Overview

overview

10

Static

static

1

RNSM00411.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    214s
  • max time network
    216s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-10-2024 17:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00411.7z

  • Size

    32.5MB

  • MD5

    96bfb62905f39619b7b785f8099c90c7

  • SHA1

    31259c5c39795fea53fa028c77f4cf4bf15a729b

  • SHA256

    ced8995052eb04eaa76fabfe606a380258bf803cc4b93202f135055663e3001d

  • SHA512

    7a6a32de9b60531472ab5cc485de10a783fe3ff8fb636e0aa5a02bc16d58e62121ccfcfbb82fc995153151a77480dc6cf8a0972358a2ed1fd02cbe391de89805

  • SSDEEP

    393216:/b8jdwLefLCFCsbafJ/PCYRcei2yDNyJtUMNouhGwhU4AJ1r0J+mhoEhN:T+bLGCsbgzfOJMeuhaJQh7hN

Score
10/10
banloadcrimsonratgandcrabagilenetaspackv2backdoorcredential_accessdiscoverydownloaderdropperevasionpersistenceprivilege_escalationransomwareratspywarestealerthemidatrojan

Malware Config

Extracted

Family

crimsonrat

C2

172.245.87.12

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Crimsonrat family
    crimsonrat
  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (55) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    evasion
  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 5 IoCs
  • Executes dropped EXE 59 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies registry class 17 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00411.7z"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3848
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Drops startup file
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1240
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3516
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.MSIL.Foreign.gen-c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54.exe
        HEUR-Trojan-Ransom.MSIL.Foreign.gen-c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54.exe
        3⤵
        • Executes dropped EXE
        PID:4296
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.MSIL.Gen.gen-674f97840252e8ea3752d8e80a3a60abddaa4633d6b5faa4aa327889a0b649f8.exe
        HEUR-Trojan-Ransom.MSIL.Gen.gen-674f97840252e8ea3752d8e80a3a60abddaa4633d6b5faa4aa327889a0b649f8.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1576
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.MSIL.Trumper.gen-c2b66b94a8210a6608ddbca8915d7d03445d0b61e909a1d5175dc238f25a371c.exe
        HEUR-Trojan-Ransom.MSIL.Trumper.gen-c2b66b94a8210a6608ddbca8915d7d03445d0b61e909a1d5175dc238f25a371c.exe
        3⤵
        • Drops startup file
        • Executes dropped EXE
        PID:2928
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Blocker.gen-1f6f8abb93623e981f8211dcb7b2ef9d8f6ce469b35968cc54806af7c7ba2efe.exe
        HEUR-Trojan-Ransom.Win32.Blocker.gen-1f6f8abb93623e981f8211dcb7b2ef9d8f6ce469b35968cc54806af7c7ba2efe.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAaQByAGUAVwBhAGwAbABSAGUAZwBpAHMAdABlAHIAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABEAGUAcwBrAHQAbwBwAFwAMAAwADQAMQAxAFwASABFAFUAUgAtAFQAcgBvAGoAYQBuAC0AUgBhAG4AcwBvAG0ALgBXAGkAbgAzADIALgBCAGwAbwBjAGsAZQByAC4AZwBlAG4ALQAxAGYANgBmADgAYQBiAGIAOQAzADYAMgAzAGUAOQA4ADEAZgA4ADIAMQAxAGQAYwBiADcAYgAyAGUAZgA5AGQAOABmADYAYwBlADQANgA5AGIAMwA1ADkANgA4AGMAYwA1ADQAOAAwADYAYQBmADcAYwA3AGIAYQAyAGUAZgBlAC4AZQB4AGUAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADMAPgA8AFAAYQByAGEAbQA0AD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2528
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall set rule name="HEUR-Trojan-Ransom.Win32.Blocker.gen-1f6f8abb93623e981f8211dcb7b2ef9d8f6ce469b35968cc54806af7c7ba2efe.exe" program="C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Blocker.gen-1f6f8abb93623e981f8211dcb7b2ef9d8f6ce469b35968cc54806af7c7ba2efe.exe" new dir=in enable=yes action=allow edge=yes
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3604
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="HEUR-Trojan-Ransom.Win32.Blocker.gen-1f6f8abb93623e981f8211dcb7b2ef9d8f6ce469b35968cc54806af7c7ba2efe.exe" dir=in action=allow program="C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Blocker.gen-1f6f8abb93623e981f8211dcb7b2ef9d8f6ce469b35968cc54806af7c7ba2efe.exe" enable=yes edge=yes
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3584
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEUAbgBhAGIAbABlAFUAQQBDACIAPgA8AFAAYQByAGEAbQAxAD4APAAhAFsAQwBEAEEAVABBAFsARgBBAEwAUwBFAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQAzAD4APABQAGEAcgBhAG0ANAA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
          4⤵
          • UAC bypass
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          • System policy modification
          PID:8
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1820
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBTAFoAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwAVABlAGUAbgB1AHAAQwBsAGkAZQBuAHQAUwBUAF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBVAFIATAAgAFAAcgBvAHQAbwBjAG8AbABdAF0APgA8AC8AUABhAHIAYQBtADMAPgA8AFAAYQByAGEAbQA0AD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4904
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXABzAGgAZQBsAGwAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3788
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXABzAGgAZQBsAGwAXABvAHAAZQBuAF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADMAPgA8AFAAYQByAGEAbQA0AD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4368
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXABzAGgAZQBsAGwAXABvAHAAZQBuAFwAYwBvAG0AbQBhAG4AZABdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQAzAD4APABQAGEAcgBhAG0ANAA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:4812
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBTAFoAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwAVABlAGUAbgB1AHAAQwBsAGkAZQBuAHQAUwBUAFwAcwBoAGUAbABsAFwAbwBwAGUAbgBcAGMAbwBtAG0AYQBuAGQAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwAiAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEQAZQBzAGsAdABvAHAAXAAwADAANAAxADEAXABIAEUAVQBSAC0AVAByAG8AagBhAG4ALQBSAGEAbgBzAG8AbQAuAFcAaQBuADMAMgAuAEIAbABvAGMAawBlAHIALgBnAGUAbgAtADEAZgA2AGYAOABhAGIAYgA5ADMANgAyADMAZQA5ADgAMQBmADgAMgAxADEAZABjAGIANwBiADIAZQBmADkAZAA4AGYANgBjAGUANAA2ADkAYgAzADUAOQA2ADgAYwBjADUANAA4ADAANgBhAGYANwBjADcAYgBhADIAZQBmAGUALgBlAHgAZQAiACAAIgAlADEAIgBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3584
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAUAByAG8AdABvAGMAbwBsAEUAeABlAGMAdQB0AGUAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          PID:2432
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAUAByAG8AdABvAGMAbwBsAEUAeABlAGMAdQB0AGUAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          PID:4516
        • C:\Users\Admin\Desktop\00411\NsProcess.exe
          PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAFAAcgBvAHQAbwBjAG8AbABFAHgAZQBjAHUAdABlAFwAVABlAGUAbgB1AHAAQwBsAGkAZQBuAHQAUwBUAF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBXAGEAcgBuAE8AbgBPAHAAZQBuAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwAwAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          PID:4952
        • C:\Program Files (x86)\TeenupExamClient_ST\TeenupExamClient_ST.exe
          "C:\Program Files (x86)\TeenupExamClient_ST\TeenupExamClient_ST.exe" EXECUTE
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4408
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAaQByAGUAVwBhAGwAbABSAGUAZwBpAHMAdABlAHIAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACAAKAB4ADgANgApAFwAVABlAGUAbgB1AHAARQB4AGEAbQBDAGwAaQBlAG4AdABfAFMAVABcAFQAZQBlAG4AdQBwAEUAeABhAG0AQwBsAGkAZQBuAHQAXwBTAFQALgBlAHgAZQBdAF0APgA8AC8AUABhAHIAYQBtADEAPgA8AFAAYQByAGEAbQAyAD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2244
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall set rule name="TeenupExamClient_ST.exe" program="C:\Program Files (x86)\TeenupExamClient_ST\TeenupExamClient_ST.exe" new dir=in enable=yes action=allow edge=yes
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:3684
            • C:\Windows\SysWOW64\netsh.exe
              "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="TeenupExamClient_ST.exe" dir=in action=allow program="C:\Program Files (x86)\TeenupExamClient_ST\TeenupExamClient_ST.exe" enable=yes edge=yes
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:4964
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEUAbgBhAGIAbABlAFUAQQBDACIAPgA8AFAAYQByAGEAbQAxAD4APAAhAFsAQwBEAEEAVABBAFsARgBBAEwAUwBFAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQAzAD4APABQAGEAcgBhAG0ANAA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • UAC bypass
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • System policy modification
            PID:2768
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2116
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBTAFoAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwAVABlAGUAbgB1AHAAQwBsAGkAZQBuAHQAUwBUAF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBVAFIATAAgAFAAcgBvAHQAbwBjAG8AbABdAF0APgA8AC8AUABhAHIAYQBtADMAPgA8AFAAYQByAGEAbQA0AD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:1120
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXABzAGgAZQBsAGwAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:4524
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXABzAGgAZQBsAGwAXABvAHAAZQBuAF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADMAPgA8AFAAYQByAGEAbQA0AD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:1224
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAEMAbABhAHMAcwBlAHMAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXABzAGgAZQBsAGwAXABvAHAAZQBuAFwAYwBvAG0AbQBhAG4AZABdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQAzAD4APABQAGEAcgBhAG0ANAA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:1492
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBTAFoAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABDAGwAYQBzAHMAZQBzAFwAVABlAGUAbgB1AHAAQwBsAGkAZQBuAHQAUwBUAFwAcwBoAGUAbABsAFwAbwBwAGUAbgBcAGMAbwBtAG0AYQBuAGQAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwAiAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAIAAoAHgAOAA2ACkAXABUAGUAZQBuAHUAcABFAHgAYQBtAEMAbABpAGUAbgB0AF8AUwBUAFwAVABlAGUAbgB1AHAARQB4AGEAbQBDAGwAaQBlAG4AdABfAFMAVAAuAGUAeABlACIAIAAiACUAMQAiAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:2316
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAUAByAG8AdABvAGMAbwBsAEUAeABlAGMAdQB0AGUAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            PID:4560
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8AQwBVAFIAUgBFAE4AVABfAFUAUwBFAFIAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwASQBuAHQAZQByAG4AZQB0ACAARQB4AHAAbABvAHIAZQByAFwAUAByAG8AdABvAGMAbwBsAEUAeABlAGMAdQB0AGUAXABUAGUAZQBuAHUAcABDAGwAaQBlAG4AdABTAFQAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            PID:4788
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAFAAcgBvAHQAbwBjAG8AbABFAHgAZQBjAHUAdABlAFwAVABlAGUAbgB1AHAAQwBsAGkAZQBuAHQAUwBUAF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBXAGEAcgBuAE8AbgBPAHAAZQBuAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwAwAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            PID:1784
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABSAGUAYQBsAHQAZQBrAFwAUgBBAFYAQwBwAGwANgA0AFwARwBlAG4AZQByAGEAbABdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsASgBEAFAAbwBwAHUAcABdAF0APgA8AC8AUABhAHIAYQBtADMAPgA8AFAAYQByAGEAbQA0AD4APAAhAFsAQwBEAEEAVABBAFsAMABdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4904
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABSAGUAYQBsAHQAZQBrAFwAUgBBAFYAQwBwAGwAXABHAGUAbgBlAHIAYQBsAF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBKAEQAUABvAHAAdQBwAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwAwAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1836
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABSAGUAYQBsAHQAZQBrAFwAUgB0AEgARABWAEMAcABsADYANABcAEcAZQBuAGUAcgBhAGwAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAEoARABQAG8AcAB1AHAAXQBdAD4APAAvAFAAYQByAGEAbQAzAD4APABQAGEAcgBhAG0ANAA+ADwAIQBbAEMARABBAFQAQQBbADAAXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4116
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABSAGUAYQBsAHQAZQBrAFwAUgB0AEgARABWAEMAcABsAFwARwBlAG4AZQByAGEAbABdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsASgBEAFAAbwBwAHUAcABdAF0APgA8AC8AUABhAHIAYQBtADMAPgA8AFAAYQByAGEAbQA0AD4APAAhAFsAQwBEAEEAVABBAFsAMABdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1980
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABSAGUAYQBsAHQAZQBrAFwAQQB1AGQAaQBvAFwAUgB0AGsATgBHAFUASQA2ADQAXABHAGUAbgBlAHIAYQBsAF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBKAEQAUABvAHAAdQBwAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwAwAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3008
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABSAGUAYQBsAHQAZQBrAFwAQQB1AGQAaQBvAFwAUgB0AGsATgBHAFUASQBcAEcAZQBuAGUAcgBhAGwAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAEoARABQAG8AcAB1AHAAXQBdAD4APAAvAFAAYQByAGEAbQAzAD4APABQAGEAcgBhAG0ANAA+ADwAIQBbAEMARABBAFQAQQBbADAAXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2548
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABSAGUAYQBsAHQAZQBrAFwASABEAEEAdQBkAGkAbwBdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsAQQB1AHQAbwBQAG8AcAB1AHAAXQBdAD4APAAvAFAAYQByAGEAbQAzAD4APABQAGEAcgBhAG0ANAA+ADwAIQBbAEMARABBAFQAQQBbADAAXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4452
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABSAGUAYQBsAHQAZQBrAFwASABEAEEAdQBkAGkAbwA2ADQAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAEEAdQB0AG8AUABvAHAAdQBwAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwAwAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4124
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBEAFcATwBSAEQAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEMAVQBSAFIARQBOAFQAXwBVAFMARQBSAF0AXQA+ADwALwBQAGEAcgBhAG0AMQA+ADwAUABhAHIAYQBtADIAPgA8ACEAWwBDAEQAQQBUAEEAWwBTAG8AZgB0AHcAYQByAGUAXABNAGkAYwByAG8AcwBvAGYAdABcAEkAbgB0AGUAcgBuAGUAdAAgAEUAeABwAGwAbwByAGUAcgBcAFoAbwBvAG0AXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAFoAbwBvAG0ARABpAHMAYQBiAGwAZQBkAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwAxAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            PID:3916
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBDAHIAZQBhAHQAZQBLAGUAeQAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEsARQBZAF8ATABPAEMAQQBMAF8ATQBBAEMASABJAE4ARQBdAF0APgA8AC8AUABhAHIAYQBtADEAPgA8AFAAYQByAGEAbQAyAD4APAAhAFsAQwBEAEEAVABBAFsAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAVQBuAGkAbgBzAHQAYQBsAGwAXABUAGUAZQBuAHUAcAAgAEUAeABhAG0AIABDAGwAaQBlAG4AdAAgAFMAZQBsAGYAIABUAGUAcwB0AF0AXQA+ADwALwBQAGEAcgBhAG0AMgA+ADwAUABhAHIAYQBtADMAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADMAPgA8AFAAYQByAGEAbQA0AD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2920
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBTAFoAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAVABlAGUAbgB1AHAAIABFAHgAYQBtACAAQwBsAGkAZQBuAHQAIABTAGUAbABmACAAVABlAHMAdABdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsARABpAHMAcABsAGEAeQBOAGEAbQBlAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBUAGUAZQBuAHUAcAAgAEUAeABhAG0AIABDAGwAaQBlAG4AdAAgACgAkMcArMTJ6LIpAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2396
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBTAFoAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAVABlAGUAbgB1AHAAIABFAHgAYQBtACAAQwBsAGkAZQBuAHQAIABTAGUAbABmACAAVABlAHMAdABdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsARABpAHMAcABsAGEAeQBJAGMAbwBuAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACAAKAB4ADgANgApAFwAVABlAGUAbgB1AHAARQB4AGEAbQBDAGwAaQBlAG4AdABfAFMAVABcAFQAZQBlAG4AdQBwAEUAeABhAG0AQwBsAGkAZQBuAHQAXwBTAFQALgBlAHgAZQBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1972
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBTAFoAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAVABlAGUAbgB1AHAAIABFAHgAYQBtACAAQwBsAGkAZQBuAHQAIABTAGUAbABmACAAVABlAHMAdABdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsAVQBuAGkAbgBzAHQAYQBsAGwAUwB0AHIAaQBuAGcAXQBdAD4APAAvAFAAYQByAGEAbQAzAD4APABQAGEAcgBhAG0ANAA+ADwAIQBbAEMARABBAFQAQQBbAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAIAAoAHgAOAA2ACkAXABUAGUAZQBuAHUAcABFAHgAYQBtAEMAbABpAGUAbgB0AF8AUwBUAFwATgBzAFUAbgBpAG4AcwB0AGEAbABsAGUAcgAuAGUAeABlAF0AXQA+ADwALwBQAGEAcgBhAG0ANAA+ADwALwBJAHQAZQBtAD4APAAvAFIAbwBvAHQAPgA=
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4980
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBTAFoAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAVABlAGUAbgB1AHAAIABFAHgAYQBtACAAQwBsAGkAZQBuAHQAIABTAGUAbABmACAAVABlAHMAdABdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsASQBuAHMAdABhAGwAbABIAG8AbQBlAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACAAKAB4ADgANgApAFwAVABlAGUAbgB1AHAARQB4AGEAbQBDAGwAaQBlAG4AdABfAFMAVABdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:636
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEYAbgBTAGUAdABWAGEAbAB1AGUAXwBTAFoAIgA+ADwAUABhAHIAYQBtADEAPgA8ACEAWwBDAEQAQQBUAEEAWwBLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXQBdAD4APAAvAFAAYQByAGEAbQAxAD4APABQAGEAcgBhAG0AMgA+ADwAIQBbAEMARABBAFQAQQBbAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFUAbgBpAG4AcwB0AGEAbABsAFwAVABlAGUAbgB1AHAAIABFAHgAYQBtACAAQwBsAGkAZQBuAHQAIABTAGUAbABmACAAVABlAHMAdABdAF0APgA8AC8AUABhAHIAYQBtADIAPgA8AFAAYQByAGEAbQAzAD4APAAhAFsAQwBEAEEAVABBAFsAUAB1AGIAbABpAHMAaABlAHIAXQBdAD4APAAvAFAAYQByAGEAbQAzAD4APABQAGEAcgBhAG0ANAA+ADwAIQBbAEMARABBAFQAQQBbAACzXNXBwPWsjNZYx4zBXQBdAD4APAAvAFAAYQByAGEAbQA0AD4APAAvAEkAdABlAG0APgA8AC8AUgBvAG8AdAA+AA==
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1652
          • C:\Program Files (x86)\TeenupExamClient_ST\NsProcess.exe
            PABSAG8AbwB0AD4APABJAHQAZQBtACAAQwBtAGQAPQAiAEQATABMAFIAZQBnAFMAZQByAHYAZQByADMAMgAiAD4APABQAGEAcgBhAG0AMQA+ADwAIQBbAEMARABBAFQAQQBbAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAIAAoAHgAOAA2ACkAXABUAGUAZQBuAHUAcABFAHgAYQBtAEMAbABpAGUAbgB0AF8AUwBUAFwATQBlAGQAaQBhAFwAQQB1AGQAaQBvAEMAbwBuAHQAcgBvAGwALgBvAGMAeABdAF0APgA8AC8AUABhAHIAYQBtADEAPgA8AFAAYQByAGEAbQAyAD4APAAhAFsAQwBEAEEAVABBAFsAXQBdAD4APAAvAFAAYQByAGEAbQAyAD4APABQAGEAcgBhAG0AMwA+ADwAIQBbAEMARABBAFQAQQBbAF0AXQA+ADwALwBQAGEAcgBhAG0AMwA+ADwAUABhAHIAYQBtADQAPgA8ACEAWwBDAEQAQQBUAEEAWwBdAF0APgA8AC8AUABhAHIAYQBtADQAPgA8AC8ASQB0AGUAbQA+ADwALwBSAG8AbwB0AD4A
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4260
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Encoder.gen-2af01ae1215b1e3bd7bb978f1d4b1d99dac6ac5b64893f2f57e884028f8e1d6c.exe
        HEUR-Trojan-Ransom.Win32.Encoder.gen-2af01ae1215b1e3bd7bb978f1d4b1d99dac6ac5b64893f2f57e884028f8e1d6c.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:2108
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Encoder.vho-be603c8d2bd838f053b88e89359bda6624dfb4de023ff357e6a2a94c22374467.exe
        HEUR-Trojan-Ransom.Win32.Encoder.vho-be603c8d2bd838f053b88e89359bda6624dfb4de023ff357e6a2a94c22374467.exe
        3⤵
        • Executes dropped EXE
        PID:4796
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Foreign.gen-df9db35119b314f2088e074ab8b010ea86f7a56c5ddf1825a24462fbaa574107.exe
        HEUR-Trojan-Ransom.Win32.Foreign.gen-df9db35119b314f2088e074ab8b010ea86f7a56c5ddf1825a24462fbaa574107.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:4140
        • C:\Windows\94000696690303050\winsvcs.exe
          C:\Windows\94000696690303050\winsvcs.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          PID:3512
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-9890ba80b0993ef9f12e0b28a25e079979fb2baf00a89afb70bdf90b1ad4bc51.exe
        HEUR-Trojan-Ransom.Win32.GandCrypt.gen-9890ba80b0993ef9f12e0b28a25e079979fb2baf00a89afb70bdf90b1ad4bc51.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 480
          4⤵
          • Program crash
          PID:3916
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Gen.gen-4570b785bd207255f6893e1309f54ae6710a855985fde0c02cf8cc5ac00eab2f.exe
        HEUR-Trojan-Ransom.Win32.Gen.gen-4570b785bd207255f6893e1309f54ae6710a855985fde0c02cf8cc5ac00eab2f.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        PID:1800
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.LockerGoga.gen-767242bc7f534aed1be6fc19f5c4b6cd405a9d10074a9b5a9316957ffc9339ee.exe
        HEUR-Trojan-Ransom.Win32.LockerGoga.gen-767242bc7f534aed1be6fc19f5c4b6cd405a9d10074a9b5a9316957ffc9339ee.exe
        3⤵
        • Executes dropped EXE
        PID:2600
      • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-2eac9eb46bed1bf8e2a642c0b31a557023ffc1eff8e342304bbfffb33ddd9129.exe
        HEUR-Trojan-Ransom.Win32.PolyRansom.gen-2eac9eb46bed1bf8e2a642c0b31a557023ffc1eff8e342304bbfffb33ddd9129.exe
        3⤵
        • Modifies WinLogon for persistence
        • Drops startup file
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        PID:4836
      • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Blocker.gcdu-5298133b76b97ebba650026e99ee7c8be10cfad8aa80f9749875969dd1213c52.exe
        Trojan-Ransom.Win32.Blocker.gcdu-5298133b76b97ebba650026e99ee7c8be10cfad8aa80f9749875969dd1213c52.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2260
      • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Blocker.jaic-46c4243bf32a503089e89d97134c7c5211d368f22bd6cd92b7c29e86e8bfa035.exe
        Trojan-Ransom.Win32.Blocker.jaic-46c4243bf32a503089e89d97134c7c5211d368f22bd6cd92b7c29e86e8bfa035.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        PID:868
      • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Blocker.msyd-e496d3afaacc3bb0ea50eca48a6bcac8de4bd7adb578b39b559b64dfc6fe9fb2.exe
        Trojan-Ransom.Win32.Blocker.msyd-e496d3afaacc3bb0ea50eca48a6bcac8de4bd7adb578b39b559b64dfc6fe9fb2.exe
        3⤵
        • Executes dropped EXE
        PID:4952
      • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Encoder.kxs-ac14b1189c8c2573f9d8eb23e3158992db7745496583f6dbfe2115a37f6c4b48.exe
        Trojan-Ransom.Win32.Encoder.kxs-ac14b1189c8c2573f9d8eb23e3158992db7745496583f6dbfe2115a37f6c4b48.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4036
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\RansomwareHOME.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\RansomwareHOME.exe"
          4⤵
          • Executes dropped EXE
          • Sets desktop wallpaper using registry
          • System Location Discovery: System Language Discovery
          PID:1628
      • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Encoder.kyp-e502aac901dde89f099bb29daf3c042e6ea99fa8e8d19585923249fabcb52209.exe
        Trojan-Ransom.Win32.Encoder.kyp-e502aac901dde89f099bb29daf3c042e6ea99fa8e8d19585923249fabcb52209.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1712
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 384
          4⤵
          • Program crash
          PID:4040
      • C:\Users\Admin\Desktop\00411\VHO-Trojan-Ransom.Win32.Rector.gen-4d5c150d5ad86d176499f109ec0a7598791fa8d46e87f1e178479c013cc9a44e.exe
        VHO-Trojan-Ransom.Win32.Rector.gen-4d5c150d5ad86d176499f109ec0a7598791fa8d46e87f1e178479c013cc9a44e.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4428
        • C:\Users\Admin\Desktop\00411\VHO-Trojan-Ransom.Win32.Rector.gen-4d5c150d5ad86d176499f109ec0a7598791fa8d46e87f1e178479c013cc9a44e.exe
          C:\Users\Admin\Desktop\00411\VHO-Trojan-Ransom.Win32.Rector.gen-4d5c150d5ad86d176499f109ec0a7598791fa8d46e87f1e178479c013cc9a44e.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1484
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4116 -ip 4116
    1⤵
      PID:2676
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1712 -ip 1712
      1⤵
        PID:1548
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
        1⤵
          PID:2600
        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
          1⤵
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          PID:4396
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x49c 0x510
          1⤵
            PID:820
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
            1⤵
              PID:6136

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Replication Through Removable Media

            1
            T1091

            Execution

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            2
            T1543

            Windows Service

            2
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            5
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Disable or Modify Tools

            4
            T1562.001

            Modify Registry

            9
            T1112

            Virtualization/Sandbox Evasion

            1
            T1497

            Credential Access

            Credentials from Password Stores

            2
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Windows Credential Manager

            1
            T1555.004

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            8
            T1012

            System Information Discovery

            8
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Virtualization/Sandbox Evasion

            1
            T1497

            Lateral Movement

            Replication Through Removable Media

            1
            T1091

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Defacement

            1
            T1491

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.exe
              Filesize

              488KB

              MD5

              d1d8e532ee0b34852770feb90d8500be

              SHA1

              c24e016810e210aa9c4a97fd5b22b776c0530385

              SHA256

              993c708b7ba66f9e65dacb0401e97f97c5830debfc14250042dbe6faac7f24dc

              SHA512

              b116d60bb4d2dc2329b04d0e000a2b9af38e77ce2016a7d76347237b9e9f0e0b937ae195dbeccdf944bcc81fee280fa022133f6f797c53d8b4bd5dcdc478984a

              Download Submit

            • C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe
              Filesize

              1.3MB

              MD5

              0168e1a525f8f0b67e65de8aa8a02f74

              SHA1

              fb012ecd15d46f2da1eacffc3638547c1700bbba

              SHA256

              17cc4719d427d814f57f16c2212daf6245abfd3a03cac09a30ec13a8ac385873

              SHA512

              f9cd5b2216675883ff8e91b84f3380dfd6fc2b4f92a006f44bbd10972479cfe438c9587b4c8101a7dcad28c43585f6938e8b24d6f4b7e0b27da6789c46c53ded

              Download Submit

            • C:\Program Files (x86)\SetupRV\3in1.exe
              Filesize

              214KB

              MD5

              b9d85cd13aa4fb2ea5db6cbb71162a00

              SHA1

              6a2c5668d280b42233f7f2c63bfb1d1556530394

              SHA256

              5b113fa9e8539c71b86558fc6de6da50e26426fa14dc2d6f8dcfbaccb315732d

              SHA512

              c42a9922cabbbe3111c2b0e8fdaa4e86c948cba99c61e8bc735af9b25bc42c8f6eacd28424f7d7d1009c6ff274279f2aee14bd57af46295cbc469cdf3fea38b8

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Common\Pipe.cpp
              Filesize

              1KB

              MD5

              9d38dbd8b60552bc2cb8585ad660b0dd

              SHA1

              4d6dad546f146c7d63091bf00330785b942b0e80

              SHA256

              6ee4e10d1fd3fc75bf105727cbb84550fd2ded37dcb5c0ff053b18d2302e5117

              SHA512

              6c6392077cbf73be36755b715144863ad9d2fdac8fd676b3ee911aee4424b1d2bd504be1b09e9b22361d0347a158990dd74812a80c01af79dc0cbcc448c66ab2

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Common\Pipe.h
              Filesize

              441B

              MD5

              86ac093e951a8cfa7fe1e020e8a61026

              SHA1

              84f2706b20009dbd75da0ab9ec2186fec64690dd

              SHA256

              b7758c2f97ab776b02fcaab9d253277a96dcb318c66dd72d294a417290aad761

              SHA512

              076571f4be1d4dff66488a73648b22194afecbd4e3fb054067b1c0c240605ff07feb40fe91af6ae3bf9a1fb377efcd2f87e03fc16e61ddcabe5d24887e5cc979

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.cpp
              Filesize

              4KB

              MD5

              021aa48bed78c67e3a7969be8bc0bb5b

              SHA1

              cca95a2d7d82ed610245d3ae88dd19c339c402ac

              SHA256

              c9ef523d9abcac32bc86cc5e316c03749b64ec4bce0343289c05e9366639696d

              SHA512

              d3e10547d368d50863cc781e1831c5fa6264faa9cc64af6114e7f4e21d361849bbee0784f0d653bc824079e43bdd8ae8d02b5574520497b07e0022cbaaef3c32

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\CEJVMTI.h
              Filesize

              836B

              MD5

              20af26e2ab559ddc6ca1929834da003e

              SHA1

              7ae93554fbcec9851f68f16a2eaed9c3f299ce5f

              SHA256

              18c5fb7cb71eb7b2d1835ce44b24e09213aa885c1407e4e2401fbd2d74970d8e

              SHA512

              b9ff67e715e0489d761424266eda7049f40fe38e0ee4f595b1d4b43e6e9f829074827dc4ebbf9ff368be02a90a9343117930c88ed5fbb8e3d8eebda43a857d90

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaEventServer.cpp
              Filesize

              8KB

              MD5

              59529578cde1ae578abcaaa331aa4fba

              SHA1

              33ab98509ed784580a259d1b310827c50b842f50

              SHA256

              e3795c3b94c84491a368c78fcbc4076bfadca038afe74da2fa7fab7415945658

              SHA512

              acbd3884642e466d29fbe6d6a7337ccbaec55147ea735098f9e463c6875b52b255480745847c3efabcbac72f9b72dd45cf259880a8d4700afb68c3c07ac747be

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaEventServer.h
              Filesize

              1KB

              MD5

              94de75f30eca367499f6c3ca7905048c

              SHA1

              26b550fac776e0647eceb2b246086d07dbb1f12b

              SHA256

              289af20bdc7d004491e224531ce0c267d251aef5ebad5f3fed1af750679f26c9

              SHA512

              4a822471535dcea02b5dd73cde60c3965910f5187e0d7e1f1691e0483921dee6c2b13e9bc3d1ec952186bccad6d05e79266c77bbf8060329c71715d3da9b4496

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaServer.cpp
              Filesize

              41KB

              MD5

              afaba48ad9afa999503ccaac45df0710

              SHA1

              45fef1f5289cb3fd353f43efd13ece034803c9cd

              SHA256

              e02208ca6ebed1999d9761cc865ce98eaba28966dc32f40b5789733e52783bf9

              SHA512

              66b995a75c6f90177bce4dcc93783b1409d20b8ff1c318b79b8dd7c8fe6a1dee2f0ab906f30c5390d1c7b043d4e99717bf6fbc267318932d066721294c663552

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\JavaServer.h
              Filesize

              2KB

              MD5

              8a6c5c03e9fef26236d765c96ca20085

              SHA1

              01c3f3d91b2eb573e0c92bb7b2f656a42a31fb1d

              SHA256

              962f6ba49567fd76ad41c87a10763249c320294a5c971b089e935b864e824ad3

              SHA512

              031fa1505cc5345144247b25a6791a265efcd05ecedab5421215dfd6f30f64e6677ea5b23df2bce0118dc865c5c3aa67b704338be9693663b8c1e26cf27a19c0

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\dllmain.cpp
              Filesize

              410B

              MD5

              66efa1b79d7aef68dfa369074abc9caa

              SHA1

              67c347b1f2f8712b0cabb60e7e111ca1b3171f38

              SHA256

              542e67d6247001859b6bb38c2aa085f5446371eb2f2385546e12d0bf275de503

              SHA512

              09dfbe5f7d95bba3d4b9107c872f8690f6a714888b3146ca3e1468e41588d872eee68ae8c4cc96b85b73b6f96f450c1d20496d9401bc94932d6f357ee42a225e

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\stdafx.cpp
              Filesize

              294B

              MD5

              2b573b5a4d6ec77a3138ec43a1b260c9

              SHA1

              2a210a2645a2b8155ca8740211d6b366ba0d293d

              SHA256

              4cfba14a6f738dd17be066c3a8f595b84c0c33c1774c83736987b9ee8c0df16b

              SHA512

              a04185bf7da42d22f0ae01c55efb7aa5fe0c5924820df3af2439b06e472131fb5659577b970834c08fbca610a10ef41909b412b94b65bb5c8465047697647fde

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\stdafx.h
              Filesize

              542B

              MD5

              3718862895ea61a1a87feb925092f535

              SHA1

              7733de8657b606a4bf18b844dea6c500642ef964

              SHA256

              2fd0179ba87126cc35fb41d63fbebbfba185414960720b0a3da652ec3b1af641

              SHA512

              9357d5c4125f7ce8d2d31a72cff04ba357565f69e0ed099076572c4e48b2a9e34c077d7462ebabc371952e6f9f48aac17a1efee682573b49f7a7cf9752a41584

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Java\CEJVMTI\CEJVMTI\targetver.h
              Filesize

              1KB

              MD5

              33f3a8e602ac6644af839acb3ca10709

              SHA1

              0f76681306ebbe5063da4c93919104d3e0134046

              SHA256

              0ce7bd4b75fcf8800faffd3b0a315cbfe7b89271b8705e9216404af4d737d0bb

              SHA512

              81898fcf08c2ea7817479852771e11a67d766fba25b4fc7a77d23c993c4274d1c7c66953951051d2952d1b52630a1ba5c5268d7e67c1b9c696ca5ef427e5ec0d

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Mono\MonoDataCollector\Metadata.h
              Filesize

              4KB

              MD5

              762f95a86f279474e4b18757bf89aeaf

              SHA1

              ea48072f0cb858ba2c390e05d58fe2e080c6d219

              SHA256

              a199164bbb0756f688f3b21f1f76e6c469c4c6f36b3b8bf0901ddd93d6a0ab2f

              SHA512

              b21e30bb424592dae1184d7c2b26c902560bee54396ac4544a7d6f881f3f0f5b93631064da94e41a50de219a47b8d3fcd3a40a81707431ba942f0d5577473d71

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.cpp
              Filesize

              2KB

              MD5

              ed039fd898a0c851638f063c286f80db

              SHA1

              e5a73fe08b6ed649ff037d1f29ec9cf5e0d6b682

              SHA256

              a45246e126d7ef7feda89d2441e2bcd37509253d8b3143721b6311621951fb14

              SHA512

              ffdc5601fed4549d0547653ddfe337280f3df0905df9f98dbbab1ecbb49b509b4c98b84fb1869d2653a787acc4976c7dd6db3e10076bd7098d730beed2ecf5e1

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Mono\MonoDataCollector\MonoDataCollector.h
              Filesize

              227B

              MD5

              a955bb9b652603bbeb0de4a061011894

              SHA1

              d0f9f4ed2d120323a318de762010f35f382e07b6

              SHA256

              6a4a0c290ffd2aa411d63ab6ca8f468007ad0d208ebf1903595c4eb51e5b796e

              SHA512

              0a92538fbba6e0d8867a4736e5e1f634858ff4c5808c7e970deb13750223cb82ad3bd02a4ba53803a582e1ccb2117670935b1a42d00519ba8414a03884166367

              Download Submit

            • C:\Program Files (x86)\SetupRV\autorun\dlls\src\Mono\MonoDataCollector\dllmain.cpp
              Filesize

              642B

              MD5

              31eb3ab4f13cc2ca3442d46c77cefa7e

              SHA1

              5232224dace325a37d2412bca2f3a32c1b86b5c0

              SHA256

              88afc32acdc447318b5bf0424ffb096d4685895552bae9818294254bbaf64ba5

              SHA512

              82f8af95e75e841dfc79d933860a321ac86f91df9a3c57896d5004dda25873ccadbfd21abe614dd04abf77d3cb3212843f3dafcbd6f9f38fda36e9dd714df8ca

              Download Submit

            • C:\Program Files (x86)\TeenupExamClient_ST\Log\TeenupExamClient\TeenupExamClient_2024102817.log
              Filesize

              1KB

              MD5

              5b7aec4332774ef1cda84049b1b7d48b

              SHA1

              eb80eea190e75cd13cd01bdc5b0ed414e45c1b5a

              SHA256

              c2fa4b4b647fef334fd175e104f6ebfd60808decd4a142d8c337f22421fa07d7

              SHA512

              bc9f3c6577c5bd03d830108627c6fa7d8fd57b3c4b1e4fb3db80ab13687b646fa0bd2685f0dcaaf6d0bd659880d14ccc784479536556bfaedc20e20a0b8e04ca

              Download Submit

            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
              Filesize

              64KB

              MD5

              d2fb266b97caff2086bf0fa74eddb6b2

              SHA1

              2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

              SHA256

              b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

              SHA512

              c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

              Download Submit

            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
              Filesize

              4B

              MD5

              f49655f856acb8884cc0ace29216f511

              SHA1

              cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

              SHA256

              7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

              SHA512

              599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

              Download Submit

            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
              Filesize

              944B

              MD5

              6bd369f7c74a28194c991ed1404da30f

              SHA1

              0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

              SHA256

              878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

              SHA512

              8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\RansomwareHOME.exe
              Filesize

              54KB

              MD5

              9c4061832940120411a190e2d03b04d0

              SHA1

              a3ea3ff9ad9a83ba7a6239a039ac13816084baea

              SHA256

              74e3d2946cbbd413f0f5fcbbf19ebdd218da19dc96674d757984e613e29f7c09

              SHA512

              01d0b007fc6d12a8b42d71aa2ce490172e3cade8798bb238fe23dea50a0da158e68a6dee5d7a38768676d0a3352dd25b7754074b7ce570d3c671155fe6bedf61

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_id1zuus4.r2n.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\__UpdateClient\TeenupExamClient_ST\_NsUpdate.exe.zip
              Filesize

              251KB

              MD5

              71dc29d3dbedd1c74ad712907749aab5

              SHA1

              e9164741a4601357afd232dd502a6705ef264422

              SHA256

              efc7b729f08550cc362e7099e56142fa1cfdb6a4db0c9a2474f0463b59364815

              SHA512

              035b40d6a36412f26b5f0f912c60be8b775c3393a744a821fd6a8dac57d7e8d4b3484e9d9dcaffc23268ff31cbd1eb7407af8b2541c57e4aa2ab2dd52e4c1399

              Download Submit

            • C:\Users\Admin\AppData\Local\__UpdateClient\TeenupExamClient_ST\___Version.ini
              Filesize

              90B

              MD5

              0d2d78740792bfb9a5f24739a0404721

              SHA1

              b5e040e78ba1b68d7442e54cd4ae53c484294efa

              SHA256

              c040a30098d92bfd3b0e5e4a1214d22956c89a84ce3c6bed436db4ab9028b86a

              SHA512

              b6d524c1a0c7c040850b7ccea1237d375b9aaa5724da329fb66038db57a30ea55c98496e0e53252d80e01912b4e43ed8fd590407de0990dbd375c130af8a0c91

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
              Filesize

              1KB

              MD5

              c0f598650df6a9dff064f501e3ee7d68

              SHA1

              11667e249a58b146f60e60e1448c73eea6b2edd1

              SHA256

              20ec752c650c75a8ef5e5bc725b505ca6b1464bca52d39384cb63fc47e8b10b6

              SHA512

              32af7a41cc42b767475ca4a7f7fab4ab72f30c0c5de0b54d103d48bca94a89e1f66a0a79849441df1d23210306cc5302cc6db8261563d1a60de492ab1f53c2fc

              Download Submit

            • C:\Users\Admin\AppData\Roaming\win-645721.test
              Filesize

              1KB

              MD5

              0ce064b24389bfa919ad4dfe430915b2

              SHA1

              0764e0e9c7cdd17b9ca4e32662d53cbf906bbc55

              SHA256

              29415997084a1880d207450a5c0a255cc9d7b81d876fd5bc427bee56b7c674ad

              SHA512

              861c0e408f18ded9e81d7e641d6ccdeead09970b63f1ea07452d6577ce70771b52e0c553e2633571b2677e025b375e603c2856ae5747bc12159eff266178d186

              Download Submit

            • C:\Users\Admin\Desktop\00411\58m5=du.jgy
              Filesize

              682KB

              MD5

              51633689af4de7c6ca9e7383bf0d8a62

              SHA1

              0db244666fa7ba15efeadefe9ce3de4c1202ee8b

              SHA256

              21f8203f8c0fa0a5364de7c81e5a952c15b1e4ee2a7e903274cd0460c8267eb7

              SHA512

              3ff84c7784b268b5e79c9aaaf5bdc9a76879728096857ceb56bafe50bff5e1a2ca292ef0d10ea2027a60850d31bcd2f090a1b89f8fb65f783c4565e0a1facfb1

              Download Submit

            • C:\Users\Admin\Desktop\00411\7tSosp^.jgy
              Filesize

              9.6MB

              MD5

              096e41e6c93c9122fad845e7046c5450

              SHA1

              542c11e32957e1a00f3f85ddd0ce473d3e4ac4e9

              SHA256

              0ed34db00bfc2dc81812484db7ad431ad7624039736e18bedf080e89e187d2a9

              SHA512

              9bb1db8a2b48d7a9394c0d4dffedaad9a3dc34cb93f6709900b0f8f48540dd8fc63f9c7a74da331db47ecde5e43799405c13fddd7311f9e4608494db7cc7b598

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.MSIL.Foreign.gen-c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54.exe
              Filesize

              9.6MB

              MD5

              db6240c4f671154185b7d7b61d1059c9

              SHA1

              ac6af4f2e3709358c613242a4520d9f752ebf52c

              SHA256

              c22c4171a9ba3fae54bbda30f9dcc05e9067d4e30c1edad665eada464925ab54

              SHA512

              53d5901609fd3bd36492acc0ba0deaa960481037a9258736d10d42e389e1420e0b07a50a48655a537e374be1b1d64b9041238dc691fc710491b091fa99744efc

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.MSIL.Gen.gen-674f97840252e8ea3752d8e80a3a60abddaa4633d6b5faa4aa327889a0b649f8.exe
              Filesize

              456KB

              MD5

              0a00d9b52872fc353e1f0d78b452078d

              SHA1

              4aacb7c858e87706f659a2090579f2be66c53045

              SHA256

              674f97840252e8ea3752d8e80a3a60abddaa4633d6b5faa4aa327889a0b649f8

              SHA512

              212b45ebc82338ac68b52bdbe594bb655aa680204ac5bed729fdaa67596757b8bf12010b1c840347caa65a9ed2e266d8fe07460d9283caab0edc02ab0b347e9f

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.MSIL.Trumper.gen-c2b66b94a8210a6608ddbca8915d7d03445d0b61e909a1d5175dc238f25a371c.exe
              Filesize

              182KB

              MD5

              950ccf41db4ba69b634253954663671f

              SHA1

              76c2dcf29f33aff6c397d0b43a3f8c28c9badef4

              SHA256

              c2b66b94a8210a6608ddbca8915d7d03445d0b61e909a1d5175dc238f25a371c

              SHA512

              d9f9c77384703ac399ff38a751cf9eade6ac3a2f570e62614af0f795eae5fa904345c18f5d71d88abdb39178e122ba6e1c7eb792c9b0c910c33661657064671f

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Blocker.gen-1f6f8abb93623e981f8211dcb7b2ef9d8f6ce469b35968cc54806af7c7ba2efe.exe
              Filesize

              1.4MB

              MD5

              07bbe318638e076dd049abc8bed7c1c4

              SHA1

              45ba7833c708fc0522663809806a6df362779a03

              SHA256

              1f6f8abb93623e981f8211dcb7b2ef9d8f6ce469b35968cc54806af7c7ba2efe

              SHA512

              33d9b83f1c551429acdcad5bcc06606a53f68654103c9eb9cfada1d0c0cf713bafc0bebc934f6a6f0ba250502cfa375c6d64c6a6fd6066b0b0a9d0217b7c510b

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Encoder.gen-2af01ae1215b1e3bd7bb978f1d4b1d99dac6ac5b64893f2f57e884028f8e1d6c.exe
              Filesize

              2.5MB

              MD5

              8f46ce5ef3fe72782e6a81e1ac3edaa6

              SHA1

              8a58ac2ab4dd4f200913a29eac47499a72bc142a

              SHA256

              2af01ae1215b1e3bd7bb978f1d4b1d99dac6ac5b64893f2f57e884028f8e1d6c

              SHA512

              4e17fe6b8f95a5721f4dbf6ef0f3e9dbf162cd1069960e2345beb88cf11ac1ce227484638f0a18d730278bc8b49644710032ab3cc4f7bf3f4ec9b91704ac6cdc

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Encoder.vho-be603c8d2bd838f053b88e89359bda6624dfb4de023ff357e6a2a94c22374467.exe
              Filesize

              9.4MB

              MD5

              82a23c65125b2a4c45934b0676ee8db7

              SHA1

              a1486bef757f9d627e0c2ce8597b8a62bc808f92

              SHA256

              be603c8d2bd838f053b88e89359bda6624dfb4de023ff357e6a2a94c22374467

              SHA512

              f19af71b8fa8525a6ee78d6f1542b32799e585ba5285e45424336b735140b7b9bdbfbdda6909a052ba3c7a6e2b742a843d7d7c06e95394f3bcbf11942fc39314

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Foreign.gen-df9db35119b314f2088e074ab8b010ea86f7a56c5ddf1825a24462fbaa574107.exe
              Filesize

              452KB

              MD5

              3c4ad6323ea37b5cf2423e2650fc8d02

              SHA1

              cff824fa63054f73fd7e2b47f9c6e3daa29f820b

              SHA256

              df9db35119b314f2088e074ab8b010ea86f7a56c5ddf1825a24462fbaa574107

              SHA512

              bfd6e0d58b8dd8fab86931eaba7fb1f3cfae2e98df28a4c171e00a3b92910ef839ebd34bc37d7e138f23e968ace6f8c956280fbac335832a93c29703c12a1ba1

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-9890ba80b0993ef9f12e0b28a25e079979fb2baf00a89afb70bdf90b1ad4bc51.exe
              Filesize

              325KB

              MD5

              012e8cf7c8f8dc1b5b0bfcb9cb39e2a7

              SHA1

              f38948153143ba5e119137980c47da332f2a9944

              SHA256

              9890ba80b0993ef9f12e0b28a25e079979fb2baf00a89afb70bdf90b1ad4bc51

              SHA512

              6918e11507666e146a05b00d9eb1283a5bbec9aa55ff3c15ec1a48ae5d7f4432cb1995eef19b6b4fc90605829487c05f07b22ec86b5bc048d826f61e71d0cd99

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.Gen.gen-4570b785bd207255f6893e1309f54ae6710a855985fde0c02cf8cc5ac00eab2f.exe
              Filesize

              199KB

              MD5

              c8606f8eda1e519cfc1150e7077f9328

              SHA1

              8e3133db2fb601df18115b1fe0d5b169414caeac

              SHA256

              4570b785bd207255f6893e1309f54ae6710a855985fde0c02cf8cc5ac00eab2f

              SHA512

              8a1b48e7f7458d0211fee8dc7caa9cafee72238fccef3bbfe0f5716150c54b1e9c60c531761aa7cace02edf37132c7feb60bcc97bd6de1eabfe1af99d2368d4f

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.LockerGoga.gen-767242bc7f534aed1be6fc19f5c4b6cd405a9d10074a9b5a9316957ffc9339ee.exe
              Filesize

              1.2MB

              MD5

              ff5bfbbb82b704ff09427f159e243ca7

              SHA1

              7809c9b2e3e8a219a00ee7bd758418f41bc36847

              SHA256

              767242bc7f534aed1be6fc19f5c4b6cd405a9d10074a9b5a9316957ffc9339ee

              SHA512

              afb6f4d45f81cc105f9700ffae331baab5b557b9f83c08a73f054a04633eb030a22a3094428286211d225ed0440b48332d09bd829bc00df497415b84733f6e99

              Download Submit

            • C:\Users\Admin\Desktop\00411\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-2eac9eb46bed1bf8e2a642c0b31a557023ffc1eff8e342304bbfffb33ddd9129.exe
              Filesize

              488KB

              MD5

              017e71ae9ee703f5592eeb14cfa85bc7

              SHA1

              b6c153d36f33d43485f33902032497bb7e5122f9

              SHA256

              2eac9eb46bed1bf8e2a642c0b31a557023ffc1eff8e342304bbfffb33ddd9129

              SHA512

              2ffff3b3aa19043c71aabb85c99e70ad263e6d46624c39b90de45172325b863e87d7b84f8c25cd8349a5d46d08486561e218023ce14d400d72a5d3e33f0ba975

              Download Submit

            • C:\Users\Admin\Desktop\00411\J61i1XxAhrd5.jgy
              Filesize

              1.4MB

              MD5

              cfb0172e87e00a10eebf4146c91d9e58

              SHA1

              086914fcd6d94a0789bab77f5ef33040266f4e4d

              SHA256

              7c82c4862610f2f5227b430c77653e78dd236c06f1b91aab7ac76278469566e6

              SHA512

              4c12f9a5756e4e1a64ea8aac6832689a9264885e6ec6e1ce65b12fdac216e8e57c5c7f1fa9e4045450c871623aa6b16804b9d6eac493d4290a8c347bbfb7389f

              Download Submit

            • C:\Users\Admin\Desktop\00411\NsProcess.exe
              Filesize

              149KB

              MD5

              f13ef6fe082be660c9dde22f763bf3a4

              SHA1

              0b7f9dc39dae73aace86a770f9afe80b65c841dc

              SHA256

              54bbed2d8d697f75e3b09ba2a754e5b18f9473f47a6a96e12127ac9ffe66e1ec

              SHA512

              ed755feec89daa9c48aa59b51d12f49ad66d2d8e7a959836ae8595e3bb6d8d90e897696d0feab6a0351c99ae4ace7c315d674fa716c6d0c90bd1c7e173471991

              Download Submit

            • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Blocker.gcdu-5298133b76b97ebba650026e99ee7c8be10cfad8aa80f9749875969dd1213c52.exe
              Filesize

              380KB

              MD5

              aa56c00aaaf819c52181f6f89c3abdc5

              SHA1

              1e312e0f30b5cf5c7d42ae711cfd97cba819159a

              SHA256

              5298133b76b97ebba650026e99ee7c8be10cfad8aa80f9749875969dd1213c52

              SHA512

              296a7605f5a2fca964fe5fb58f2c4473b5ccb8dbf8e6ada2f07e154d904a3fb13e916ec6471d39001bb13134341c237c84fb9d4e8f29e38e63f5d78d1b6917a8

              Download Submit

            • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Blocker.jaic-46c4243bf32a503089e89d97134c7c5211d368f22bd6cd92b7c29e86e8bfa035.exe
              Filesize

              54KB

              MD5

              012e22a817db7b9223b3a5b63a8781c5

              SHA1

              71b2715a1ee35b818c8da91246138e649bc85e81

              SHA256

              46c4243bf32a503089e89d97134c7c5211d368f22bd6cd92b7c29e86e8bfa035

              SHA512

              dcee78b51f2e4977acd63b6b40cb72f4a5e94e526f7976d9efa32b86e4ecc3641cfa2f1f9ffe81da102a0838b8aa36429633e1e27342ba41c8c59a98d577178e

              Download Submit

            • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Blocker.msyd-e496d3afaacc3bb0ea50eca48a6bcac8de4bd7adb578b39b559b64dfc6fe9fb2.exe
              Filesize

              282KB

              MD5

              27e8d8289fa37adbae7f9d0e23d232c6

              SHA1

              e26f9bbd3685088af75773366fcd288f7fb5e780

              SHA256

              e496d3afaacc3bb0ea50eca48a6bcac8de4bd7adb578b39b559b64dfc6fe9fb2

              SHA512

              7c548b586b31c1d486e5b3e811598c12f091cacfc51d990e5051422d18029a38afde3756a3f31a3505eda24d8de3c070d561b60a811e774824213751e0504659

              Download Submit

            • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Encoder.kxs-ac14b1189c8c2573f9d8eb23e3158992db7745496583f6dbfe2115a37f6c4b48.exe
              Filesize

              681KB

              MD5

              2535ccadf0360c8d8b1113c246096f73

              SHA1

              810e1902ef9542f96e505d14bcd0e4e009580ef1

              SHA256

              ac14b1189c8c2573f9d8eb23e3158992db7745496583f6dbfe2115a37f6c4b48

              SHA512

              ada05ce84f7e955f82a7f4b7bc46ff17df22f249781173cc92bcd973300fcf3e9e7a5b070571596ab475ba261ecafad4382c201fbc7736ed2f12b5b0450885cb

              Download Submit

            • C:\Users\Admin\Desktop\00411\Trojan-Ransom.Win32.Encoder.kyp-e502aac901dde89f099bb29daf3c042e6ea99fa8e8d19585923249fabcb52209.exe
              Filesize

              3.9MB

              MD5

              9688616fb9224f674010fc3f0e910d78

              SHA1

              899fb7cde8aef0a42f65e0ef56b9cda8800292b1

              SHA256

              e502aac901dde89f099bb29daf3c042e6ea99fa8e8d19585923249fabcb52209

              SHA512

              b3b3cbbd04579570df32ac1111912e0754259bf654445fe520843d994d1e8d7459528c63cc609089654910f5affcac2dde3faff7dbfe69d3554de154ddca1bc2

              Download Submit

            • C:\Users\Admin\Desktop\00411\UDS-Trojan-Ransom.Win32.Rakhni-563b24151e280c2e307370f2640cbd0e2ef3f6bf5ece63eb1b5faee0f1e769b9.exe
              Filesize

              8.2MB

              MD5

              20e277e38bb2d4ffedbc29cc33cdb282

              SHA1

              02ca3be398e8af8a9f1d44b4c70ac7a2553808d2

              SHA256

              563b24151e280c2e307370f2640cbd0e2ef3f6bf5ece63eb1b5faee0f1e769b9

              SHA512

              acd19d1778b5f4ab14914dc617e084950eaacf6dbf926a9a54bc1c9b39d27e1a23474eb8369ee9daa6230bc1cad7873d43f7f49d1c1db064d52d13e47bf65a53

              Download Submit

            • C:\Users\Admin\Desktop\00411\VHO-Trojan-Ransom.Win32.Convagent.gen-2666dcbe11611049be8d7878b8dafb801541b1b6b1c3854a1d7c0336f0e973de.exe
              Filesize

              5.4MB

              MD5

              265346d7d94f38dfd118096e88b9ecd8

              SHA1

              1a742bca880111f71fa001a454862dcea155f4cd

              SHA256

              2666dcbe11611049be8d7878b8dafb801541b1b6b1c3854a1d7c0336f0e973de

              SHA512

              2fac46729d78b9d39faff46ed8386440db856cbd5cbf8cf0dd7b051f7a7b19a0daec4620ee574bf8c7275f9d768e7adab7320aff7fea5c265cb3509d5488f0ab

              Download Submit

            • C:\Users\Admin\Desktop\00411\VHO-Trojan-Ransom.Win32.Gen.gen-e4eb20d73b017f892a050c67d05d57fd2e1daff60df63cd2019e6fdb38af3aae.exe
              Filesize

              1017KB

              MD5

              b250d230f3c3156e2a3f9a60b5468841

              SHA1

              8b5f74fd01aab5abc865309ac76b79d0c488b0b6

              SHA256

              e4eb20d73b017f892a050c67d05d57fd2e1daff60df63cd2019e6fdb38af3aae

              SHA512

              c5838b666d4682c62a95c82a826d1cfba83d97bc7033fb9c984cb7e0d29f2c1104f0981b182dd1667ecccc4a427126e569e4113495514030c8a4cbb37bc1c109

              Download Submit

            • F:\AUTORUN.INF
              Filesize

              145B

              MD5

              ca13857b2fd3895a39f09d9dde3cca97

              SHA1

              8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

              SHA256

              cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

              SHA512

              55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

              Download Submit

            • memory/868-230-0x0000000000400000-0x0000000000411000-memory.dmp

              Filesize

              68KB

              Download

            • memory/868-398-0x0000000000400000-0x0000000000411000-memory.dmp

              Filesize

              68KB

              Download

            • memory/1484-516-0x0000000000400000-0x0000000000412000-memory.dmp

              Filesize

              72KB

              Download

            • memory/1484-514-0x0000000000400000-0x0000000000412000-memory.dmp

              Filesize

              72KB

              Download

            • memory/1484-560-0x0000000000400000-0x0000000000412000-memory.dmp

              Filesize

              72KB

              Download

            • memory/1576-116-0x0000000004EE0000-0x0000000004EEA000-memory.dmp

              Filesize

              40KB

              Download

            • memory/1576-111-0x0000000004F40000-0x0000000004FD2000-memory.dmp

              Filesize

              584KB

              Download

            • memory/1576-435-0x000000000D3A0000-0x000000000D6F4000-memory.dmp

              Filesize

              3.3MB

              Download

            • memory/1576-345-0x000000000CF90000-0x000000000D120000-memory.dmp

              Filesize

              1.6MB

              Download

            • memory/1576-346-0x000000000B2A0000-0x000000000B312000-memory.dmp

              Filesize

              456KB

              Download

            • memory/1576-103-0x00000000005B0000-0x0000000000628000-memory.dmp

              Filesize

              480KB

              Download

            • memory/1576-108-0x00000000054F0000-0x0000000005A94000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/1712-257-0x0000000000360000-0x0000000000C70000-memory.dmp

              Filesize

              9.1MB

              Download

            • memory/1712-343-0x0000000000360000-0x0000000000C70000-memory.dmp

              Filesize

              9.1MB

              Download

            • memory/2864-52-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2864-50-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2864-49-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2864-42-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2864-41-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2864-40-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2864-46-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2864-51-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2864-47-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2864-48-0x000001F07EB30000-0x000001F07EB31000-memory.dmp

              Filesize

              4KB

              Download

            • memory/2928-98-0x0000024ED1D30000-0x0000024ED1D66000-memory.dmp

              Filesize

              216KB

              Download

            • memory/3512-399-0x0000000000400000-0x0000000000480000-memory.dmp

              Filesize

              512KB

              Download

            • memory/3512-489-0x0000000000400000-0x0000000000480000-memory.dmp

              Filesize

              512KB

              Download

            • memory/3512-477-0x0000000000400000-0x0000000000480000-memory.dmp

              Filesize

              512KB

              Download

            • memory/3516-80-0x0000010D34450000-0x0000010D344C6000-memory.dmp

              Filesize

              472KB

              Download

            • memory/3516-74-0x0000010D33E90000-0x0000010D33EB2000-memory.dmp

              Filesize

              136KB

              Download

            • memory/3516-79-0x0000010D34380000-0x0000010D343C4000-memory.dmp

              Filesize

              272KB

              Download

            • memory/3516-82-0x0000010D34410000-0x0000010D3442E000-memory.dmp

              Filesize

              120KB

              Download

            • memory/4116-204-0x0000000000400000-0x0000000000460000-memory.dmp

              Filesize

              384KB

              Download

            • memory/4116-209-0x00000000006C0000-0x00000000006D7000-memory.dmp

              Filesize

              92KB

              Download

            • memory/4116-208-0x0000000000400000-0x0000000000460000-memory.dmp

              Filesize

              384KB

              Download

            • memory/4140-380-0x0000000000400000-0x0000000000480000-memory.dmp

              Filesize

              512KB

              Download

            • memory/4140-195-0x0000000000400000-0x0000000000480000-memory.dmp

              Filesize

              512KB

              Download

            • memory/4296-114-0x0000000001BD0000-0x0000000001BD8000-memory.dmp

              Filesize

              32KB

              Download

            • memory/4296-104-0x000000001C630000-0x000000001CAFE000-memory.dmp

              Filesize

              4.8MB

              Download

            • memory/4296-109-0x000000001CBA0000-0x000000001CC3C000-memory.dmp

              Filesize

              624KB

              Download

            • memory/4396-355-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-374-0x00007FFB52560000-0x00007FFB52570000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-369-0x00007FFB52560000-0x00007FFB52570000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-351-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-555-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-352-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-353-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-556-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-557-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-558-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4396-356-0x00007FFB54830000-0x00007FFB54840000-memory.dmp

              Filesize

              64KB

              Download

            • memory/4408-633-0x00000000741F0000-0x0000000074229000-memory.dmp

              Filesize

              228KB

              Download

            • memory/4408-565-0x00000000741F0000-0x0000000074229000-memory.dmp

              Filesize

              228KB

              Download

            • memory/4428-462-0x0000000000400000-0x000000000062E000-memory.dmp

              Filesize

              2.2MB

              Download

            • memory/4428-513-0x0000000002790000-0x000000000299C000-memory.dmp

              Filesize

              2.0MB

              Download

            • memory/4428-521-0x0000000000400000-0x000000000062E000-memory.dmp

              Filesize

              2.2MB

              Download

            • memory/4428-467-0x0000000002790000-0x000000000299C000-memory.dmp

              Filesize

              2.0MB

              Download

            • memory/4428-509-0x0000000000400000-0x000000000062E000-memory.dmp

              Filesize

              2.2MB

              Download

            • memory/4428-510-0x0000000000400000-0x000000000062E000-memory.dmp

              Filesize

              2.2MB

              Download

            • memory/4428-512-0x0000000000400000-0x000000000062E000-memory.dmp

              Filesize

              2.2MB

              Download

            • memory/4428-519-0x0000000002790000-0x000000000299C000-memory.dmp

              Filesize

              2.0MB

              Download

            • memory/4428-511-0x0000000000400000-0x000000000062E000-memory.dmp

              Filesize

              2.2MB

              Download

            • memory/4428-463-0x0000000002790000-0x000000000299C000-memory.dmp

              Filesize

              2.0MB

              Download

            • memory/4836-476-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

              Download

            • memory/4836-551-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

              Download

            • memory/4836-460-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

              Download

            • memory/4836-387-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

              Download