Overview

overview

10

Static

static

1

RNSM00394.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    243s
  • max time network
    244s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2024 22:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00394.7z

  • Size

    31.2MB

  • MD5

    76b93f055cb09b9c703f1c934853ff39

  • SHA1

    7c82fe366d1ed04a5ada0cab06762e9e8136664d

  • SHA256

    38ab2002e8df4e98a0bfd4272f9dd3acb7c1ae6e9137a1343baf2f3e4994cec7

  • SHA512

    842e5e23cbac2b6031ac16be6869d2d296dc7233a802edb0a545d513a41698421b6c1a7019e6f470998785df221edad75f708af00ba9cfb35f7602558334aba1

  • SSDEEP

    786432:frOl5j9tSAcWHyw7AvM06/p3sC9C18FIz6oD2UHf:fS99vuuSC9C18QHf

Score
10/10
azorultbalaclavadharmagandcrabwarzoneratbackdoorbootkitcredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceransomwareratspywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

azorult

C2

http://valhalla42.000webhostapp.com/testcode/index.php

Extracted

Path

C:\$Recycle.Bin\HOW_TO_RECOVERY_FILES.txt

Family

balaclava

Ransom Note
Hello! If you see this message - this means your files are now encrypted and are in a non-working state! Now only we can help you recover. If you are ready to restore the work - send us an email to the address [email protected] In the letter, specify your personal identifier, which you will see below. In the reply letter we will inform you the cost of decrypting your files. Before payment you can send us 1 files for test decryption. We will decrypt the files you requested and send you back. This ensures that we own the key to recover your data. The total file size should be no more than 2 MB, the files should not contain valuable information (databases, backups, large Excel spreadsheets ...). Email to contact us - [email protected] YOUR PERSONAL ID : 80123D5C4202ED861D306A2ED251ACD4D39D6B1F90158BF5CB0FAEF3E0620E04 6C5A6ED4A248DBE8F3E7784F8882D403861829936BEAE9C99E557E59107B8F13 22A9AED242CE9AF3DF5524050F88ACBD54F666F20F5A1B98B207DB04C6DB5B03 FD7A59BDBADB0082C24101162EB32D52B23ACA115D1326B86AA148BC4CCD4121 C9AFB710C82A2EC92B027AC9EA458F6010C64582E774B8ED305793AE3111E2EE F836FCE6CFAD8643D7A270454D095AC7F2AAA8487EF17B3F41BC6BDD75B2CE3B 9779AA48527F3678D603C623E050C92E9BEDF9681972DA92B031F632F20DABBF CC577AF462087D227CEF8DB0EE5476793F6D11B6A9C9F58D23498E0B23A71EFC 499C687E145B3F62E8AB323A8671AC932756E593B2A37F4DF9139AC6DBB98F5D 66524B238C1F75B066E75B0EC89AA037D313D99FBF98DC4099A2D3D825386040 E6C6407181F3AD5A482F5CAFAE7AADAC27BB46565EC84558DBBD57E03E9AE240 116ECF217C5F08BB512610E641F1D0A186DAD8CD27AF2CEDBE1CF14AAE17190C C04BD7C775D76580E44675D4BD634A4AEE93D3E05BB75D18C387722924979828 048DDC166425E05C1A11427C01A969C96B38DE466C02E8FEA31847689D53A8BC D02C09AC173669F21C96B3243AFE0F4FE3F1584D103CEFD442CF293B9921F9BC 5A0436A62931B071517519922E9FA4B3572A59196286A3A97442051F0D4646DD 67EEA27FA943F35B78FBDBA73924AAD1C2056732B85D1945FA48FB99C1E539F3 74313ADAAD68605A4D0E761304BDD20276E458DFC1F7C0AC5DB7274EC45F2A2A 6173A8BE6226B1B9DAEFB6F3CBA379699F147BEA2600469CCCDA47A1F52F5858 5001BD769962001D02D44E47B1BAB1CF107B1E9C1E0A9FAA06895BF14EFA037C 109AD3C48DD535C20AFFE6AB79DDB317D39457115FB069BE141C8F288ADECFB5 052D51817D54BDAF548EC62B0F81A6848FC918CB81F070926178C67C51C8552A BFEE682CEF4F0B2CA46DF8516487AF157F81268EE8FA51FDAAB6ADFEBFA97D24 8731DB7D06012841816F958424612E89E7A8D607E8F9D59371B7C5C0B24E1494 579B64837281ACDF7F6CFE0B693933CAF5E51AE53D61D38AD5FAD28315CF4C02 3A54576DDF6C3A018B

Extracted

Family

warzonerat

C2

officedesktop004018.webredirect.org:5500

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Azorult family
    azorult
  • Balaclava Malware

    Balaclava malware is a ransomware program.

    ransomwarebalaclava
  • Balaclava family
    balaclava
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Dharma family
    dharma
  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzonerat family
    warzonerat
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Renames multiple (450) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (8746) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Warzone RAT payload 3 IoCs
    rat
  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 11 IoCs
  • Executes dropped EXE 21 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 15 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 11 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 24 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00394.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:64
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Drops startup file
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2112
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0d6673edd2998e93f605a0d828dafd54055169580e8390e48fcbae7216bf1cfc.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-0d6673edd2998e93f605a0d828dafd54055169580e8390e48fcbae7216bf1cfc.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        PID:3548
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:8348
      • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.Blocker.gen-aeda2014bf5250cb3a6c32fe9da4cf97793f8849221047bf155fe515c9bc1769.exe
        HEUR-Trojan-Ransom.Win32.Blocker.gen-aeda2014bf5250cb3a6c32fe9da4cf97793f8849221047bf155fe515c9bc1769.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3692
      • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.Crypren.gen-d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe
        HEUR-Trojan-Ransom.Win32.Crypren.gen-d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe
        3⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: RenamesItself
        • Suspicious use of WriteProcessMemory
        PID:2192
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:512
          • C:\Windows\system32\mode.com
            mode con cp select=1251
            5⤵
              PID:7980
            • C:\Windows\system32\vssadmin.exe
              vssadmin delete shadows /all /quiet
              5⤵
              • Interacts with shadow copies
              PID:4340
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
              PID:7300
              • C:\Windows\system32\mode.com
                mode con cp select=1251
                5⤵
                  PID:3948
                • C:\Windows\system32\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  5⤵
                  • Interacts with shadow copies
                  PID:8444
              • C:\Windows\System32\mshta.exe
                "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                4⤵
                  PID:8468
                • C:\Windows\System32\mshta.exe
                  "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                  4⤵
                    PID:6488
                • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.Encoder.gen-f5464d39819344e94f36215f6e68a090031fe616437612a4abd82bfb7492887a.exe
                  HEUR-Trojan-Ransom.Win32.Encoder.gen-f5464d39819344e94f36215f6e68a090031fe616437612a4abd82bfb7492887a.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:620
                • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-87ee41b3141fd60ce9e1c8b744c67dee643a942e03e09a81026b31762104ce74.exe
                  HEUR-Trojan-Ransom.Win32.GandCrypt.gen-87ee41b3141fd60ce9e1c8b744c67dee643a942e03e09a81026b31762104ce74.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:6976
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 6976 -s 488
                    4⤵
                    • Program crash
                    PID:5488
                • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.Generic-361fc41e13edf9845b4ca36c770138b033df619138622deddd10c7f3e00d7539.exe
                  HEUR-Trojan-Ransom.Win32.Generic-361fc41e13edf9845b4ca36c770138b033df619138622deddd10c7f3e00d7539.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:224
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 540
                    4⤵
                    • Program crash
                    PID:7156
                • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Blocker.lckf-864448901d066f7fa4835e4c12341d60bf7f610d8c45577ac5749267535c243c.exe
                  Trojan-Ransom.Win32.Blocker.lckf-864448901d066f7fa4835e4c12341d60bf7f610d8c45577ac5749267535c243c.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:6836
                • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Blocker.mpzi-4aeaf7f2d61fa7bf5fefe8d8e4c1755ec89ea337ae99dcbdbcaa18c97d1b271e.exe
                  Trojan-Ransom.Win32.Blocker.mpzi-4aeaf7f2d61fa7bf5fefe8d8e4c1755ec89ea337ae99dcbdbcaa18c97d1b271e.exe
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:6824
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\license.js"
                    4⤵
                    • Checks computer location settings
                    • Drops startup file
                    • Adds Run key to start application
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:6324
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida x32.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida x32.exe"
                      5⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:8576
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida x32.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida x32.exe" /i "C:\Users\Admin\AppData\Roaming\Oreans\Themida 2.4.6.0\install\Themida.msi" CLIENTPROCESSID="8576" SECONDSEQUENCE="1" CHAINERUIPROCESSID="8576Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="MainFeature" AGREE_CHECKBOX="Yes" PRIMARYFOLDER="APPDIR" ROOTDRIVE="C:\" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida x32.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\RarSFX0\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs " TARGETDIR="C:\" APPDIR="C:\Program Files (x86)\Themida\" AI_INSTALL="1" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida x32.exe"
                        6⤵
                        • Executes dropped EXE
                        • Enumerates connected drives
                        • System Location Discovery: System Language Discovery
                        PID:6324
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEA6DC.tmp.bat" "
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:6028
                        • C:\Windows\SysWOW64\attrib.exe
                          ATTRIB -r "\\?\C:\Users\Admin\AppData\Roaming\Oreans\THEMID~1.0\install\Themida.msi"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Views/modifies file attributes
                          PID:6828
                        • C:\Windows\SysWOW64\attrib.exe
                          ATTRIB -r "C:\Users\Admin\AppData\Local\Temp\EXEA6DC.tmp.bat"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Views/modifies file attributes
                          PID:4812
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEA6DC.tmp.bat" "
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:3532
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" cls"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:9324
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEA70C.tmp.bat" "
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:7132
                        • C:\Windows\SysWOW64\attrib.exe
                          ATTRIB -r "\\?\C:\Users\Admin\AppData\Roaming\Oreans\THEMID~1.0\install\Themida.msi"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Views/modifies file attributes
                          PID:5452
                        • C:\Windows\SysWOW64\attrib.exe
                          ATTRIB -r "C:\Users\Admin\AppData\Local\Temp\EXEA70C.tmp.bat"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          • Views/modifies file attributes
                          PID:9836
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEA70C.tmp.bat" "
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:7384
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" cls"
                          7⤵
                          • System Location Discovery: System Language Discovery
                          PID:9224
                    • C:\Windows\SysWOW64\wscript.exe
                      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\license.js"
                      5⤵
                      • Blocklisted process makes network request
                      • Checks computer location settings
                      • Drops startup file
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:7196
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida x32.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Themida x32.exe"
                        6⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:7476
                • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Crypmod.adok-4b4cf0cb7674e0ef6e4a7a9c5f8cc46056d7538932cc2f86ff2698abcf100b53.exe
                  Trojan-Ransom.Win32.Crypmod.adok-4b4cf0cb7674e0ef6e4a7a9c5f8cc46056d7538932cc2f86ff2698abcf100b53.exe
                  3⤵
                  • Executes dropped EXE
                  • Enumerates connected drives
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:5964
                • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Crypren.afyz-355b8ed7476cf09a8c510e1442fa57ca1ade6c54a7306522a6e48f34e8905bda.exe
                  Trojan-Ransom.Win32.Crypren.afyz-355b8ed7476cf09a8c510e1442fa57ca1ade6c54a7306522a6e48f34e8905bda.exe
                  3⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  PID:5596
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 2552
                    4⤵
                    • Program crash
                    PID:6896
                • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.DoppelPaymer.au-6ec458fe4d57f4637b12a9f740ae9a5bbc903d4499a89969ef9b564a5ba96d88.exe
                  Trojan-Ransom.Win32.DoppelPaymer.au-6ec458fe4d57f4637b12a9f740ae9a5bbc903d4499a89969ef9b564a5ba96d88.exe
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:6460
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 6460 -s 444
                    4⤵
                    • Program crash
                    PID:8956
                • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Encoder.kic-1c657d12c407867f9fca7b2386a9cff3f563f44b2c523bd33c9c20fc0cbbc24e.exe
                  Trojan-Ransom.Win32.Encoder.kic-1c657d12c407867f9fca7b2386a9cff3f563f44b2c523bd33c9c20fc0cbbc24e.exe
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:5616
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7068.tmp\7069.tmp\706A.bat C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Encoder.kic-1c657d12c407867f9fca7b2386a9cff3f563f44b2c523bd33c9c20fc0cbbc24e.exe"
                    4⤵
                      PID:7508
                  • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.PornoAsset.dkwp-a96181b68cae9625f9881b885009490f142c83cab3afe02b4c2c2813ec26088b.exe
                    Trojan-Ransom.Win32.PornoAsset.dkwp-a96181b68cae9625f9881b885009490f142c83cab3afe02b4c2c2813ec26088b.exe
                    3⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5200
                    • C:\Windows\SysWOW64\comone.exe
                      "C:\Windows\system32\comone.exe"
                      4⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      PID:5840
                  • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Snocry.dum-22d46011258236f404f345c0c581690252031132d938d946b66118daaa39047d.exe
                    Trojan-Ransom.Win32.Snocry.dum-22d46011258236f404f345c0c581690252031132d938d946b66118daaa39047d.exe
                    3⤵
                    • Executes dropped EXE
                    PID:4700
                  • C:\Users\Admin\Desktop\00394\UDS-Trojan-Ransom.Win32.Encoder-23d38f76f8e559c3eae61af733052138f2a01221f2d2c1206d845a6415e80c04.exe
                    UDS-Trojan-Ransom.Win32.Encoder-23d38f76f8e559c3eae61af733052138f2a01221f2d2c1206d845a6415e80c04.exe
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:2972
                    • C:\Users\Admin\AppData\Local\Temp\25E317.exe
                      C:\Users\Admin\AppData\Local\Temp\25E317.exe
                      4⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      PID:1560
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 6976 -ip 6976
                1⤵
                  PID:2800
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 224 -ip 224
                  1⤵
                    PID:6480
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6460 -ip 6460
                    1⤵
                      PID:1200
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Enumerates connected drives
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      PID:10148
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding E69D4C2116E8C36850717F6355683A04 C
                        2⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        PID:3308
                      • C:\Windows\system32\srtasks.exe
                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                        2⤵
                          PID:9596
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding 20823A819EA70EBDAFE4A8BD11478531
                          2⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:5764
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                        • Checks SCSI registry key(s)
                        • Suspicious use of AdjustPrivilegeToken
                        PID:7484
                      • C:\Windows\system32\werfault.exe
                        werfault.exe /h /shared Global\7cdd19d929164c7db4609d8f4f37ce60 /t 6228 /p 6488
                        1⤵
                          PID:7912
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5596 -ip 5596
                          1⤵
                            PID:7052
                          • C:\Windows\system32\werfault.exe
                            werfault.exe /h /shared Global\abd15c80f16e4edab43860021057cf91 /t 10204 /p 8468
                            1⤵
                              PID:9832
                            • C:\Windows\system32\NOTEPAD.EXE
                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\HOW_TO_RECOVERY_FILES.txt
                              1⤵
                              • Opens file in notepad (likely ransom note)
                              PID:9696
                            • C:\Program Files (x86)\Themida\Themida.exe
                              "C:\Program Files (x86)\Themida\Themida.exe"
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Checks whether UAC is enabled
                              • Writes to the Master Boot Record (MBR)
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of SetWindowsHookEx
                              PID:4056
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:5760

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Command and Scripting Interpreter

                              1
                              T1059

                              JavaScript

                              1
                              T1059.007

                              Windows Management Instrumentation

                              1
                              T1047

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Pre-OS Boot

                              1
                              T1542

                              Bootkit

                              1
                              T1542.003

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Defense Evasion

                              Direct Volume Access

                              1
                              T1006

                              Hide Artifacts

                              1
                              T1564

                              Hidden Files and Directories

                              1
                              T1564.001

                              Indicator Removal

                              2
                              T1070

                              File Deletion

                              2
                              T1070.004

                              Modify Registry

                              1
                              T1112

                              Pre-OS Boot

                              1
                              T1542

                              Bootkit

                              1
                              T1542.003

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Credential Access

                              Credentials from Password Stores

                              2
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Windows Credential Manager

                              1
                              T1555.004

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Peripheral Device Discovery

                              2
                              T1120

                              Query Registry

                              6
                              T1012

                              System Information Discovery

                              6
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Web Service

                              1
                              T1102

                              Exfiltration

                              Impact

                              Inhibit System Recovery

                              2
                              T1490

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\$Recycle.Bin\HOW_TO_RECOVERY_FILES.txt
                                Filesize

                                2KB

                                MD5

                                dde4eeed33fca4b00ed69a2c54c32375

                                SHA1

                                9da210ede81d72961eeb87ac349e346edb460f3d

                                SHA256

                                cd90ccf38a1af1030b9bde388c8dc754d32f25e515cd6ea686d030e491c9c371

                                SHA512

                                64fa7a988cbd7468f03ab5016ab1c8264f8e9e62862ea98fd3c41dfeee32ae660bf28788b613e8f751fbce51d83be05efb79deeece576d3066b6e19de3887e55

                                Download Submit

                              • C:\$Recycle.Bin\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                2KB

                                MD5

                                2562cbf5f6166b984f7e794c8d5c6aa7

                                SHA1

                                beb148df0fb9667f6c8ab5ae83050fe3050f9542

                                SHA256

                                8156cf9b16694cc3d738561faf9568da6cf8b8b4eebe690a44c788b819ace324

                                SHA512

                                f6633c98204e3ed4f26b328c20f8b76a8271030c1e3e0a217673aad6098dab26c5fec2621546a4b57df4f4169d158653a84c2945d94408cd4f9530cfc431a19f

                                Download Submit

                              • C:\Config.Msi\e5974aa.rbs
                                Filesize

                                41KB

                                MD5

                                44ad2f405e87cee197885b33b291ba3f

                                SHA1

                                fab04001277dc1679bb10d86ea7d4833aa921dbd

                                SHA256

                                0d36603df9e450601a13d35b541259c205edb2a300e5dea77087e43a89d20ae4

                                SHA512

                                fef558b5e687d916cbfc22561883071fb1e9c6dbb7681964dd173c55e045b679dcd64813032590139bf82024df2591ebae1873259f31746684bb870360433a47

                                Download Submit

                              • C:\Program Files (x86)\Themida\ThemidaSDK\ExamplesSDK\Macros(Check Protection)\Delphi\Via Inline Assembly\Project1.cfg
                                Filesize

                                434B

                                MD5

                                d8ff66a45c69860931690ad87575813b

                                SHA1

                                0eb8f818d6374031a791767ff2a60e8dc8c8bd94

                                SHA256

                                be4b309251a5ecc7111b5a044c637a6ddf3a548176ac5c66480ccb0a4c20a444

                                SHA512

                                f5721d3db7f66c29d663502661d11c06a567ac3d55281b83836e1ebd9363dbb83aec8fa397bc4cf4bd1166c5d4351ad1167a48ab0f8805e56339a929899e1a25

                                Download Submit

                              • C:\Program Files\7-Zip\7-zip.chm.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                114KB

                                MD5

                                f208d7d455a736398253ff683197b621

                                SHA1

                                35d6ec6044d518bbe64f58d3f4ab0d1934db83ea

                                SHA256

                                443c2daabb300044b46d06889b09c3eaa20c5fed44cd2c4f1b0954067f541e6e

                                SHA512

                                2eaf3989e07f3762f2b7522f1294a2f3758f9a2616939c5f6b13fa5ee8b8d5e97391ba4a1c8ca6345ee296daf268bb1a67538a35a509e6dc6c79fc6fc7aa09f4

                                Download Submit

                              • C:\Program Files\7-Zip\7-zip32.dll.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                67KB

                                MD5

                                2d647dc204fbe60cc8c45af07f79ccab

                                SHA1

                                e568aeabd45eaee50b279d2622092494bed42fb3

                                SHA256

                                bbe83a6888377187e26ec3927199e486668de98eab5b7caae858f5f7e0cbf5df

                                SHA512

                                90e5ebb91322e089c93d8ad3f144e0c6a2d8679c3a521f4f77881753f71df1816676209cdd94d53fa109c44f221bebf0bcaf07992e45e1cb81255ab6acb5f6e2

                                Download Submit

                              • C:\Program Files\7-Zip\7z.dll.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                2.5MB

                                MD5

                                cdf255cf4158968558f44f3c871314bf

                                SHA1

                                5bd08dc7d1ae1c2811e7c6372f3599a9c9f48333

                                SHA256

                                dc36f18f7fd462d5aa72afede7706ed17b8f04942c6b0618852f1b22c5ccb614

                                SHA512

                                f5264dbf40d83005aaf62de26f292a3525a04208b4f6f12b5f42cc4eb805d2b706d49eebd2ea26d0e7f37ef1825498cae65291af7686171806ceec78840dd413

                                Download Submit

                              • C:\Program Files\7-Zip\7z.exe.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                546KB

                                MD5

                                0e618bf1921eac9cc014e0ed6623e873

                                SHA1

                                647f5cc413679b06d71382ff24b87f108b613a71

                                SHA256

                                0a2ed11d6edb67ad56ce90cad44c894a9003a8a4829532753e7031e3e9db3559

                                SHA512

                                6737c7123382af369dfcdbd3bc8103e5bd84479d56dd42ea8254d368adabe24b79c55f67af67908ec0b5f00fb32bc468ca1069baa8eba2067175bff98c1210be

                                Download Submit

                              • C:\Program Files\7-Zip\7z.sfx.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                211KB

                                MD5

                                e4056feaa2b9b6726b402eae71e9e860

                                SHA1

                                c1d9e3e0003970d07568859f3e1883f5483e5980

                                SHA256

                                e4e01c5a11962cad8f36641e6b713e9eaeb51571289cdf0de9f4e9bdab93653f

                                SHA512

                                50b136d82af449f5d184f3af9be213d9d163997a4ab0e41a77c4c238f66f3c883da3d89358521a79683d815c13dc5ba663bd16468238b68da336fa41967081de

                                Download Submit

                              • C:\Program Files\7-Zip\7zCon.sfx.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                190KB

                                MD5

                                9ef5ab0ea574da7a6ff4c7fae51dd9f1

                                SHA1

                                4a1c215a3b77f33db09089101e47246c7da7258c

                                SHA256

                                e62b81795a65e8dea5c0c6cb71274c9f64808b2f2f4a81b44d3b7dc153b8fd2a

                                SHA512

                                f7f25fa43e5a2f89baca643da7906500050b6b6d9baa02baba6b78a74ba48621a33384e6ebbd1a4a6a7a096576cf088ff9c0b9190204bfbf841a889e3fc4d926

                                Download Submit

                              • C:\Program Files\7-Zip\7zFM.exe.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                932KB

                                MD5

                                3fbbf546e12a85fa87f77c2aa7739d47

                                SHA1

                                b3b8e2b5743d6401bc66581124272e0bc8d07fbc

                                SHA256

                                3d670c2d51647d6f67ed27d7b10536e1a41f0dffcca3714f38ee5fd685129a0a

                                SHA512

                                d429cf6513cc2a7076b22df0706e4c89fcd5ac159e0193f3b5092a6a509718dd5039016e7db90e06c30929d0e4114ff62027c6f22080d4a45b9eb3111d793521

                                Download Submit

                              • C:\Program Files\7-Zip\7zG.exe.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                686KB

                                MD5

                                0bc0c17b4706ecff98c6494b87d0c95a

                                SHA1

                                4d5089e3eb0b63e06117edf6aa1569401b6ed54a

                                SHA256

                                db818c12539deb290a36ae2de219da030e4f01bba767514ed4492e2adf1c8218

                                SHA512

                                fd368120e85cc26eb726b115fc3014f6166b776b25c044ea2d19c642e726e89569b5b6cac8adecca7c9dd67ff500426affc1aa7736e5fcf174d9c7f296f0cc67

                                Download Submit

                              • C:\Program Files\7-Zip\History.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                59KB

                                MD5

                                173be1dee835691062365b8fd79a15b9

                                SHA1

                                59028815dcab19d3568098aabdf86f89d544de13

                                SHA256

                                3f12749f1105f13b5794d2795055f3c741e3bb015dab284a0fbd51ec361b8b20

                                SHA512

                                dadd3ff7123c75578c3b5fa19b0239e9385c58578b8a150c444ed59f4357873582224496f6f4ef5076bc51f73713457485e0d1b2b75d85b2a07a2ed3e3205192

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\af.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                7KB

                                MD5

                                3eae58b3f6c7598c1b13cf1ae888a033

                                SHA1

                                b6694a7b8a5a6e015b09d7c53cba1bd6a238bae7

                                SHA256

                                4c48fb3f809efebd784d492a18dd3807d4d8f138828f75f6f37ad85b4721d4e3

                                SHA512

                                3a76f7ee8ba0e601c09763425d667a7c16f7a8f4d59ed5f2ae944be0f78b8bd8398e6a5a1402716a54e4140dccec3410f2bdde4b77e7711e43af1eddce7da67f

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\an.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                9KB

                                MD5

                                dcc85ea00df10022c1eb54773c6bb12c

                                SHA1

                                053dfb176a8d764d2dfce7e09df12ff3fc94ebbb

                                SHA256

                                83ec76494ab9d2ae2356b15ebe50246ca81c3619dd58621123001f7aa1e4d437

                                SHA512

                                3c986c82f160dda959a8e8275f61a268c85b01cd2b2be10ea3b8d427ca029c58cf1c41015d2ee42f7751849c35f83972d2014db1d8333658495219119659d179

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\ar.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                14KB

                                MD5

                                9c0833c44a2d95133f432abaece559a7

                                SHA1

                                4b92c2cc3d7667917aaff42dc870e3f43ec5051d

                                SHA256

                                550012b9f1956424f3805b8e0eed4c3425a121daa5e1a18660b1a6e65c16aa9c

                                SHA512

                                db0b1664af6078034feea2a339a7b7f95621f02dad8abe5eb214a98752377e4537ee26a1a8e4027ee88088a3103866852864bcaae12b7536a5781d3a34385bd5

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\ast.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                7KB

                                MD5

                                29e3320558af17334d8773f73255036e

                                SHA1

                                ff6eda86125ff284641191ec9066682ac16f26b1

                                SHA256

                                bace7721ad04faa39e06cf96da9bc99c2b65f222cbaee93f90a7fd9adc7c26d3

                                SHA512

                                abbb728e79d6a000f6296d8696ca72e5f737f13e8f905934e56f87572adfef221f0d2dc5ec479a12dcfbb6cc8e69937587e880f19378114dcf40305100cd0dd5

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\az.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                11KB

                                MD5

                                d53e2cc29c1fdf0741d894fee3288578

                                SHA1

                                037e6c0dddefecb71b4b17ac691e9c8ff56795fc

                                SHA256

                                aae0cf1f3dcf721ecc997f670d3ffa8df2596da9d9978912f19bd5ef9feb01ca

                                SHA512

                                36534d534ab7d9ccbe260f58667cf9efb68cd1259fa695fa7edc0344ffaf18e6d40168b6ad517d27626e2e8f3ef0794427ea76299d141304d2f1e5b1935554b8

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\ba.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                13KB

                                MD5

                                1c576f5f5820d2091e6acb6029bc0b81

                                SHA1

                                b3f247567ceded1bc4e10e45d854e6ca75fd483a

                                SHA256

                                21b5c804fdd6f37fc286e4e56c3677a72378d12d98a24c257905bc9d6d0d654e

                                SHA512

                                573e5b970a0daee0e1b56f10dab09beb0218738898fec1fb773e18be9464646d6a82a9423d40bbf71bd57b244dc1bfd2f3cd2cd319829faa3d8e7cc11176a7b8

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\be.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                13KB

                                MD5

                                427eceacdbea9f97f3931bc172e5504d

                                SHA1

                                864cdf21fd5123345ede37bb0c334d0dd5ecfb40

                                SHA256

                                ce7b0537ca654dd14402c787c34bc407a0582276199ce7ac1df5a1411591d91b

                                SHA512

                                7b775dd67c24fb83fd0c53441be5a3a7e80080021914cc63422698c6cb4d174e731ecec4bca6a9c978d35ce89e7d936adf622018c071cf4ba372f487be257ac2

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\bg.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                14KB

                                MD5

                                ffcd27feaaecee1aa6b5f79809dfc32a

                                SHA1

                                81e45017beacd5ee427e15257f4cbc262291b437

                                SHA256

                                1d9d42b9f5c10b697d707e5f194c33de8079ac0a8f3938fd4db2aec3335d1c77

                                SHA512

                                9baa44735d857009b727984471dd85ad6afc05ba70e148b6803c84d8e7abd0e5fbdbfa80171d1a3fab9d702a6ffc4df169d1f3f0a44a878f49abeafb88f88360

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\bn.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                16KB

                                MD5

                                a2651a7fc97734534f4f232c30af1bcb

                                SHA1

                                fcba3924d5934ea415a0e7f0c2bd99555b80f5d3

                                SHA256

                                a5c72b229791f8ccb24128899ab0616db51eb7649e6ed9ab13609c2be33ac4ae

                                SHA512

                                10d12fa04fa8e19323c1cfe981d616892e2c70a4ec46237057cce32bffae1ed671a82a26fa9bb3bbb14b65afd29dde7abfb7a0029a3c45a5166bf921490ad7dd

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\br.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                7KB

                                MD5

                                1b441190adf2853cfbde361f6056c9e7

                                SHA1

                                a62c397f0018083343c9287b1d35f8fe582af8fd

                                SHA256

                                121d14c04d0e4c8a2cc3eb2a4693cfb1aaac09bc1748506865d30bf6f94d81e3

                                SHA512

                                7d5f88841b7bbb4b33044520dab39c49e4fbf515c72962a14eeceeba49296c68397be9f00dad95837eb8376053801ee89eaa5718b1b2c5c6d51b3039a3094f62

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\ca.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                11KB

                                MD5

                                9180fe99736e3cf701d7cc992632e3d2

                                SHA1

                                6ea4fd8b62b4eaf1e63877df9c6bbee74f41b3f0

                                SHA256

                                e5b3410b94a616b0ca78cc7f04ebe57d3562033f4aea09d5f82780a21ff4b53d

                                SHA512

                                af0da25eafb79e7df57e14f97e9b45aeb7cce3f7afd993868b8b6c2c37b93b76c6a9a6284e37ddfa6753323dbe486b725d8286f498e09a727c2d906c6f4ec701

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\co.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                12KB

                                MD5

                                d73cd76eafbe50595ab03477abbaa653

                                SHA1

                                54b19d7c168397bc4c131d050926300801031e74

                                SHA256

                                504aee1e3be467acb7f3ceed73c04609a95044894afa5f3df1f28c00a5da001d

                                SHA512

                                7d79b31fead6bd25d6d6810c3083957d19690b204ebc3e9f39b71830411be8e89e985ae7ebf6ae3fdd49bcebf52afbd8a7366036c3293c88d254315f356bf1b3

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\cs.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                11KB

                                MD5

                                d4c666c61388ef8827814175c49cdd45

                                SHA1

                                01d6ee834d6676516c8c03706e2e44308efec1d9

                                SHA256

                                1b88a734298b1a2200bb86d1d3fcf8955e1d4f78dd1774758302b369d24d34af

                                SHA512

                                56fac17c139484af471ad307e5ecbcf68d2b4d6dc7377bcc6c4a9271a3664d4a9fd81a763ee2abd91a7000895d73f8eedb1c3f2f155649c69c4c8966bc8d4b5c

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\cy.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                7KB

                                MD5

                                a326e2c3da5966c5e5ae17ac6417d74c

                                SHA1

                                cb2604a57e5dfeb26355298dba6175dab19edb9b

                                SHA256

                                e7d2d202746d6eaa4244a5fab27ada608e9d8cf95ad93610e0a1eb58f219e502

                                SHA512

                                58de8a5dfa959e8ebcfd4aba5209106d75a3a8ea24d64c62b82678deff702334f05f7eea617c7d1654de4137c58ed787c4188a4b66d03af02e6a1ed1a8022126

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\da.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                10KB

                                MD5

                                c9d7669742fcb75d42179fce0b34353b

                                SHA1

                                e37198a038c0ee40feb10cf684b2e8e0fed1c79e

                                SHA256

                                d6364ea4e3d04268dd8cb14eb5221c7baa98247afbc985782b3476aebd9d7193

                                SHA512

                                fba080e62befef98fa36c5e87552876661396775af9e34b1645cb23e6ad0c0fcfc1c22206447675ae30979cb8a32b0be223ed60e6a8650678d69377f34193679

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\de.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                11KB

                                MD5

                                d1c0bf9dfc73428ebe9334730145cdb8

                                SHA1

                                ba7586a2d4866708a07037e399996366ee90bb8b

                                SHA256

                                c0d05597e4eedcb9e9c450048a5b31d4995477978ed552fb88aa10f5a4c20d70

                                SHA512

                                7ebf10304f4593373c77b4f7ca53b5bd91b098d1f11df04c07370f5688bd9c2d50ea434a158b926e07396c95563c226a9fdc6fe32ebf853327cf5bcf28d77b5b

                                Download Submit

                              • C:\Program Files\7-Zip\Lang\el.txt.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                18KB

                                MD5

                                77f2d06706eac7587d532429eb336237

                                SHA1

                                ce7b76a5e3c582d36442f0cb0982f60da75d3be6

                                SHA256

                                4fc11b53688c613c2bcae4089a47eba42aedbcfee985fef8f04bb54a7038f38b

                                SHA512

                                7d497b05585a2f30383ada6c498c722075116e766be966fc68c32e32e75912a6a51c3af7c3f27f84d795a74707d24bc93bcbc94e0a246a83f0fd7508ccd91199

                                Download Submit

                              • C:\Program Files\7-Zip\descript.ion.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                2KB

                                MD5

                                d4e602db4b9ca79a4b84145ced52bf52

                                SHA1

                                cf617b410113aae8dbd2d0034a01b0805d93e5ef

                                SHA256

                                a619391bdc1e7a2728f419032eae4c18b89c16f070870390fd7c54e504540af3

                                SHA512

                                2dcbc672d249a3176c9984e31ac1067ebef0ebce763bd99b8f2464bfd90a0ac85655aea659faa234eda1a782e215a4fdefa75c6779e0a7204c5ec63e6ab0af65

                                Download Submit

                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-2A16F034.[telegram_@spacedatax].ROGER
                                Filesize

                                3.2MB

                                MD5

                                6b69acf8229f2d3621a24ba6a33f2319

                                SHA1

                                0db5136e40de4cbd1c99b74f94d4d1924aa08f07

                                SHA256

                                55b86f4e69861b1552ef53f766e4212bbc432b40cca5776d21d78f42c6023b45

                                SHA512

                                b4502bbf7241e98facfb4bf5160631f63b1ccdf0cef0c055da155ec292672532c8659e2c78e3b15559cd8fc9285d97ed94c594bad75eb059f26b9e1de527632b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                Filesize

                                64KB

                                MD5

                                d2fb266b97caff2086bf0fa74eddb6b2

                                SHA1

                                2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                SHA256

                                b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                SHA512

                                c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                Filesize

                                4B

                                MD5

                                f49655f856acb8884cc0ace29216f511

                                SHA1

                                cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                SHA256

                                7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                SHA512

                                599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                Filesize

                                944B

                                MD5

                                6bd369f7c74a28194c991ed1404da30f

                                SHA1

                                0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                SHA256

                                878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                SHA512

                                8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\PrepareDlgProgress.gif
                                Filesize

                                24KB

                                MD5

                                f550f449baed1315c7965bd826c2510b

                                SHA1

                                772e6e82765dcfda319a68380981d77b83a3ab1b

                                SHA256

                                0ee7650c7faf97126ddbc7d21812e093af4f2317f3edcff16d2d6137d3c0544d

                                SHA512

                                7608140bc2d83f509a2afdaacd394d0aa5a6f7816e96c11f4218e815c3aaabf9fc95dd3b3a44b165334772ebdab7dfa585833850db09442743e56b8e505f6a09

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\Products1.png
                                Filesize

                                80KB

                                MD5

                                8fba38514c65d78433176678600cdc5b

                                SHA1

                                8fdeed8181c940649bda310c74d29d301e7ffeec

                                SHA256

                                af4cc127f9801621641ab6d96f38ddaf6a6d94d73d9907e283a0d7594ac19bfd

                                SHA512

                                cf2555c6e15eb95c2dad9faf2f2a3fb2033e15fdad74221a3dfb139c2819640a673f494adef23b5531ab731f961bbc03dbd6cf2ac08ab9c2e055f6a897a3a015

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\ProgressImage.png
                                Filesize

                                173B

                                MD5

                                6bbc544a9fa50b6dc9cd6c31f841548e

                                SHA1

                                e63ffd2dd50865c41c564b00f75f11bd8c384b90

                                SHA256

                                728c6cc4230e5e5b6fdf152f4b9b11ac4d104fa57a39668edea8665527c3bcc2

                                SHA512

                                2cf43d3a3f2e88805824e4c322832af21c4c49d5309387aa731ddbea8cc280a6049cab4526e20b1c87c39c8781168c5ff80083c94becf0984b94593b89ab77f8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\backbutton
                                Filesize

                                404B

                                MD5

                                50e27244df2b1690728e8252088a253c

                                SHA1

                                b84ad02fd0ed3cb933ffbd123614a2495810442b

                                SHA256

                                71836c56ec4765d858dc756541123e44680f98da255faf1ece7b83d79809b1c3

                                SHA512

                                ba3d3535bfd2f17919e1a99e89fdb1c9a83507ff3c2846c62770e210a50aee1281445d510858d247cc9619861089aaf20f45b0b7c39f15c0ea039ac5498fa03e

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\background
                                Filesize

                                134B

                                MD5

                                a0efb0e7b9cee25b09e09a1a64e96ba6

                                SHA1

                                0c1e18f6f5e6e5e6953e9fb99ca60fdec35d6e39

                                SHA256

                                f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787

                                SHA512

                                7e53f9f564aaa529b3b15035671957c2923ec98ddee93758ea7a4c8645ee9058962078771b853e3490290fde1f57030dff5092d40d69418776ffee89f79c8a7c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\browsebutton
                                Filesize

                                253B

                                MD5

                                9554be0be090a59013222261971430ad

                                SHA1

                                9e307b13b4480d0e18cfb1c667f7cfe6c62cc97c

                                SHA256

                                f4302ee2090bc7d7a27c4bc970af6eb61c050f14f0876541a8d2f32bc41b9bab

                                SHA512

                                ac316f784994da4fed7deb43fe785258223aba5f43cc5532f3e7b874adc0bc6dbcd8e95e631703606dfaa2c40be2e2bb6fa5bc0a6217efe657e74531654ea71c

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\checkbox
                                Filesize

                                1KB

                                MD5

                                0b044ccde7aa9d86e02a94030d744ac2

                                SHA1

                                0594ebb3737536703907ba5672ccd351c6afb98a

                                SHA256

                                bce5b6de3a1c7af7ec14b6643da25f7c9e15bd5f1c4a38abfcddc70a5e93bdd3

                                SHA512

                                dbfba793722589f1a76dbc75c9a2f3646733e4a079a6b70003716a7f7b8fa1a6a2b234ec9132f5737e91d20d460db1e29826b2d7ac740f73136975f19e336cd8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\frame_bottom_right.bmp
                                Filesize

                                66B

                                MD5

                                1fb3755fe9676fca35b8d3c6a8e80b45

                                SHA1

                                7c60375472c2757650afbe045c1c97059ca66884

                                SHA256

                                384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21

                                SHA512

                                dee9db50320a27de65581c20d9e6cf429921ebee9d4e1190c044cc6063d217ca89f5667dc0d93faf7dcc2d931fe4e85c025c6f71c1651cbd2d12a43f915932c3

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\frame_top_left.bmp
                                Filesize

                                154B

                                MD5

                                1966f4308086a013b8837dddf88f67ad

                                SHA1

                                1b66c1b1ad519cad2a273e2e5b2cfd77b8e3a190

                                SHA256

                                17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741

                                SHA512

                                ec50f92b77bca5117a9a262ba1951e37d6139b838099e1546ab2716c7bafb0fc542ce7f1993a19591c832384df01b722d87bb5a6a010091fc880de6e5cfa6c17

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\metrobuttonimage
                                Filesize

                                404B

                                MD5

                                17368ff7073a6c7c2949d9a8eb743729

                                SHA1

                                d770cd409cf1a95908d26a51be8c646cace83e4c

                                SHA256

                                16e6e7662f3a204061c18090a64a8679f10bc408be802abd2c7c0e9fe865cbb4

                                SHA512

                                cbc3a378335f131d0146e5fe40cea38a741a0754a26304daebfda6f82c394cf0e151654782c6c8c7bbf7c354fcb72a2c66a77a87df528c2a3fa87c88f204059d

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\metroinstallbutton
                                Filesize

                                520B

                                MD5

                                70db38d656afa3778dcf6173d390e61b

                                SHA1

                                8b8674d6d70d67943d313d2b74222daa4bd1691d

                                SHA256

                                3a0a5b69f9da7cae9fc631326ed8aa97abbaaecf2bf15d0a73169a29f3381e83

                                SHA512

                                8888ab493c7342f69b33279eaec4f99c41a906929d65503c48c7059d199fbab267ba9ad6ef6e57a7a56d2a321c01e46008f770afe67fa99ec7b7676ec2376c05

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\metrorunapplicationbutton
                                Filesize

                                3KB

                                MD5

                                49ad8e9164fd6facb8a8bfd6f62972b8

                                SHA1

                                e23605df242772a047d6d3543aaa72241066abb9

                                SHA256

                                914a0241a557591dfdcf3ed1ef0e557ceb153f32c716c53d13342dc5318bbb79

                                SHA512

                                843359888242b97b12185954fe6f04bbe8ed14c71f101a79d4863ccdca7d1b03b4e1f0c6cacf26f87a91c5eacb0d4571481bca81a0c3dfd8add475310a6269f2

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\nextcancelbuttons
                                Filesize

                                404B

                                MD5

                                583580e2c651f5c230fb3235b7ca0e3b

                                SHA1

                                a9bd6aeef43a6f4c0c00d1ecd98a585d7eb0aaa3

                                SHA256

                                65172283ee04f2fa18d0e57b21471be2e68017d1f61816aaaa6be070b446346f

                                SHA512

                                6c61e6c06c883113a7a0efbd352120354c070f5c17d770b6b821c42cb9d9ca895992842b29b51bd3e569b0c95e93709dd7c1c2a26bcff0ad425079f5302670ce

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\runapplicationbutton
                                Filesize

                                18KB

                                MD5

                                f5a120b564fc7823d1c269b7a6e70473

                                SHA1

                                1b85466c12f83b7872214f787390614df50eaddb

                                SHA256

                                c178ed81de4aa8b049efcf0670c10cf2043a51c6be1144ee95d09c1c2afd6087

                                SHA512

                                96d285759f8a8c5d17d7cac4ef224995dfa09554a3687c7f34e63651888c98a9c60095cd1a71c82030781ff6e7d58b7d49068bd9f53126ff7b775579d3368ace

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\sys_close_down.png
                                Filesize

                                273B

                                MD5

                                f6a5e71e9cbe8d3654a2cdf91aae98fa

                                SHA1

                                8871a1ae25cff6c5a3e6288a58fc5f4d7a92409d

                                SHA256

                                4801d63bd9bdc6279765ba785b0da9e10730764a9c3645934a46c691547c0612

                                SHA512

                                1b3146dfdef9c46123f27fa355790036f296d600bb10fbad12363c71c8e3a840863512f4a581daa18ffabb3ec5a3720a6337c4bac54be8b9b49d161b9459a1c9

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\sys_close_hot.png
                                Filesize

                                276B

                                MD5

                                17242d201d004bb34449aab0428d2df1

                                SHA1

                                77a332c6a6c4bfc47a2120203cfeabb8a2268a6b

                                SHA256

                                15405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033

                                SHA512

                                605a97e2614c664417d53263be21c67b1504a46ee61b92b0a84ac18a7baab05eb56b72d4cf27372ae6c157928080ba16e24081e95458eb122ba18f3722c2d21f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\sys_close_normal.png
                                Filesize

                                225B

                                MD5

                                8ba33e929eb0c016036968b6f137c5fa

                                SHA1

                                b563d786bddd6f1c30924da25b71891696346e15

                                SHA256

                                bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5

                                SHA512

                                ba3a70757bd0db308e689a56e2f359c4356c5a7dd9e2831f4162ea04381d4bbdbef6335d97a2c55f588c7172e1c2ebf7a3bd481d30871f05e61eea17246a958e

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\sys_min_down.png
                                Filesize

                                205B

                                MD5

                                5e947815d865acf099fa753283e09179

                                SHA1

                                7d98046d20a73439c53044e0ebb5f0b34afaeea9

                                SHA256

                                c1d0663131fe901d890cdd9f18af8f9a553bee4848cbd978f5122e8383b5534b

                                SHA512

                                b22e31c37d84128b271c5e5a70fdce90a3bbc02059d1bd032841b3383dbeeca56ec9abe6335453abc8ded1de84e6fcafb648d76d4dcc79246339e9a5eb6d5270

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\sys_min_hot.png
                                Filesize

                                180B

                                MD5

                                1a883668b735248518bfc4eefd248113

                                SHA1

                                1112803a0558a1ad049d1cac6b8a9d626b582606

                                SHA256

                                bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e

                                SHA512

                                d321878ed517544c815fd0236bdff6fcb6da5c5c3658338afba646f1d8f2e246c6c880d4f592ff574a18f9efdf160e5772bbf876fb207c8fd25c1f9dd9ddfd04

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\sys_min_inactive.png
                                Filesize

                                175B

                                MD5

                                a2c4802002bb61994faabda60334a695

                                SHA1

                                0a2b6b0ceb09425080c5ba4b9cbdef533cf69eba

                                SHA256

                                a3b59dbc5a39d551455ff838e71b5820560ca3484c6411b9d69df33d8113619c

                                SHA512

                                34e130edc650c3de6020f2d2b5dc1404b7aee0105eb7e315c15c5aa61398d174377e9b6a2aecc55f79f54c04812b8745c6739a201539e291538979e6b024da31

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\sys_min_normal.png
                                Filesize

                                238B

                                MD5

                                516172d0ebf941237cef32fcee8cdf43

                                SHA1

                                6bee117996c16c7413be876dfc15978d14813091

                                SHA256

                                56e64eaf6349ece08005e6f7299de413ed00112d53518215d90690be2b2a4f1a

                                SHA512

                                46477a58aa7e9eeae29e1c1d826bf045422709b7c8f428985c617b366012c58121d4404523a75efe77fc6d8e061a6bb209743d0a2af81545898f51c8855728ec

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_8576\viewreadmebutton
                                Filesize

                                2KB

                                MD5

                                c288a7a350a1a5a5eee9ada36cb6011c

                                SHA1

                                d1174e488d08dc4ab9bba3fd7653724d5553898f

                                SHA256

                                030e5bb7b7fff395c38433516cf96988939cb794d9d62d550d7eab9cef7d2b2e

                                SHA512

                                dc7f9486699b4eb4b8295590112b540ed619c2b956948eec3b72fe86226740f43392dd1898d5f27d553e775351c527ac316f4606389b92bedfc996845649a859

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\MSID928.tmp
                                Filesize

                                86KB

                                MD5

                                616d33d84937a1edde1bb431b8cd8fc0

                                SHA1

                                4a690e056a7808d10d0667351697fa43640aecb3

                                SHA256

                                494939263cb5535d464a8cf49616e1fa69bc8de099aae4638b1609e32827bede

                                SHA512

                                daabdd78946d2c12124c680a31e8e7afd9184ceffdf2fd59d0c8067fe46ee80f53a843b93fd3be203a0fa74424e95d1509d8f1a75db3ea6239b19b3b78e720f6

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xnly53hd.y0x.ps1
                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Oreans\Themida 2.4.6.0\install\Themida.msi
                                Filesize

                                1.0MB

                                MD5

                                8ff0b207200c87f2d7629120ab57980b

                                SHA1

                                6e30b18e97d0d5d262df41b1d8a8ea8c2bce81e6

                                SHA256

                                e9b0a8fa04f2ecc69447b9263389d87ae748fe219b0f85e83c3c7289ffd7553e

                                SHA512

                                48f67d8a9c2a241e4e3234b45de28105b4120bffa7fc020d115591fcdb6a68a2c6525b4294f260777eb9da14a936114bef5263cb9257702a76b2f102d207f566

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\license.js
                                Filesize

                                254KB

                                MD5

                                869ebc637e29b28668bfaa56a4482cbb

                                SHA1

                                8f8674f3a4d80c02be96e30e58389abdbdc5a441

                                SHA256

                                99af43ab309334577b01e9a4caebc5e7ba01602c5aa2aa402f07b2cc2c3038af

                                SHA512

                                6656505fdbf62e415b281682c3c2b472f960030a12fd06e15cea511061016b4f102829833c7b0590e7554c27b508723f88f4837e41cf3cb3aa2d9e183a2834a9

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.MSIL.Blocker.gen-0d6673edd2998e93f605a0d828dafd54055169580e8390e48fcbae7216bf1cfc.exe
                                Filesize

                                628KB

                                MD5

                                c3ded2ff55251338c0fdec3333b1c6ab

                                SHA1

                                fbe88ff5c0de0025c306b22b77432ea4590d5e05

                                SHA256

                                0d6673edd2998e93f605a0d828dafd54055169580e8390e48fcbae7216bf1cfc

                                SHA512

                                3b322cd02ed4a1139bd8e4d1c52a541486c754bf9a4e610ce191870a77c72db405a33cd5fc301a13ca4c2f7a8b970007a6834a54b31f56fb68b0671aebf59de3

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.Blocker.gen-aeda2014bf5250cb3a6c32fe9da4cf97793f8849221047bf155fe515c9bc1769.exe
                                Filesize

                                1.3MB

                                MD5

                                330adeea904a1b244338884d414364f0

                                SHA1

                                31d87590bc332a7c2570628bea6e4ae16f36af79

                                SHA256

                                aeda2014bf5250cb3a6c32fe9da4cf97793f8849221047bf155fe515c9bc1769

                                SHA512

                                502cfc7b49b9a6ad83b2efee197966d64d61368398cd56db1e06d24dff32e0d50067f336d6a5ef1520a16171db516824a315117ee3dcfca8b54e0041d6a4152d

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.Crypren.gen-d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08.exe
                                Filesize

                                263KB

                                MD5

                                02062ed82e5359e9094eb74767e6a007

                                SHA1

                                9785f019e92675899d0284a1c293727c4afb0e4f

                                SHA256

                                d48b4ccd17d23b9935c7426671918ce48dbc8cf25e7cf98550300b43fb16bd08

                                SHA512

                                268e2797a861c8b6c40ee7c0b36485e22ee3bf0bb1a3d22fc87c0cfb3f345b176509b23d989ff833df93fe233aae8ff2b02104b6f8d5e5a03d8c6107dca335fe

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.Encoder.gen-f5464d39819344e94f36215f6e68a090031fe616437612a4abd82bfb7492887a.exe
                                Filesize

                                1.1MB

                                MD5

                                1c3b67ada6d6ca547a80f5ecf116369b

                                SHA1

                                44e430315ae5a85450b5de2354fd555774929b98

                                SHA256

                                f5464d39819344e94f36215f6e68a090031fe616437612a4abd82bfb7492887a

                                SHA512

                                68949bd7973e45fdfe9ea075ddf505400cf8a79163b2eb3ad5f64b43d1f9a59196e6f98ad7b88d0ecf666536562d7b20fd20db1f08e39ffde366534b7729e62b

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.Fonix.vho-e5324495a9328fe98187239565c05b077680b2ebc9183a6e3e2ccfbfa9f0295a.exe
                                Filesize

                                512KB

                                MD5

                                71b664b09dd6463b23899855eb62681e

                                SHA1

                                a94f92f1e6e4fed57ecb2f4ad55e22809197ba2e

                                SHA256

                                e5324495a9328fe98187239565c05b077680b2ebc9183a6e3e2ccfbfa9f0295a

                                SHA512

                                33d5037ac8538f7efee692f38ea38356da41125746e2a59e83625ed9ddca0e715128baf1d6bd73281b658b9c4ad65c9110f9fde962df4dc72ad6a8574f9b068f

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-87ee41b3141fd60ce9e1c8b744c67dee643a942e03e09a81026b31762104ce74.exe
                                Filesize

                                321KB

                                MD5

                                02e37a2c12689e648d2936047e0effa5

                                SHA1

                                c8cb8b40c5b60e191ae3b4a56db3e9bf84700570

                                SHA256

                                87ee41b3141fd60ce9e1c8b744c67dee643a942e03e09a81026b31762104ce74

                                SHA512

                                86cde210e2d41e604db44dec2de7ffb704ec5fc1cb0aa45ab0c76e357eb2ec954932723934f32fcbac285f494e1c4bae1276748c898d66fc42c654a119240358

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\HEUR-Trojan-Ransom.Win32.Generic-361fc41e13edf9845b4ca36c770138b033df619138622deddd10c7f3e00d7539.exe
                                Filesize

                                5.6MB

                                MD5

                                d47ffcff40d70127b8e3ead9ed820c86

                                SHA1

                                3cf746b669ab4de3445a7f7055c143e611b9d70e

                                SHA256

                                361fc41e13edf9845b4ca36c770138b033df619138622deddd10c7f3e00d7539

                                SHA512

                                5fddeea07fa918aa3cd4ed918b0c9bdb59cd365a2708387937f163b64cf2f464dd7b84bc28eb4c364f8cc036dddc3d3a9948e5b07b7b13e0550a9e82d4ba6ce3

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Blocker.lckf-864448901d066f7fa4835e4c12341d60bf7f610d8c45577ac5749267535c243c.exe
                                Filesize

                                112KB

                                MD5

                                0a9ee4058fce2dd656f08be22701d0d8

                                SHA1

                                d2951d4aa6469c57af03e45ccd1e33b881db02c1

                                SHA256

                                864448901d066f7fa4835e4c12341d60bf7f610d8c45577ac5749267535c243c

                                SHA512

                                ca4fa3ec18053b1004a171e783a8222c901f3b95b8a7ec80dc671ab6bd5b2bd261f20a63afeb76eee9472cd229dd4cda902047b713648eeaa3c45df19d593cf5

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.DoppelPaymer.au-6ec458fe4d57f4637b12a9f740ae9a5bbc903d4499a89969ef9b564a5ba96d88.exe
                                Filesize

                                3.5MB

                                MD5

                                8ec4bad8353ce03ddfb833f73034a617

                                SHA1

                                4046a99a43ee201f7db7a9d0b0edc706175ddbec

                                SHA256

                                6ec458fe4d57f4637b12a9f740ae9a5bbc903d4499a89969ef9b564a5ba96d88

                                SHA512

                                bfeaa4f2067c92d01ea1c555f7cc55a73e84766a3bf9e9d993149e45fcd52676e7d3e3c3c8af2f8b1b152d14c1c205b85f377bfaaa7b6118f6ba7c5457f9ad81

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Encoder.kic-1c657d12c407867f9fca7b2386a9cff3f563f44b2c523bd33c9c20fc0cbbc24e.exe
                                Filesize

                                1.1MB

                                MD5

                                ad280456e87ad7aeef1b4d3bdbd7573e

                                SHA1

                                5ca2b1928121f99f5a2b5ad90c3cdcfa2d00a6cc

                                SHA256

                                1c657d12c407867f9fca7b2386a9cff3f563f44b2c523bd33c9c20fc0cbbc24e

                                SHA512

                                59a9ab8ecbc96539823e4680e68dbe07b28cc573f1a2fcf9a31985bfe1418731303894f06872e03db08a49420c9e9f4457ffb7e06937861fbd6870056fe7363a

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.PornoAsset.dkwp-a96181b68cae9625f9881b885009490f142c83cab3afe02b4c2c2813ec26088b.exe
                                Filesize

                                537KB

                                MD5

                                b020d7d9ff0c771b9245a74c2486e1f2

                                SHA1

                                814634df2cc90febbe916cd17fab7293e96dd63e

                                SHA256

                                a96181b68cae9625f9881b885009490f142c83cab3afe02b4c2c2813ec26088b

                                SHA512

                                fb7a87d62041c2570cc001ded486bf2a35f9a37fa67ca47d41365d9c343d786a8161a469761aa514825396c05570eb8ff64a3329551cd727e0734e00f8463587

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\Trojan-Ransom.Win32.Snocry.dum-22d46011258236f404f345c0c581690252031132d938d946b66118daaa39047d.exe
                                Filesize

                                1.9MB

                                MD5

                                24615b25084cf1dbfe3f5c0302c3eeae

                                SHA1

                                bfebc9169e21a6d46e754a56e7502357988edd74

                                SHA256

                                22d46011258236f404f345c0c581690252031132d938d946b66118daaa39047d

                                SHA512

                                49e8072328a0cd58831590c1e4733d5e5d4fa5ad05a9af8996b7caeaccd8ebd1179027c196bc347d64f75babea389b8ce3e7bb1b09c1f3e00c390b732a82800d

                                Download Submit

                              • C:\Users\Admin\Desktop\00394\UDS-Trojan-Ransom.Win32.Encoder-23d38f76f8e559c3eae61af733052138f2a01221f2d2c1206d845a6415e80c04.exe
                                Filesize

                                212KB

                                MD5

                                af6db1e5eb0784631dca750bceb0b353

                                SHA1

                                6cca4c7459f22a485167457aeb36bb711c442c6f

                                SHA256

                                23d38f76f8e559c3eae61af733052138f2a01221f2d2c1206d845a6415e80c04

                                SHA512

                                cab8f583166566e262603ee421ed52d87e8a56835f2fc1e8c8de7676728d6e2251f40c09970cdb261a9d4f06c1dcbd4a565d1a182426e199de92d23bb5e6f2b6

                                Download Submit

                              • C:\Windows\Installer\MSI8028.tmp
                                Filesize

                                309KB

                                MD5

                                6509b4aa5d8561d61dd7699088bede3b

                                SHA1

                                126ccbd1db3ce2fcd412d4f2b9afe1e7c62a3ae6

                                SHA256

                                3b7ceecd08d77d0795144793ec9ef9be7fbe91f9242d0ff0b5521fa0bbf8d152

                                SHA512

                                085b3328581c774a5187f66bba38479474fbf8d6b2c6f83ea4c869d0addf9eeccbbd28d063fbfd741ac45dc113cb0646eff91653cea21825fa56e9968e349370

                                Download Submit

                              • \??\c:\users\admin\desktop\00394\trojan-ransom.win32.blocker.mpzi-4aeaf7f2d61fa7bf5fefe8d8e4c1755ec89ea337ae99dcbdbcaa18c97d1b271e.exe
                                Filesize

                                18.2MB

                                MD5

                                6ff64ea658bb6e3f526698c49b0b3445

                                SHA1

                                46970329cebb2be6aaa3c96ec8ce99ac4da08ccf

                                SHA256

                                4aeaf7f2d61fa7bf5fefe8d8e4c1755ec89ea337ae99dcbdbcaa18c97d1b271e

                                SHA512

                                9170fcd5ba0766d615cb4a2a1388427a5c28af946c0fca3492dd1eea06ed679df07c23f34a363297377fe12476614327a546b27d48a1c3a0abce1f75a434f8bf

                                Download Submit

                              • \??\c:\users\admin\desktop\00394\trojan-ransom.win32.crypmod.adok-4b4cf0cb7674e0ef6e4a7a9c5f8cc46056d7538932cc2f86ff2698abcf100b53.exe
                                Filesize

                                1.1MB

                                MD5

                                1556f2668d519e4401a82d6f4e490d83

                                SHA1

                                67a2348ac4d4e5d8e5721a2f294006f028b38df6

                                SHA256

                                4b4cf0cb7674e0ef6e4a7a9c5f8cc46056d7538932cc2f86ff2698abcf100b53

                                SHA512

                                173158ec12b929eacf6c80cf194f7fb8fde717da1c25878d12402bc1aa3d1e1226e81685a5d85197ac884579cd262ae9ae9a05fee77583b82c2925960ef8c865

                                Download Submit

                              • \??\c:\users\admin\desktop\00394\trojan-ransom.win32.crypren.afyz-355b8ed7476cf09a8c510e1442fa57ca1ade6c54a7306522a6e48f34e8905bda.exe
                                Filesize

                                66KB

                                MD5

                                0ecfdc386b4876c4fea7deddfc9649f4

                                SHA1

                                2a7805af4ce551bb7d6f03915b361e4413f125bc

                                SHA256

                                355b8ed7476cf09a8c510e1442fa57ca1ade6c54a7306522a6e48f34e8905bda

                                SHA512

                                f3c69bbd3e19949367a4cd88cb4b33576cb3d6879ef55a93bca742f6a2fec6eadcd13cb45420b5a0fe5cbeba216073bfa91c24c20741369c5cc34f4866417b14

                                Download Submit

                              • memory/224-3299-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/1560-6883-0x0000000000400000-0x0000000000498000-memory.dmp

                                Filesize

                                608KB

                                Download

                              • memory/1560-3839-0x0000000000400000-0x0000000000498000-memory.dmp

                                Filesize

                                608KB

                                Download

                              • memory/2112-46-0x000001C64B5C0000-0x000001C64B5C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2112-47-0x000001C64B5C0000-0x000001C64B5C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2112-53-0x000001C64B5C0000-0x000001C64B5C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2112-52-0x000001C64B5C0000-0x000001C64B5C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2112-56-0x000001C64B5C0000-0x000001C64B5C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2112-54-0x000001C64B5C0000-0x000001C64B5C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2112-55-0x000001C64B5C0000-0x000001C64B5C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2112-45-0x000001C64B5C0000-0x000001C64B5C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2112-57-0x000001C64B5C0000-0x000001C64B5C1000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/2192-6282-0x0000000000400000-0x0000000004DBA000-memory.dmp

                                Filesize

                                73.7MB

                                Download

                              • memory/2972-3160-0x0000000000400000-0x0000000000498000-memory.dmp

                                Filesize

                                608KB

                                Download

                              • memory/2972-3841-0x0000000000400000-0x0000000000498000-memory.dmp

                                Filesize

                                608KB

                                Download

                              • memory/3188-44-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3188-38-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3188-39-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3188-40-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3188-41-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3188-42-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3188-34-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3188-43-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3188-32-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3188-33-0x000002A74A830000-0x000002A74A831000-memory.dmp

                                Filesize

                                4KB

                                Download

                              • memory/3548-91-0x00000000056E0000-0x0000000005772000-memory.dmp

                                Filesize

                                584KB

                                Download

                              • memory/3548-3054-0x0000000005880000-0x00000000058AA000-memory.dmp

                                Filesize

                                168KB

                                Download

                              • memory/3548-90-0x0000000000CA0000-0x0000000000D42000-memory.dmp

                                Filesize

                                648KB

                                Download

                              • memory/3692-14226-0x0000000000400000-0x0000000000562000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/3692-6232-0x0000000000400000-0x0000000000562000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/3692-43694-0x0000000000400000-0x0000000000562000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/3692-37415-0x0000000000400000-0x0000000000562000-memory.dmp

                                Filesize

                                1.4MB

                                Download

                              • memory/4056-43830-0x0000000010000000-0x00000000122C7000-memory.dmp

                                Filesize

                                34.8MB

                                Download

                              • memory/4056-43824-0x0000000000400000-0x00000000022D1000-memory.dmp

                                Filesize

                                30.8MB

                                Download

                              • memory/4056-43957-0x0000000000400000-0x00000000022D1000-memory.dmp

                                Filesize

                                30.8MB

                                Download

                              • memory/4056-43892-0x0000000000400000-0x00000000022D1000-memory.dmp

                                Filesize

                                30.8MB

                                Download

                              • memory/4700-3157-0x0000000000400000-0x0000000000943000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/4700-11354-0x0000000000400000-0x0000000000943000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/4700-7685-0x0000000000400000-0x0000000000943000-memory.dmp

                                Filesize

                                5.3MB

                                Download

                              • memory/4784-74-0x000002127ABB0000-0x000002127ABCE000-memory.dmp

                                Filesize

                                120KB

                                Download

                              • memory/4784-72-0x000002127AC10000-0x000002127AC86000-memory.dmp

                                Filesize

                                472KB

                                Download

                              • memory/4784-61-0x000002127A680000-0x000002127A6A2000-memory.dmp

                                Filesize

                                136KB

                                Download

                              • memory/4784-71-0x000002127AB40000-0x000002127AB84000-memory.dmp

                                Filesize

                                272KB

                                Download

                              • memory/5200-2958-0x0000000000790000-0x000000000084E000-memory.dmp

                                Filesize

                                760KB

                                Download

                              • memory/5200-6647-0x0000000000790000-0x000000000084E000-memory.dmp

                                Filesize

                                760KB

                                Download

                              • memory/5596-43352-0x0000000000400000-0x0000000000411400-memory.dmp

                                Filesize

                                69KB

                                Download

                              • memory/5596-12188-0x0000000000400000-0x0000000000411400-memory.dmp

                                Filesize

                                69KB

                                Download

                              • memory/5596-2957-0x0000000000400000-0x0000000000411400-memory.dmp

                                Filesize

                                69KB

                                Download

                              • memory/5840-6917-0x00000000002B0000-0x000000000036E000-memory.dmp

                                Filesize

                                760KB

                                Download

                              • memory/6460-4908-0x0000000000F90000-0x000000000131A000-memory.dmp

                                Filesize

                                3.5MB

                                Download

                              • memory/6836-11712-0x0000000000400000-0x0000000000420000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/6836-7683-0x0000000000400000-0x0000000000420000-memory.dmp

                                Filesize

                                128KB

                                Download

                              • memory/6976-3426-0x0000000000400000-0x000000000045F000-memory.dmp

                                Filesize

                                380KB

                                Download

                              • memory/6976-3427-0x00000000020A0000-0x00000000020B7000-memory.dmp

                                Filesize

                                92KB

                                Download

                              • memory/8348-39629-0x0000000000400000-0x0000000000554000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/8348-39628-0x0000000000400000-0x0000000000554000-memory.dmp

                                Filesize

                                1.3MB

                                Download

                              • memory/8348-39613-0x0000000000400000-0x0000000000554000-memory.dmp

                                Filesize

                                1.3MB

                                Download