76d44db4c3a8d810348f65e539f8d65af3ee764c058290033da8f5c508fc5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    127KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    d449503da4a13fd6e8c8f15dde16949b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    d9ede4f71e26f4ccd1cb96ae9e7a4f625f8b97c9

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    04f76d44db4c3a8d810348f65e539f8d65af3ee764c058290033da8f5c508fc5

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    71b602332851adb5549a8e780d351fd694691eb1c2dc286a7834d2d50a239a05aed8742e0e3b05fabfd8e272cd2fc68d3b6489d69ec3494c88f867f6e3eb8a6c

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Redeemer.gen-7c0d4431fe5a730e588c6fa7a51f7c1f10063ab1cb91d4e7c74407cd12f60639.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    44e76817e3eece02005f4c55c5451063

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    fca79486af800d2047f8f2b3a12518fb937445e5

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    7c0d4431fe5a730e588c6fa7a51f7c1f10063ab1cb91d4e7c74407cd12f60639

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    2a2cb6c055d092e09edb5b93fca1b5adfefa3e8b48432c1828bbbd6f70d9717ff541ea837dce808c74b103479d6f698d3d04dd762298361951c9cd0efbc4fd69

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Stop.gen-1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    766KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    220ac0f1dcf8dde9755f2b94d4e3c409

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    5f16547db81b0192caf39db3b348e16ce67f8cbb

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    1667fd2bfdda36fb586fd966d8c2d32961b152e86514b68ff9e7775cb9cd5677

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    ffe3de0bbd350c2d7bd8930bf474e9d12db2d578f9c5177c5639f2fc3ffd831b7389edfd06d6a52ddafebd3a167218338adc572b80cfd35a45d9bb02352fa15e

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan-Ransom.Win32.Stop.gen-ec53d6c450d6b6c7cdc3655056128f0c6454eddf9e86e39793800214e16cb215.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    450KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    3055a0e7f51de111d2ac97c51259bc8e

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    6675122e4095e603bc255f52e5fea4a154e70554

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    ec53d6c450d6b6c7cdc3655056128f0c6454eddf9e86e39793800214e16cb215

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    7e80787798979c560386f85f3905c017c125e42f470a05984b19c8015349888d0dc430d8442c0c2f1a7738f939be2ce61a9152ffda592cf7ca586c27ce0f6414

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-11c918def783a81e623897abe4977610d51bda2bcdd71004ccf2c7e02a8258db.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    8cc4e94ce78d076cec99f5663d3650df

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    b275c4b4de7d148fc3a511162e4e55900fe7eead

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    11c918def783a81e623897abe4977610d51bda2bcdd71004ccf2c7e02a8258db

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    f294ee820330d6533effcbff1e257831afaee2479ae02340265397739f4a339815f6c5635acf7656068976d93b166ba43a6c6894549d53f7c167a4deba40cc83

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-11d865bb83565e4a5c248033ba2695daf00cfa6a3434fdc3fd4ee6ce238e631a.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    130KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    f2b34ef2573016d68d91345bb8f4d256

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    8db2368a2d069bc5595d2dd4d69814e107b82460

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    11d865bb83565e4a5c248033ba2695daf00cfa6a3434fdc3fd4ee6ce238e631a

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    4bc64621be12500a9740da71a49145476a39139ebdbeb6578b2970c12069437c2de8f37cc3dc95931b979dea58f2d9594f3a3060dca79022b6097d895d99d6f2

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-123fb2d18126d6bf04becd0184ee8c306211f6cc32a6dd099f33bf91caec58b1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    905KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    4614f5a7fac48259c1e5fc7995b59649

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    1e27ad2ab509575841f36ed1b2d81fc9a4ba65bc

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    123fb2d18126d6bf04becd0184ee8c306211f6cc32a6dd099f33bf91caec58b1

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    0d13c2b3ed2659912132899f27651c16ca35b9612b406abc786927f4da5bae7a8b71d946d3e20823d3cabc294dc37f9e3c9de2cabd66c26badc12a04eaafb4f7

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-39206992b85eed86e84fece2d17c17d50dc950ba2466aed6986d5e8f9aff6621.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    68e0c2bab9e346283d3559b5bb6f5770

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    518851caecbab02f1beea7402fa04ca46104e73b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    39206992b85eed86e84fece2d17c17d50dc950ba2466aed6986d5e8f9aff6621

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    3581afa487f3d9d550b0a8e54842d09b41659ab58043fb8baa2920a221a771e85dd869919b822b9d528aa598439c5cd0a71714be15ab22ab672d6fd7f0e752fe

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-54825845d63970436bf2a478a7fc8b23d49059ff0689884d310416d0fdf00df3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    018ab4bb53556c41703f0fadaedfdf4b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    c7f429cd6df6c9a3fdfd089a461b54cf25fcce69

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    54825845d63970436bf2a478a7fc8b23d49059ff0689884d310416d0fdf00df3

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    56870e09e8b290f726544db540551c9221f8041793c21a3bd7ff9cf2515e0be03f23e41504789ad2029e2190548c807603cab2c4bedb18a8284eede5c7e1d2ba

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-58e4f159cf92476a1e7f452f9632ac320dbca9ef797cc6f11c6d171754eff016.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    513KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    fec2979ba6c288121b614b719576432c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    60911d1d6ed465fe00e6f1e856789562572b2eb8

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    58e4f159cf92476a1e7f452f9632ac320dbca9ef797cc6f11c6d171754eff016

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    2beb09ea2f488aa149546e43712985a9dc01c1851893a55d85536ee084b9f42f477f8aba76a1a8eef57b54df334d8bb8ada9c00bdd10c3d41319901468add8ce

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-60200fdc37dec75226160d54f445926323b86a4cb4b2d47abfbe4cf70d0915de.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    2.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    5be589c1142af851f65c3223a9f69a7d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    fb4ca9243604b0c6c87606ec62148a221697488c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    60200fdc37dec75226160d54f445926323b86a4cb4b2d47abfbe4cf70d0915de

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    527c1c45a54f8db44ca8c3d0381295833072b401e5f6cb2d7faf0887f9ff44bfc025585f06b302ecaaf86572241cc4fdb74a30e0d1d1d0ac43899993eee5e3ff

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.MSIL.Crypt.gen-6275527e99e315350639d15b23daa1437f42aae5b3babe70a9457e92c407b5e9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    429KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    2c6f9885e158b423d8a42b132750df1b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    d79ba7d3fac16a216e35df19cdd64564913de16f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    6275527e99e315350639d15b23daa1437f42aae5b3babe70a9457e92c407b5e9

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    4825e2a6d17ad0428aaad9f44e24c02a4f6487fbf7eb97887c847a1637a1e923b113717e9b22da57a0e6a4606c65f793969e8b225319db50dad4bfa007048ce9

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\HEUR-Trojan.Win32.Crypt.gen-4051eb7216e002cc6d827d781527d7556f4eb0f47bf092fc1a58b41b365252ec.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    2.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    969a631044715e387f3b7cd7c64fdb63

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    8ea2c93cab54022165a5ca92ae663b04fcdfc97c

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    4051eb7216e002cc6d827d781527d7556f4eb0f47bf092fc1a58b41b365252ec

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    0546920e791e7d7be8755564950c68a570dfa543be9c4b043e406dcec08ff189cae19b1aa27c0e9850883328bba51ceeda33d107a9e017261363bb788507865c

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Desktop\00453\temp.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    31B

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    7a0eff075565cd423f38ac466fc53569

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    1bfd204eda2eeac7a5b8a1eac7f715eedc0b2661

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    17a0fd4cc8995e18103165585b73e5e39e46f5d600e45a7302ee91801efb1ac4

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    c551f31e745110223d1357cfd0b5ae9a58bb53ae86baaca9347d12ef489fc5bb9f2f1090fc956894bf2eae4cdcd511619f8ceee5eed4780cc61819c09915bf0c

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\Pictures\recover.txt
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    2KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    d0293ceed8665943d61a95b7f90df40e

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    e11821ea65b875ba1514df555c860d8991de1f13

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    6fcd88dec847f2903bfedb056bd1ab93a49649e7c64b01d195bb966d9cfb0e19

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    8272837ad540186edb6b6d2bf4b33a9a0a4bb714902a28993e49bd2e59e6a33144df007a22f62162d43f0ecaf9ac70f557073870afd1be860ee26acb23b8626b

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Public\readme.txt.bart
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    894fe08961822fbc9dba57a3c7861286

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    666d8922acd9612805774edeaf359322f0ca51d8

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    35165f83c52d97d4ba4ca66ef66c28901286e00b210a1091328dbf3b85d0d7a6

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    bcd74c08489fd0393b31f68d34c6affff0cc94d45a81811b479eb2829b70e7aeb76a5db6ed591266094f5daab7f6ea2f7252989a8ad7335665ac1c5408d61b1b

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\Microsoft\telemetry\sihost32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    50KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    665596c5f64c72eb78f372ea653ae2c3

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    10ead6d4abafe8e33cd82eb0791275ecfc5cf131

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    a543a3a55593a75593b478462ac0a4634bc56a407f0f21cdc64a1b487401b6ce

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    93f6a975ddc0a787234b64fb2c3b2daf59affb00243f52b413389a9361dd72389978522afddb07c71a4cace7583b969b548d3640eb968cab3e52e286866af0ab

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\services64.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    296KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    2ec08b3c14aa597d433f23af97924765

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    211789a9aa6e4b865e4ce5ad19e38e84c1ff9147

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    71c39017f5bb3201f0c5c8a3209a0f657ee089b469b03fbe8a042eb723b36619

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    ea1b9fe7ad6ced78b289055a492997f067e9f087e547f854d8774fcf440876388620cf200edf1ba5f866fda1bcd6afbd5cf7d492b5afa7d8121fe0da7f2b9126

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.PMFXA
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    170KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    e6f7135d1f3041ac20fd44e229aada6f

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    ae44667727eb87c82411a76ca9ec9cecae7b1c2b

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    de36b8387391f9f927caf6db3c2a8cda309b974e3de6b4d5b20e09b4241187fd

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    dbad7ee4c691210c96fda920be51436f929d710ef7fe73174f05676988f5aba22c7a9efc9bd3647008e9eebdce68e5a0c7005e934fe0d609ac67f1cf580966a7

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\yunbox\driver\_readme.txt
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1KB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    9d53234c65ceeba6d92f891528f2b44d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    4ece1d4a7f32d9931918a08152828f2c72916e52

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    a45b8a6a6aa7fee16e5312c3f00c281563762b3ccc5276ac2236dda833c5e281

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    965ad5e37d0a48f226b2eab0d879e7bcc70650d227b71d56a676020f46388060cad651fe71048d4d2c025bc3cb6edc03837fef333d7325722b4291901a0459f9

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\yunbox\yunbox_virhub.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                    MD5

                                                                                                                                                                                                                                                                                                                                                                                                                    796a06a12c3ed74855de583b6f932c78

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                    5be22bf3d1e85a86667abec9c7f37465da195b1d

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                    897b76be257c9dd7f311080d02d608f2f7bc25cfd51e7539bd79840a35017553

                                                                                                                                                                                                                                                                                                                                                                                                                    SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                    4f09170c7c3e7bb25164a0af150a5ec7bd0ace3d9f296becee324b1576ccf3623f7d1c3a9b2dab33aff4d8fca832e2c193004652c30d441186e899df2de80867

                                                                                                                                                                                                                                                                                                                                                                                                                    Download Submit

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/816-2163-0x000000001D470000-0x000000001D960000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/816-2189-0x000000001D960000-0x000000001D9D4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/816-233-0x0000000000220000-0x000000000073E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    5.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1968-220-0x0000000000E30000-0x0000000000F04000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    848KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1968-234-0x0000000005820000-0x0000000005886000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    408KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2600-245-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2600-507-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2748-299-0x0000000000140000-0x0000000000156000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2804-3560-0x0000000000170000-0x0000000001DFA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    28.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3004-221-0x00000000002C0000-0x000000000039A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    872KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3088-314-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    268KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3088-313-0x00000000005C0000-0x00000000005D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    92KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3464-5354-0x000000001E2E0000-0x000000001E34A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    424KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3464-4864-0x000000001FDA0000-0x0000000020406000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    6.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3464-219-0x0000000000C40000-0x00000000012D8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    6.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3472-4319-0x00000000008C0000-0x00000000008DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    112KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3612-513-0x00000000007E0000-0x0000000000874000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3612-522-0x0000000004F20000-0x0000000004F58000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    224KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3656-286-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    92KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3900-540-0x000000001BC00000-0x000000001BC9A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    616KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3900-514-0x0000000000460000-0x00000000007AC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3928-247-0x0000000000CD0000-0x0000000000CD6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    24KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3928-246-0x0000000000510000-0x000000000052C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    112KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-171-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-175-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-166-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-165-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-172-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-170-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-176-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-173-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-174-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3964-164-0x000001F78E960000-0x000001F78E961000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4344-276-0x0000000001F10000-0x0000000001F2B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    108KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4344-337-0x0000000000400000-0x0000000000446000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    280KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4344-338-0x00000000020C0000-0x00000000020D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    92KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4420-225-0x0000000000790000-0x00000000008EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4420-227-0x0000000005220000-0x00000000052B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    584KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4420-226-0x0000000005730000-0x0000000005CD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4420-229-0x0000000005620000-0x00000000056BC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    624KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4420-228-0x00000000052C0000-0x0000000005614000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    3.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4504-306-0x0000000006EC0000-0x0000000006EE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4504-239-0x0000000000E80000-0x0000000000F4C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    816KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4504-4493-0x0000000009B00000-0x0000000009B06000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    24KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4504-4492-0x0000000007660000-0x0000000007674000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4504-305-0x0000000006E40000-0x0000000006E68000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    160KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4888-876-0x0000000000C80000-0x0000000000DF8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5020-206-0x000002A33F500000-0x000002A33F51E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5020-204-0x000002A33F540000-0x000002A33F5B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5020-203-0x000002A33F470000-0x000002A33F4B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    272KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5020-202-0x000002A33D000000-0x000002A33D022000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5156-515-0x0000000000520000-0x000000000077E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    2.4MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5156-523-0x0000000004E20000-0x0000000004ECE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    696KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5348-521-0x00000000006D0000-0x00000000007C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    960KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5348-2000-0x0000000006440000-0x0000000006448000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5452-512-0x00000000006F0000-0x000000000070C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    112KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5500-419-0x0000000000400000-0x00000000005BB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5632-873-0x0000000000130000-0x0000000000138000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5720-503-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5720-506-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-620-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-579-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-570-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-585-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-587-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-575-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-622-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-581-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-577-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-583-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-567-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-624-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-566-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-574-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5912-572-0x0000000004B60000-0x0000000004BF4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    592KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5948-5166-0x0000000000400000-0x000000000042B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    172KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5996-499-0x0000000000D90000-0x0000000000E0A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    488KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5996-519-0x0000000005700000-0x0000000005776000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    472KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5996-524-0x00000000056A0000-0x00000000056BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5996-1749-0x0000000005780000-0x00000000057BA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    232KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6040-516-0x0000000000460000-0x000000000047C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    112KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6040-518-0x0000000000D20000-0x0000000000D28000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6048-538-0x0000000004F70000-0x0000000004F7A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6048-1981-0x0000000006650000-0x0000000006666000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6048-517-0x00000000004B0000-0x00000000006B8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    2.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6048-539-0x0000000005230000-0x0000000005286000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    344KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6104-510-0x00000000019A0000-0x00000000019B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    80KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6104-508-0x0000000000FA0000-0x0000000000FF8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    352KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6104-509-0x0000000001980000-0x00000000019A4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    144KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6680-5355-0x00000000013A0000-0x00000000013AA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6680-2148-0x00000000005C0000-0x00000000005CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    48KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6916-7917-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6916-7915-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    152KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6916-7916-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7600-2002-0x0000000000740000-0x000000000076A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    168KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7600-2039-0x0000000004E50000-0x0000000004E5A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7636-4865-0x00000000015F0000-0x00000000015FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    56KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7636-2104-0x0000000000760000-0x00000000007AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    312KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7636-4866-0x0000000002DD0000-0x0000000002DE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7636-4867-0x0000000002E10000-0x0000000002E1A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    40KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7640-4011-0x0000000000830000-0x0000000000866000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    216KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7700-5304-0x0000000000520000-0x000000000055C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7768-2077-0x0000000000E80000-0x0000000000F2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    680KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7768-2083-0x0000000005780000-0x00000000057F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    464KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7768-2133-0x0000000005930000-0x0000000005946000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    88KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7864-6191-0x0000000002AC0000-0x0000000002AD2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7864-5766-0x0000000000D70000-0x0000000000D92000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7864-2117-0x0000000000420000-0x000000000048C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    432KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/7864-2137-0x0000000000D20000-0x0000000000D42000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    136KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8564-2069-0x0000000005320000-0x0000000005938000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    6.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8564-2071-0x0000000004E30000-0x0000000004E6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    240KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8564-2070-0x0000000004D90000-0x0000000004DA2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    72KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8564-2063-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    120KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8564-2078-0x0000000005940000-0x0000000005A4A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8564-2075-0x0000000004F70000-0x0000000004FBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    304KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8572-2054-0x000000001C8F0000-0x000000001C98C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    624KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8572-2046-0x0000000000EC0000-0x0000000000EDC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    112KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8572-7712-0x0000000000D30000-0x0000000000D38000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    32KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8572-2047-0x000000001B470000-0x000000001B516000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    664KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8572-2040-0x000000001BA80000-0x000000001BF4E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    4.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8828-2087-0x000000001B1E0000-0x000000001B292000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    712KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8828-2086-0x00000000023C0000-0x0000000002410000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    320KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/8828-2045-0x00000000001A0000-0x000000000023E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    632KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/9532-5765-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/9532-4506-0x0000000000400000-0x000000000051E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/9532-5763-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    152KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/9532-5764-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    572KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/10436-4447-0x0000000000400000-0x0000000000475000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    468KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/10436-5188-0x0000000000400000-0x0000000000475000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                    468KB

                                                                                                                                                                                                                                                                                                                                                                                                                    Download