modiloader | 99b64aab9a8117d18911876cb4aa710b8b86a7b80c83829bd3d7ce1083d5753b

Analysis

max time kernel
84s
max time network
276s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RNSM00389.7z
Size

2.8MB
MD5

f5c991a3d250ecc71b370ae5281d6ff5
SHA1

bec5ccea4fd07f48e413d89fe4577f3d51375fab
SHA256

99b64aab9a8117d18911876cb4aa710b8b86a7b80c83829bd3d7ce1083d5753b
SHA512

e58f269befdd28fd3f4cd8b91c1f636fdbb49d2abf850e3fca9d7660807c8b4b26bb00b49c1fc7cea8f9c4c707610b222035a003cf812e93c9d62cb4745b5b1c
SSDEEP

49152:27pM4uXr78dzJ4kauQWaD2TJECeTzWQMMt4l98QykWZJIP0POZuvr7p:ypMPXr7sJta2Z2ZvbMMml98/J8022l

Score

10^/10

modiloader netwalker sodinokibi trickbot $2a$10$3aloagguasu5qrj8y1pyzeu93mmqzm6yvgd7yb83at6o21pmw2lcu $2a$10$qv..iaq6b9qv724w3myuferdo8uuvgvqgsa6edwdtrsj1a32xbdh.4402 51 banker discovery ransomware spyware stealer trojan

Malware Config

Extracted

Family

sodinokibi

Botnet

$2a$10$QV..IaQ6B9QV724W3myufeRDO8uuVgVqGSa6eDWdTrsJ1a32XBdh.

Campaign

4402

Decoy

employeesurveys.com

izzi360.com

centromarysalud.com

coding-machine.com

schutting-info.nl

ceid.info.tr

eglectonk.online

tulsawaterheaterinstallation.com

rumahminangberdaya.com

buroludo.nl

labobit.it

steampluscarpetandfloors.com

andersongilmour.co.uk

satyayoga.de

sotsioloogia.ee

oceanastudios.com

cactusthebrand.com

danielblum.info

cursoporcelanatoliquido.online

stefanpasch.me

Attributes

net
true
pid
$2a$10$QV..IaQ6B9QV724W3myufeRDO8uuVgVqGSa6eDWdTrsJ1a32XBdh.
prc
firefox

sql

outlook

ocomm

dbeng50

ocautoupds

mydesktopservice

sqbcoreservice

steam

thebat

isqlplussvc

oracle

onenote

mydesktopqos

tbirdconfig

visio

msaccess

excel

synctime

xfssvccon

thunderbird

wordpad

dbsnmp

powerpnt

infopath

mspub

agntsvc

winword

ocssd

encsvc
ransom_oneliner
Soon you may lose your files FOREVER Find: "readme-{EXT}-NOW.txt" in folders or on your desktop! YOU HAVE A FEW DAYS OR A FILE WILL BE LOST FOREVER !!!
ransom_template
Your files are locked due to a vulnerability in your system by "{EXT}" extension. You will not be able to decrypt the files yourself, in the worst case you can destroy the data irreversibly. The only way to unlock your data is to buy the decryption program. Go to the link written below to more details. If you cannot do this yourself, find a data recovery company in internet. They cannot help you unlock your data, because only we have decryption key, but will help you make a payment and provide you guarantees. ATTENTION! DATA RECOVERY AGENCIES WORK AND DURING THE CORONOVIRUS QUARANTINE, THEY WILL HELP YOU REMOTE. Also, I ask you to note, you have no long time, if you do not make payment soon, the price for the decryptor will double. So I recommend you dont waste time and move! Go to the page through the browser: http://decryptor.cc/{UID} If your site does not open, then download the "TOR Browser" (https://torproject.org/). If you cannot access the download page of the "TOR Browser", then download the VPN! After installing "TOR Browser", open it and follow the link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} After going to the site, enter the following code: {KEY}
sub
4402
svc
svc$

mepocs

memtas

backup

sql

veeam

vss

sophos

Extracted

Family

sodinokibi

Botnet

$2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu

Campaign

Decoy

woodleyacademy.org

bookspeopleplaces.com

despedidascostablanca.es

lapinvihreat.fi

drfoyle.com

carolinepenn.com

abuelos.com

groupe-frayssinet.fr

tecnojobsnet.com

deoudedorpskernnoordwijk.nl

siluet-decor.ru

smessier.com

calxplus.eu

julis-lsa.de

aminaboutique247.com

pier40forall.org

coding-machine.com

longislandelderlaw.com

expandet.dk

blogdecachorros.com

Attributes

net
true
pid
$2a$10$3aLOaggUASU5QrJ8Y1pYZeU93mMQzM6yVgD7yb83aT6O21pMW2lCu
prc
mysql
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
51
svc
backup

sql

svc$

mepocs

vss

memtas

sophos

veeam

Extracted

Family

modiloader

https://drive.google.com/u/0/uc?id=1BKqO_YkUPGwRKT_vzYTj7zx1s5xlp4SU&export=download

Extracted

Path

C:\Program Files (x86)\Microsoft\Edge\Application\D36D2C-Readme.txt

Family

netwalker

Ransom Note

Hi! Your files are encrypted. All encrypted files for this computer has extension: .d36d2c -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised. Rebooting/shutdown will cause you to lose files without the possibility of recovery. -- Our encryption algorithms are very strong and your files are very well protected, the only way to get your files back is to cooperate with us and get the decrypter program. Do not try to recover your files without a decrypter program, you may damage them and then they will be impossible to recover. For us this is just business and to prove to you our seriousness, we will decrypt you one file for free. Just open our website, upload the encrypted file and get the decrypted file for free. Additionally, you must know that your sensitive data has been stolen by our analyst experts and if you choose to no cooperate with us, you are exposing yourself to huge penalties with lawsuits and government if we both don't find an agreement. We have seen it before; cases with multi million costs in fines and lawsuits, not to mention the company reputation and loosing clients trust and the medias calling non-stop for answers. Come chat with us and you could be surprised on how fast we both can find an agreement without getting this incident public. -- Steps to get access on our website: 1.Download and install tor-browser: https://torproject.org/ 2.Open our website: pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion If the website is not available, open another one: rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion 3.Put your personal code in the input form: {code_d36d2c: j4RWPhbOwBMdJF1g9iZDdISHWipFTj1OTsMuJBQhffGKqeIU8O FwS3ljHGvWfPRcZ4B+v1BxL06eNVCtQsFK+3F1ANWwhGg+urP5 y+QsbdOOk54zhCUqPFYtMX/h1jozEnRiw2HmacUxL4lXWzCn0C OU6f71BijhGo7SbzZ3TPD2jGcQmjEKPGNSnDOdhTg4ADmB2AiD agB4CcyunkJZxXKJIQnMv4rAF0lgGmdXSC4mu2O42AjP158Ha5 rpV+QjES/jeDCCF974Upza6xEdzVZ5nla+pezxSQ==}

URLs

http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion

http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion

Extracted

Path

C:\Users\readme-7108z-NOW.txt

Ransom Note

Your files are locked due to a vulnerability in your system by "7108z" extension. You will not be able to decrypt the files yourself, in the worst case you can destroy the data irreversibly. The only way to unlock your data is to buy the decryption program. Go to the link written below to more details. If you cannot do this yourself, find a data recovery company in internet. They cannot help you unlock your data, because only we have decryption key, but will help you make a payment and provide you guarantees. ATTENTION! DATA RECOVERY AGENCIES WORK AND DURING THE CORONOVIRUS QUARANTINE, THEY WILL HELP YOU REMOTE. Also, I ask you to note, you have no long time, if you do not make payment soon, the price for the decryptor will double. So I recommend you dont waste time and move! Go to the page through the browser: http://decryptor.cc/ACFBC0BCBA746B0F If your site does not open, then download the "TOR Browser" (https://torproject.org/). If you cannot access the download page of the "TOR Browser", then download the VPN! After installing "TOR Browser", open it and follow the link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ACFBC0BCBA746B0F After going to the site, enter the following code: Zqghz1KzWFC+Abzz8rIjig6/pu4Kpx5oONxYpnvZp23uYq/zijyvLG8OXE9YEtW1 o9+/Cy43DF1Yjk43Sg2cyN+iweFC4H8OHuNbP0DnIk04SYtgBLlRy+wtAXV2dnPq 4m6dtC8ryrKXDG6Mu/M2smOcUWvcp3P/6L79vgcwDIUcMEddTQzypE7JlWPJ6QjV shXIFMcFpFZ+HRaLzewgFgKVEUER2NQL5CTAalD92PTkp7kPTuVMqOj7x2hLQLNN S2tHUsn+T9rMWX6zGKcHZQ2eMcUEppKdh1p00O9JxYMXF8TDM8gDm1c6t5eeAuDX 40b1XngKGIJnA7TCXj6d2terWZD8VU/h1CJpZZq11rZWyxkGU0ZPBWpcD2vOL+EE RU6b1OKrS7PljZpIiRtj3wSBO3ATrR1w8TOARUBv8zadJaEjSAs/Q4Fnk87lIvpi wNFhW5fdcOlky+OaWyW5aYHgdpRehBuHQgzFsWPyJWf+CyYx2/gC+WJiEsapGx2A fm43iN14ebiKiKEA9WXTFz1KQmwnotPJlsj8HLk/HeYp+faVty8b4JowKSFt4b0w LEEypZdCc3oXS2yOWu31eOzOMy7NkOanVK5HE/Xm2AjUTy0iuCfiozLxswnuFTjk iUaDPGtv8Wc0lgjoPNOwaQ3vaGnlBsGH/byBu7iOBc9uaOAwxXlOwJ70ZxdkTno0 6dVUb3dXf3v8i6gxbHmGBI4QceXLKDsWxy08F6fgPN4i7tCiGEWFsIbbhK+yguid FLItZTApYYzaAChNPas1mWqXM9rRQQKiNex0g53VNwDBPlknNvDw6hIP85xNRU/u nvaz1sB0i6vOwFoJEmBRC7FS+tEfZ1JIE2R4xqB+micF0XVEzvW7aar9jy8a3lFH s4c+Rssqe7FqQLgms2fCZ/3EoY198wf0pKgI8mxg5kOD50Pjnv1QkiAQvKBZVXDo 26g7iIMbqZ7r4e17aIWtau0SaEf8jAipoTHAlfa5lkOopGzjpYcd7iLpK7xEkj3v vPsdnbN/pDfyh6JvYCOBPaUrmZFFqJ2ERyJZ+14+pDKXFped571JenizZDZpRkN6 W9O7Q7NNWgr+ygZxLarhl9nnWU1o66RyilZi8zZ4KA7R+RhB0hg9dawWmYPQRjU8 lM6J2ph5LnMQo0UzGx1i8ZDQUfW9HqDv78z27tPpHOkDOdiP/lqp0hilOzoaKr+z gYsoFvIMlUDXXlzGdNI37mo/+jLjgu3tlERIBFo1/fw1CwwIy6ubEqgFHZko4+f9 T+NFFriAp7hREzwtg+0v9tTy/wEShMuUcF9ICWhwedD+1gqr79j7XVuPTbXBVcTd FW+fNMm4auAjA+zea6fHPxebk1FP+P4UqQNQn6XZaFkujjPR

URLs

http://decryptor.cc/ACFBC0BCBA746B0F

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ACFBC0BCBA746B0F

Extracted

Path

C:\Users\7sie9qr-readme.txt

Family

sodinokibi

Ransom Note

---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 7sie9qr. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ACFBC0BCBA746B0F 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.cc/ACFBC0BCBA746B0F Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: s4vjUYXFWa3vEBQH6xN6NwSxAwn04iPUMQwMYyUcW3/m3ZrkIaqFnS8qpbBxju1Z xIk48PzsaEAXzux4p/gsoZ6mZElrLP9JkPcFt3oGNa4lCy2DoJpqJCqBBzy8EHpt Ob7Hy0WCdJYAsve4tehQENqw74frAdQ/AqZ081cL2j0b757Mv/HGj+WZP2QYbmXW VtKUNuMBbF/mp7V88JTfdF+OBTK++QUruDjnD9twsCYJR2X4sZZVsqxQE7Q1is0r 0hpkKg4/vqApH1pyk+aRAFq0ldO6pw4/nF0R2uyXUW/w9XTrxmurExB4KHwwi/4k hQ9HAbEG+eYRDVT2m5F5MH4PQvzghe6GjJ9n/h0AG+/8NOUTDmXGiHOXWLEi/6uh jcDtw77A+zPlHvFwZcTpLX71qwhR5/c7eaHAfDePEiUyHbuduDyqf7PpIz9gxBbl Rl4INWUnvJfcxiWNv2kTMJX5mxr6h34OB0MUdR3BLuXWK0aVWkr3eYQsd9xxjzDf 2FsFCy9RpPBi9GY3H7rX4c6pg+i8byvyU6wRyoe3ur4EJKyVGF3DS2Ane6SmHvok po9+xgm6AG91yWGPumLm+y7QQDsyYj5vxnK7+jevpGYCL03RqbUVraBHdEcf2tK2 x63nByPck1pqKoJHJGG/8Njf6kxw5Ydg4rjwOCnjh5Lhl7pxzQ3jIK7DJLqBbgUO 6efTO+LfG+kHCCOU6VfD2inSiMmhky+Cr4XFFiLf4FWh+edwDvZSpJfQ2ZWsa2uU YPbOCyIgqUkTlZGbMgs01Ljpl2QuIb9Vsl8NAn3AMRx58992g39bRKv/YxkvS5ta aMHYqBcpXrExZZx3FV2rTKT4Tc1LXtDgxSYP5K44S/rryHcFZOx+WUlzYckMkXVY hdJvKHPSndnvSCxwEdu/99nPWBCb7wx1cArBwEChyhEJchw5YurD2lzUUvcabmzd yzSmDpqyT9U4wnwku/YTOEHXWHMe7k3wszZ/ecU5sUOZhUYIiEmL2iGer3WEzfbS U4xR8BYkRBRzzoIVyy4WS8wZpMZxMvetih/KU6sNLQjakBzoRoL5tbVAIqaivgXI Jo7NaTDu8d46ixYw26zsjITF9arnS1EiXNDJMNnzTEjE5RSrQFs2biNAKdhn68nX TFVXN9JM8eOdZmzx5CM4z9SzVxSrrTFiavhrL56EfBjGfC90Jyp2Ap8BasKiPrlS dbzjdk3AbngLRuMTDC6wojbh0qgi31308FI6j8x+WI5tpnOhStxhE0O/00KBE1ZW VF2Sbdr++B3h2e0Q81Ndmi/1jD8ZWGhJuY5gb/rxG10dbz6sJRyRjPUhJ0/sGY0M yniwEJD5/69qbDiG2IqQWuF/c+SNVjal02FO1nu9fAQYJST4 Extension name: 7sie9qr ----------------------------------------------------------------------------------------- !!! !!! !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/ACFBC0BCBA746B0F

http://decryptor.cc/ACFBC0BCBA746B0F

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modiloader family
modiloader
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
ransomware netwalker
Netwalker family
netwalker
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi
Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot
Trickbot family
trickbot

ModiLoader First Stage 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4712-152-0x00000000023D0000-0x000000000240A000-memory.dmp	modiloader_stage1
behavioral1/memory/4712-184-0x00000000023D0000-0x000000000240A000-memory.dmp	modiloader_stage1

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

Processes:

HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exeHEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exeHEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exeHEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exeTrojan-Ransom.Win32.Agent.aymj-cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exeTrojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exeTrojan-Ransom.Win32.Encoder.kci-7786483b897971c243102c6203d0f19608524cba52136ae5fa71803e74d55825.exeTrojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exeTrojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe

pid	process
4712	HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exe
2252	HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe
3612	HEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exe
2984	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
3368	Trojan-Ransom.Win32.Agent.aymj-cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
1048	Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe
4528	Trojan-Ransom.Win32.Encoder.kci-7786483b897971c243102c6203d0f19608524cba52136ae5fa71803e74d55825.exe
4540	Trojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exe
528	Trojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe

Loads dropped DLL 1 IoCs

Processes:

HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe

pid process

2252 HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

66 drive.google.com
67 drive.google.com
77 drive.google.com

pid	process
2252	HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe

flow	ioc
66	drive.google.com
67	drive.google.com
77	drive.google.com

Drops file in Program Files directory 64 IoCs

Processes:

HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-256.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-125.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-24_contrast-black.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_altform-unplated_contrast-high.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-unplated.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSmallTile.scale-150.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxManifest.xml	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TinyTile.scale-100_contrast-white.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-180.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLogoExtensions.targetsize-256.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionMedTile.scale-200.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-150.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsBadge.contrast-white_scale-200.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Silhouette.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\Wide310x150Logo.scale-100.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-125.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg4.jpg	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\jsaddins\onenote_strings.js	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter_dark.css	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\LayersControl\Aerial.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_altform-lightunplated.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Audio\Skype_Error.m4a	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\logo.scale-200_contrast-white.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-150.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\Crashpad\metadata	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-unplated.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-125.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-black_scale-100.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-80_altform-unplated.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Generic.xaml	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.scale-200.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsBadge.contrast-black_scale-200.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\FPA_f33\FA000000033	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Fonts\PaintA.ttf	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-150.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-64.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\resources\strings\LocalizedStrings_it.json	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256_altform-lightunplated.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-20.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseHostPage.html	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square150x150Logo.scale-125.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-24.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.scale-100.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteWideTile.scale-100.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-16.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyCalendarSearch.scale-400.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-black_scale-100.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_contrast-white.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymsl.ttf	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-100_contrast-black.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WorldClockWideTile.contrast-white_scale-100.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-48.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-36_contrast-black.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-2437139445-1151884604-3026847218-1000-MergedResources-0.pri	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\microsoft.system.package.metadata\resources.5295ec3d.pri	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailWideTile.scale-150.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxBadge.scale-100.png	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Edge.dat.LOG1	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	process	target process
3384	4712	WerFault.exe	HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Trojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exeHEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exeHEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exeHEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exeHEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exeTrojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exeTrojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exetaskmgr.exepowershell.exe

pid	process
3868	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
3976	powershell.exe
3976	powershell.exe
2324	taskmgr.exe
2324	taskmgr.exe
3976	powershell.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

2324 taskmgr.exe

pid	process
2324	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

7zFM.exetaskmgr.exetaskmgr.exepowershell.exeHEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe

description	pid	process
Token: SeRestorePrivilege	1416	7zFM.exe
Token: 35	1416	7zFM.exe
Token: SeSecurityPrivilege	1416	7zFM.exe
Token: SeDebugPrivilege	3868	taskmgr.exe
Token: SeSystemProfilePrivilege	3868	taskmgr.exe
Token: SeCreateGlobalPrivilege	3868	taskmgr.exe
Token: SeDebugPrivilege	2324	taskmgr.exe
Token: SeSystemProfilePrivilege	2324	taskmgr.exe
Token: SeCreateGlobalPrivilege	2324	taskmgr.exe
Token: 33	3868	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3868	taskmgr.exe
Token: SeDebugPrivilege	3976	powershell.exe
Token: SeDebugPrivilege	2984	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
Token: SeImpersonatePrivilege	2984	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

7zFM.exetaskmgr.exetaskmgr.exe

pid	process
1416	7zFM.exe
1416	7zFM.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exetaskmgr.exe

pid	process
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
3868	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe
2324	taskmgr.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

taskmgr.exepowershell.execmd.exeTrojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe

description	pid	process	target process
PID 3868 wrote to memory of 2324	3868	taskmgr.exe	taskmgr.exe
PID 3868 wrote to memory of 2324	3868	taskmgr.exe	taskmgr.exe
PID 3976 wrote to memory of 4524	3976	powershell.exe	cmd.exe
PID 3976 wrote to memory of 4524	3976	powershell.exe	cmd.exe
PID 4524 wrote to memory of 4712	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exe
PID 4524 wrote to memory of 4712	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exe
PID 4524 wrote to memory of 4712	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exe
PID 4524 wrote to memory of 2252	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe
PID 4524 wrote to memory of 2252	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe
PID 4524 wrote to memory of 2252	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe
PID 4524 wrote to memory of 3612	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exe
PID 4524 wrote to memory of 3612	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exe
PID 4524 wrote to memory of 3612	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exe
PID 4524 wrote to memory of 2984	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
PID 4524 wrote to memory of 2984	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
PID 4524 wrote to memory of 2984	4524	cmd.exe	HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
PID 4524 wrote to memory of 3368	4524	cmd.exe	Trojan-Ransom.Win32.Agent.aymj-cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
PID 4524 wrote to memory of 3368	4524	cmd.exe	Trojan-Ransom.Win32.Agent.aymj-cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
PID 4524 wrote to memory of 1048	4524	cmd.exe	Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe
PID 4524 wrote to memory of 1048	4524	cmd.exe	Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe
PID 4524 wrote to memory of 1048	4524	cmd.exe	Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe
PID 1048 wrote to memory of 4948	1048	Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe	cmd.exe
PID 1048 wrote to memory of 4948	1048	Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe	cmd.exe
PID 4524 wrote to memory of 4528	4524	cmd.exe	Trojan-Ransom.Win32.Encoder.kci-7786483b897971c243102c6203d0f19608524cba52136ae5fa71803e74d55825.exe
PID 4524 wrote to memory of 4528	4524	cmd.exe	Trojan-Ransom.Win32.Encoder.kci-7786483b897971c243102c6203d0f19608524cba52136ae5fa71803e74d55825.exe
PID 4524 wrote to memory of 4540	4524	cmd.exe	Trojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exe
PID 4524 wrote to memory of 4540	4524	cmd.exe	Trojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exe
PID 4524 wrote to memory of 4540	4524	cmd.exe	Trojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exe
PID 4524 wrote to memory of 528	4524	cmd.exe	Trojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe
PID 4524 wrote to memory of 528	4524	cmd.exe	Trojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe
PID 4524 wrote to memory of 528	4524	cmd.exe	Trojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00389.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1416

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Users\Admin\Desktop\00389\HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exe
    HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1948
      4⤵
      Program crash
      PID:3384
- - C:\Users\Admin\Desktop\00389\HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe
    HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2252
  - - C:\Users\Admin\AppData\Local\Temp\y_installer.exe
      C:\Users\Admin\AppData\Local\Temp\y_installer.exe --partner 351634 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\y_installer.exe
        
        C:\Users\Admin\AppData\Local\Temp\y_installer.exe --stat dwnldr/p=351634/fail=1
        5⤵
        
        PID:9980
- - C:\Users\Admin\Desktop\00389\HEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exe
    HEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3612
  - - C:\Windows\system32\wermgr.exe
      C:\Windows\system32\wermgr.exe
      4⤵
      PID:1736
- - C:\Users\Admin\Desktop\00389\HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
    HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2984
- - C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Agent.aymj-cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
    Trojan-Ransom.Win32.Agent.aymj-cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe
    3⤵
    - Executes dropped EXE
    PID:3368
- - C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe
    Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\D32A.tmp\D33A.tmp\D33B.bat C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe"
      4⤵
      PID:4948
- - C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Encoder.kci-7786483b897971c243102c6203d0f19608524cba52136ae5fa71803e74d55825.exe
    Trojan-Ransom.Win32.Encoder.kci-7786483b897971c243102c6203d0f19608524cba52136ae5fa71803e74d55825.exe
    3⤵
    - Executes dropped EXE
    PID:4528
- - C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exe
    Trojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      4⤵
      PID:6288
- - C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe
    Trojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      4⤵
      PID:5296

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3332

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\D36D2C-Readme.txt
1⤵
PID:9648

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:11096

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-7108z-NOW.txt
1⤵
PID:5400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:10144

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\7sie9qr-readme.txt
1⤵
PID:6460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\D36D2C-Readme.txt

Filesize
2KB

MD5
238db96f62495dbc1061c6dd9147cf2a

SHA1
8b00dfdff59d840a0cdd5a89429b9397d2fc0990

SHA256
504a816842ba304871c922c8b047da9ef73883362437fe65dfd53dfbc589aa99

SHA512
c1b370de5bdacf167b74cb517dad100aa24717dbec13934cfc2d7fbe0331be2f0ec5acfe7bc4d1c5a7447ce6ebbd1949493f6446d8c45fd8c86c998bf3a31b1f

Download Submit
C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml

Filesize
3.3MB

MD5
e3afd47d92a2526d0306194c0b3a105a

SHA1
3294f5c3dcb71263815c8da7449006124fffe1bc

SHA256
3a67fe3473714d6012ef438daaa35cc0ecedc45b2dee83aa8f7e1812cfa3279e

SHA512
f41d3e12ec57b7a6c2fff14c878d17369c19ce8caf114020dead2444e68f36d15f4b935330b271ecaaa4fb6d1e788b00eeb5a96b27f7a113c5411c34adae1589

Download Submit
C:\Users\7sie9qr-readme.txt

Filesize
6KB

MD5
e817cf305e5cbaba586f6d89cfd64ed5

SHA1
1a26f1f008f4db3d6f09ac4a2ba40945e1f27e2c

SHA256
22bcc82eb7ff9a2716bbe69bc5f8f58a3181a7f06267f055e577048332351edf

SHA512
a27a0890deeedc6647ef49977b11cd8724c77338019a549945723eb8376f5268cad5857f12e58d98c635ff1e41730e2949659709fcab9242fdc4676772cb56cf

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M6JHG9EK\YandexPackSetup[1].exe

Filesize
10.1MB

MD5
e6d10b61b551b826819f52ac1dd1ea14

SHA1
be2cdcba51f080764858ca7d8567710f2a692473

SHA256
50d208224541ab66617323d8d791c06970a828eeb15b214965a5d88f6a093d41

SHA512
0d5d98424bab24ccced9b73d5ed58851d320e0540963a3ccc14da6d6231b2413136fa11458dc2155bb5844af9e28f3a053f8b7f709a806a4070c5ff737fb0ac8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
a26df49623eff12a70a93f649776dab7

SHA1
efb53bd0df3ac34bd119adf8788127ad57e53803

SHA256
4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

SHA512
e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

Download Submit
C:\Users\Admin\AppData\Local\Temp\D32A.tmp\D33A.tmp\D33B.bat

Filesize
51B

MD5
4dfbbfc8b9baf134e1f5a5f41755e6c6

SHA1
7d5742bd99cfcf07e382c1272ad3cff2dd025e64

SHA256
5a7f41cc4a16d6280dc346da13fd99a1b90f1a7b7c96f5b7c1c29b5adf9c9db8

SHA512
09796c075f0f1f4fa086a4ff8f1c8a15eded8392cfb506e4d5cc226d50fb483da81a63363160eaa4ea4810fb080201934c6ebb19ac1f9ed46894c64bbc640ea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hhgdxgcm.34z.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqC56F.tmp\INetC.dll

Filesize
24KB

MD5
640bff73a5f8e37b202d911e4749b2e9

SHA1
9588dd7561ab7de3bca392b084bec91f3521c879

SHA256
c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502

SHA512
39c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqC56F.tmp\System.dll

Filesize
16KB

MD5
c8ffec7d9f2410dcbe25fe6744c06aad

SHA1
1d868cd6f06b4946d3f14b043733624ff413486f

SHA256
50138c04dc8b09908d68abc43e6eb3ab81e25cbf4693d893189e51848424449f

SHA512
4944c84894a26fee2dd926bf33fdf4523462a32c430cf1f76a0ce2567a47f985c79a2b97ceed92a04edab7b5678bfc50b4af89e0f2dded3b53b269f89e6b734b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsqC56F.tmp\nsDialogs.dll

Filesize
11KB

MD5
da979fedc022c3d99289f2802ef9fe3b

SHA1
2080ceb9ae2c06ab32332b3e236b0a01616e4bba

SHA256
d6d8f216f081f6c34ec3904ef635d1ed5ca9f5e3ec2e786295d84bc6997ddcaa

SHA512
bd586d8a3b07052e84a4d8201945cf5906ee948a34806713543acd02191b559eb5c7910d0aff3ceab5d3b61bdf8741c749aea49743025dbaed5f4c0849c80be6

Download Submit
C:\Users\Admin\AppData\Local\Temp\y_installer.exe

Filesize
203KB

MD5
b9314504e592d42cb36534415a62b3af

SHA1
059d2776f68bcc4d074619a3614a163d37df8b62

SHA256
c60c3a7d20b575fdeeb723e12a11c2602e73329dc413fc6d88f72e6f87e38b49

SHA512
e50adb690e2f6767001031e83f40cc067c9351d466051e45a40a9e7ff49049e35609f1e70dd7bb4a4721a112479f79090decca6896deac2680e7d107e3355dae

Download Submit
C:\Users\Admin\Desktop\00389\HEUR-Trojan-Ransom.Win32.Blocker.gen-8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a.exe

Filesize
918KB

MD5
922af74d1c297ab5078bef3cf8c7cbc6

SHA1
5f9b595f5776bd675b88cad0f797cf01950055e3

SHA256
8c777c0ffb0097d517ed08dee3c306d7fddc7687bcb0349d5eed0a6b5c82f93a

SHA512
d37d82c1cd4e77c43b51ecb283773d82c6aaae7c596242f9372fa834f912c8f5f392f549245ac4f028cf8a7aa588b642900252e3270456b27438ce4b827baf82

Download Submit
C:\Users\Admin\Desktop\00389\HEUR-Trojan-Ransom.Win32.Encoder.gen-06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c.exe

Filesize
201KB

MD5
d24598f9562dd1c60d11ece8f0f470f0

SHA1
af46f6d75844d28738725fae2526d36cf4459022

SHA256
06e4a62ef0d088bf564e7daa6bdc89093c5931ac313270380e41ea20fe9ae74c

SHA512
10d3870408f828858766590b1db8588ba7f1f40acace351cbe773d7ab4dd84ff427a87e604fcef4418890a401e0ae6591f421f4ee9f0902a3cae110b7ba5c01c

Download Submit
C:\Users\Admin\Desktop\00389\HEUR-Trojan-Ransom.Win32.Gen.gen-d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83.exe

Filesize
531KB

MD5
aef03ddd3134451e1efe137fb22e3a0c

SHA1
09d7afd49f836d4de22b96792de47ff50abb7ead

SHA256
d5efc42f10137cb465bcc098f0a3f5440a86ae59059526c6fb4bfce46bf1be83

SHA512
1fc053f05d666242a87bfd6c7ce29c4b5679bc7bc72ca1363e646c2ccb2440d57144e511ecfc308992056f9c40e5fc53b15d6d0e5e4c11691595065a9c827b15

Download Submit
C:\Users\Admin\Desktop\00389\HEUR-Trojan-Ransom.Win32.Mailto.vho-4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60.exe

Filesize
65KB

MD5
eaef25ab1f59492ffc735a386294b69f

SHA1
76cc795c39cc19465c24825dc5ebafd7f944ea7e

SHA256
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60

SHA512
a812186ff05baa0c194abc2b4becc145f312b885068773f994658ecac2bfd8e1c85acdfe3774728541ed966f46a872d19fee17a53cc07f3f8e2e94be0cdef1c4

Download Submit
C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Agent.aymj-cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c.exe

Filesize
2.4MB

MD5
a239735cddd49236ae3562d43d83a8e4

SHA1
35bad8d66c79af9dabdcdd8dcebfc0440efc42a1

SHA256
cd49c58defedd1594ad6c93c1019385e171e10bede1995eecd74540debfd942c

SHA512
34bbfc20d82c4227f9e745f0f7cdb5ce68c684a4a84cde0340fa82601f9340fcb7d21c6060564be8580dcba8c3d1b5a16b28ab6964508e0d1ab994b59a818fef

Download Submit
C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Encoder.bpt-6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90.exe

Filesize
88KB

MD5
fb2ebc4783c029e46ee5579fd3ec7fa7

SHA1
ca39c907767c4d85e2814e261a70bf0a2766c6dc

SHA256
6ddadf28aa0fff0c1535058c75f200ddee7abae44c7831d028b04eb533e59c90

SHA512
daaa73cc305e843d2562114fa0d1e4fb3be650c8ce355531a47713f2f2982a9def0bab7cf0e162cdc0c78298c0be20fd3d18557796f521a88618d651c6ec806a

Download Submit
C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Encoder.kci-7786483b897971c243102c6203d0f19608524cba52136ae5fa71803e74d55825.exe

Filesize
2.6MB

MD5
8f616ddebbce71e29951a6e9472f2ea6

SHA1
0394adee22cc087a07b5f661eeb008fb4083163a

SHA256
7786483b897971c243102c6203d0f19608524cba52136ae5fa71803e74d55825

SHA512
474ab5d0d7d80b0a546e3131b42cb5f8f3d00d54b2d5afbff825e6f0374793c015db44e31b9ec28c8a125f8ab4c9407879bac61051c4dfd195eabcc9f58e9240

Download Submit
C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Sodin.aaq-9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879.exe

Filesize
166KB

MD5
63ae6ca6853552716571555546833d99

SHA1
09e37e98a74ec8edb36b22a4eb51dbed4390544a

SHA256
9d3a482d9441876096e0cee429fedf7b9f7e1c6a50b3e4b2009884019627d879

SHA512
087baf5fbf764f480f384cbdee878d3dfb8b3880f378b4597d5e292f392341e5da196ee2232a441c6268b7760afffdde293f35f536ee55cff4992b4b45238f86

Download Submit
C:\Users\Admin\Desktop\00389\Trojan-Ransom.Win32.Sodin.zx-735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c.exe

Filesize
324KB

MD5
20defcd42cabf5da27a21dd342e58068

SHA1
408cfabc99c350ad28def5475cfff5dc2de02543

SHA256
735ff072077023765e445b284f072946ffad2e36fa8aba9f1b8f93fef885352c

SHA512
8a6a2f462b9e5ecccae13ecf176c8d2ec93e1c535f3541aa9a39151ea7874e730bdb627b422fbe2ba1c51c98c9c5a2b35da79433fbe9105038836ca33f31814d

Download Submit
C:\Users\Admin\LICENSE.TXT

Filesize
266B

MD5
a00d54825dba30bea54e895a6f9c9e18

SHA1
d5b3c3ac1a047504d07b3e04da759f1926015b44

SHA256
604509a6847cf0f1179fc311dda45fc3ad919b3a3243443894e95fb41960ef97

SHA512
65d26abe168e1309ae715d067885d4db2cb587ca7fc856a4283081b58df2d343d02d5df454b08e1749dc3bd2d04a38843ddbeb1021130bf963c3f5e2bb95fc97

Download Submit
C:\Users\readme-7108z-NOW.txt

Filesize
5KB

MD5
31a36b444d734d53999e3772d72b3b17

SHA1
f79e05a6ccb7ae2c42d455d4cecaf861cd2b0b2a

SHA256
451271592e46ae0fe3cc35d79431e850753aca773cd830c8e9db084d8c89f8d0

SHA512
78c8fcdd991dff09c4e4ac192c16ad75d711ede6554595e2fea4536b3bb0bad0dd05c884033b26e08a8a5085b73a89ebe9568cfc94c73a50a9729b48d7ca5203

Download Submit
C:\Windows\System32\CatRoot2\dberr.txt

Filesize
38KB

MD5
cc42bc233bfe4f7e350bc18111721b1a

SHA1
503dc08f54cde2d27f79fd39f804bda27a44a5ff

SHA256
b2df4c9c7db4fe6bafebf0b9a097c929b1ea23bf6f29986cf5bc7f84fe2fb23a

SHA512
742123525613dfeee189305158887171edabc892a34a55dcd511364f905eafbc0697e56f13d699ebfacbf3397c5bf8cf153751d3741f7d2f9e289bdd161a22fc

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
37KB

MD5
5aa1123a05d4f019b8f6e8697bffdd64

SHA1
faf4c3b857200b350efcc5d9f2c7282a64c13767

SHA256
acfdcf6594f8decad0cb3cd4425a728eed34d178e4f663aba1511d31570ab297

SHA512
6b174237f28160e9a5fc99db5fb102db66abcef5cd9e543fa0316be7b5a178e1c70fc67b4f11d53d1d0236b53615d28560dce77d0ab4e223a6b57c013b4a7c56

Download Submit
\??\c:\D36D2C-Readme.txt

Filesize
2KB

MD5
684d64e3b14aecdd7d1ba2bb54f68172

SHA1
b69b74aa1d9d9c3f2fa37ba3f0dbf2b61f940f6f

SHA256
d3a472fc2f080239d8fb02534afdd544928a61635bdbfc02f53c090552e53269

SHA512
259828fa3ea1ce239541913c6e456b8605d2f0aaed776da2ffe56b31b57131c4dc7bec3cf6b48812e086d10dd6299f5eeb5858f3496fdb01ee0ea61f1eb96569

Download Submit
\??\c:\program files\DisableApprove.xsl.d36d2c

Filesize
2.0MB

MD5
2fcb5ec9386d2408d8ad6c10c7dca0dc

SHA1
a718a9fcc7abcd0f513f23680cf610ce204868c3

SHA256
56e6afc49880eb0d7e7d0c5111b40d4e599cb6d387047aebf6e134d83c6466cd

SHA512
7d4d89135d11fc6fbcda11b8edcedd2dd405366173f1c7e369744d8b06ed352cf6e8a5089b11a201e5fe56dd1a390f8b7829b77d785d045f06c926e64a4dc8f2

Download Submit
\??\c:\program files\FindInitialize.mov.d36d2c

Filesize
748KB

MD5
2acead58bdbef91c2f65581e6e7c42d9

SHA1
e58ead31dee998f2033bcc601bd12d2a3fde9225

SHA256
535fa7bd962e18e81383a17ec2eb66a87d214f12b86cb5d5dacd81f9fa0a7d1d

SHA512
4ed147588c7dfe48c65f75576b73f40a85ec93a9eb3c2abab2affcbf8e32738eecefb34924086cdb3429e5dc82d4ce86ac9da5ac2a1a2e7443954c79ea5eb1b6

Download Submit
\??\c:\program files\FormatTest.vsw.d36d2c

Filesize
1.4MB

MD5
0dd43d505ed77984fe00dd40c00828e9

SHA1
17ff801c4a01d051d3eac2b5c6ccf559199d390b

SHA256
fe967c340328d87d09224096e736a75f3152d0471ac0b5900801662a625c8758

SHA512
c7e969b858abaca7eab82878ed82296385909fb37af4200541c8fac2b4bd4bf7739bafb161d448900a2c228f1d3e9b0a4a467997eb694df52b442ef8c63d1669

Download Submit
\??\c:\program files\ProtectRename.js.d36d2c

Filesize
1.2MB

MD5
09e36ad84ff75ea6b124a0c61c34ea33

SHA1
457cba33da8ed730adbdbcb54a14716c7cf15c0a

SHA256
0f03d73c0c68fa9290d7d47dde7e4934b80efbd15124802aa74bf63af7f47b56

SHA512
7251ceb39c790cda5c1787bae575c189a5b902d288f4c8b5f746f36d62ccb44f8c3134766839df3c7a226b07e7026d84822cd43ef53cceb40db248fd917c8fd1

Download Submit
\??\c:\program files\RepairCompare.raw.d36d2c

Filesize
1.1MB

MD5
21c5b36fc5a514354c01c1c2acfdec9b

SHA1
cb72457cba36f648ab9a67980bf90ff61a3efaca

SHA256
a92bcb53ebb554d89d315d4f03ee13939278a3a7a93335e1e64311e569ae9d0b

SHA512
b327e17446f135efe9e12d72681f461049834692255e1c133907e13d42fc851beb091f355673c6ae02bb266875c01ac1902235cd1261dbe3ffc06a9ffb9fedae

Download Submit
\??\c:\program files\RestartOpen.tmp.d36d2c

Filesize
978KB

MD5
6bb3847d4a1153f4c8d72062ff8ad666

SHA1
ea998e41862f4f7e1602b0a6b8e04a9bb6121328

SHA256
bd142e078ed7e72dc6e5f47f46fedd2290263eeb5a39b9bb1fc753395eb7799b

SHA512
6ad9fa551601b2f40eb7dbf12442e0730db4cfb48411c5ff67047903e84df3ee611959f111dc5871b989b62e3b96e2c25d06366391046beb571f8181bdf83ba1

Download Submit
\??\c:\program files\ResumeJoin.mov.d36d2c

Filesize
1.9MB

MD5
d4dddd13f95cfb98d00c3f4eb74297c4

SHA1
150e351c6073e76624051797c6d21f91cd18acee

SHA256
f971757322fcdd010bf1d2c4f1e31f81560c7488c1e6aa64c4c1eb4577c1a550

SHA512
0d20e61da1ad75a03a0c9ced23910f6711960198d044832b0d218df07673d29ca860c957f6b807052d1cd58644597ce12ebf588caf75de719fc066fe6dcf5276

Download Submit
\??\c:\program files\SyncRename.mpeg3.d36d2c

Filesize
1.5MB

MD5
94db00c395faeb58854f9f1d5e5bbd32

SHA1
45ee2861f9d7d003d18da951b64fb80584f8d14e

SHA256
bdca2c0b0429da17bfd669b216acb252dfcec440c9f6aa98047b92a39c8841ac

SHA512
f959a8354281d9185e2b228ffc5a205452cb0a493b0206ed936ad1f0e46b3ca0d4b8377fd27b044a09e2934a5bf301e89e7fdd3245889055a9c35aa8255fdc66

Download Submit
\??\c:\program files\TraceRevoke.vsdm.d36d2c

Filesize
1.6MB

MD5
c6f1de30da49712ca080b2435f82c1ba

SHA1
b11f9bb939b4e5e2599c5ca8f8e190d2a37bc379

SHA256
d7327f8638970a3d42f56837b09156352b99821726327a9aca839b8118fdee59

SHA512
51bc3c08cb49380670bad37bce076f1c74dfb5f6af35afbd2d10ef33da358bb29028aa76995d12128de589342cc3e7da3a297e27b30b57dfe54f2c0eb0481f92

Download Submit
\??\c:\vcredist2010_x64.log-MSI_vc_red.msi.txt.d36d2c

Filesize
381KB

MD5
2a4f1148d1c55ca816c1cb342a756841

SHA1
21c708fe31c9adfaa1590435a26e45222ccc79b0

SHA256
99192e9c25321655844f39e4c38a068f492d844396063b083672cc4d95c25151

SHA512
cfd8fcf6109925df725bb6cbba20c376834c24d01be392454b745db8af5fc337878a01c2061d9b66ae8754fa379caf64c1dade2ef97855b5d4c536173f862d3a

Download Submit
\??\c:\vcredist2010_x64.log.html.d36d2c

Filesize
87KB

MD5
3f2ce15d65090e6408c8960b4cb07e47

SHA1
7afa54e31da9cb367cc4645c4ed9d551738f24c0

SHA256
4faf2b957079447d3b63887cc13fc7eb9fc920ad5a96504c7154cff72ddb0ebf

SHA512
84b9b8bcf68886dabcb2815c2e6b6671a7c0fd3019f693815fc79a2b67f3ddbba69c6eb7eadd49d9efd5f650dcd1efa8db2a3075f0218cb48f73e767ce7fbb6b

Download Submit
\??\c:\vcredist2010_x86.log-MSI_vc_red.msi.txt.d36d2c

Filesize
396KB

MD5
43937c4439a78eba9daeca1db27a47e4

SHA1
de556e9307db164be3ace917c1f126734278a0ee

SHA256
7c19d5b6a042b1097ceba3bc641ef52440bcfd67dfc3be4541e456d2c3f81e8f

SHA512
9d1147137f749441a5017a20328e403485dd520d8de89e227573066c358772462e0196d7dc1d35669549d92288e73e19d1d228b079ef9fcceb52894e9bcb891e

Download Submit
\??\c:\vcredist2010_x86.log.html.d36d2c

Filesize
81KB

MD5
9636dcf338fab73b48f70e192fc0e3d2

SHA1
93cd2502f3d08a55d17f5e46e6da37bcbc820cc3

SHA256
59be46f177b00b613ae02424c04ad004d4377ecf3828a91cef25eab0c3329c63

SHA512
d8cf1b31c7d4350336d3a59d09c48236260d1162feecb1108c56ab1172c017fd479b678ce715e01083c855580d664021265c2ebaa5504bcfdf23afd623f90d52

Download Submit
\??\c:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log.d36d2c

Filesize
168KB

MD5
3de1421026e3d6ff73e6d13ccd068206

SHA1
23cf4a7b82539fbdac0f835fed5290bfdfb72197

SHA256
95a73b18b176b933e0896fa94cb305fc2f7391d097a5d27a0135e59d13775bf2

SHA512
5925bff24853ba0427619c9c76d7cd87ee21c7a777bf9746f6c6147cdb7960284c3ba30c22ab253ed78bfa4c7d7f8187dc4393e2ef3b75f17aaf02da28f737e1

Download Submit
\??\c:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log.d36d2c

Filesize
195KB

MD5
d01b03362f5725ac1c3b9986d5ade94b

SHA1
4c1cbc67bec244b360c8360449e045b8adb24496

SHA256
5295e50ac534823beb89efc05bb351c91ab45bbb3ba9130e2ff5ec8a4a6287f8

SHA512
ad4f3faa2a589f18ea904dbe1901571cacbfb71f30ff1c623d73765dfa19afe87571447eb713041f0be362b0511f66e1d09b109aa4fc922034c0eab8ab8ee188

Download Submit
\??\c:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log.d36d2c

Filesize
171KB

MD5
bdd601982aad7f8617e38c28243e2bd5

SHA1
30a442035a8d7a575d9850e81379932c1357decc

SHA256
d82cae5a9bd9dee9fbc9a9e154bbcc7b0e47f0997a3a8cf0d60d82baee74d837

SHA512
6fd7f486adfc30e13f0cb09e73499e47470d6e3deb5ff6b71905735de61d55d2fe2dc6afb90678071df6fb40238fea42d1dd763d3347f5997c443e9a057cd05e

Download Submit
\??\c:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log.d36d2c

Filesize
208KB

MD5
98f2d5c09e78061b8c96d9206241a3da

SHA1
667e66e2ab771a27fe4a81b5d0534fc1516cc0f2

SHA256
3307cbf92fd224502a287197d43a284380eab4a33ad6d9c9bd3d3f38c71edfa0

SHA512
67e8c46222bd517111a74cc64a35c4728c91526487bc22726385896ca32b0791af483b27fdec782427cebb473a117182d835e46d2d3b8cc42d2081201f48b544

Download Submit
\??\c:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log.d36d2c

Filesize
170KB

MD5
9edb67879c27dae3ebf6a9402afec615

SHA1
91dfb6baa2fd93bea09dc4145fd0abc36da7f3b3

SHA256
69a01214e92d36e152019a7fc6e5a3de85f8e381d8834f121ff67cb18c449823

SHA512
e0473dc543798cf5722e9ab1c1ddd9bf22ffb6569fd62737cba70b53b60d1afbe1f1d0045d1a08d1c5bfeceb480938c46eead6509328c14a3bee80cd8659208d

Download Submit
\??\c:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log.d36d2c

Filesize
191KB

MD5
64a376de2945238b7402353207592ae9

SHA1
a267f3ca32d40d3b1d8d20cc09753cb20462b6ad

SHA256
441db97b43464e71c957d68813863ab1f740cf0cb1331ade7e310dca1ae71d38

SHA512
8faf6aba5f381e2e134edd0e91c13236cf18899e778602660af8d40476dc8eed8a1da67ba76e773dcb24f792ef49924833ab5f5a62289d252dd6b1d3cb51824f

Download Submit
\??\c:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log.d36d2c

Filesize
170KB

MD5
bac40e202a8b567b5ea6e06afeff2c5b

SHA1
39197d25fa797430e883a0a8e73192421ae9a98f

SHA256
175b2a79bf7cac59898a5911f988f2df468407416bfaefeb4e2cd696a81a1ca8

SHA512
08b2b0fb88c838e53f3385b29d57a59493efcde6f03a312e1aad561e3b9c60a89ecade1c13903c2fb55443510d672d1dcbeb9397db14d92557c3b15c4004b6fb

Download Submit
\??\c:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log.d36d2c

Filesize
199KB

MD5
9fbc550224d4798a2deb39fdc175c5c1

SHA1
27ac34e214474edb344535bc541bd398abd6856d

SHA256
9535a2157ed7d820fac11be66b30458f50cee792783f81e0d261a5866d668c81

SHA512
87fe76401bcba09331289a3c165a37f4d173bd1436f4f5d3f463eec5423164474936d3f7e86f8b3f962debddb8419db37374c1dc2f48db3324a6fd67d22da56b

Download Submit
\??\c:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log.d36d2c

Filesize
123KB

MD5
45b3637c608a8ced2ab84b5a6c00bfce

SHA1
1fc58aed8a80176a94b4363cea538cbd591d0edb

SHA256
a1d386b93ac8c245aeca814346f9f8ec17402132da450522a10573e7772b6f1e

SHA512
d9c936b099b5e38c27dc0bc9ad0db7fd2f56a76baa6b89c0a87cc7a3977e12681cabe2f45e8925e5b4f0cc7cab9a724a274eb40492c884bbd3c46ecae329f0bc

Download Submit
\??\c:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log.d36d2c

Filesize
130KB

MD5
72db6f35ceb25fcaee0bce7d71cc2082

SHA1
f9305550df2e05232cf0af0f92258e57524c09c4

SHA256
eadd068e4fbb58c0090886d33187e791c9e4f38c64af33f0ddf5e19b782f7824

SHA512
5a2941852cc3b653d1a056f3640c553aa4e60e23eb0d6e44c6846948bb2218a0f71d46aa7517aa3003eadec281352943869f46f416d36daea12e90ed3c03c581

Download Submit
\??\c:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log.d36d2c

Filesize
123KB

MD5
6d34454cf2f5d0a0881d7a5389624264

SHA1
f59718e45f2ab2585dc6c285dbdb960f0ae07676

SHA256
97334efe68a8098f5b494db27f4ff3e5d5ac08120deb2d17204d78bc5bfc11cd

SHA512
1ddd94912f5cfc7b3338f6731d5a20371d87bb54b7de93c623ae7434ade561c3c7e48dda5819ae148f234dfc3bdd634ae941fb6b58c5fa8278600fba6bba2aeb

Download Submit
\??\c:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log.d36d2c

Filesize
135KB

MD5
0131c33c933cc84ac1c238a47f85bdee

SHA1
d0e540b5b42b104fb09f693150cc05b8cdd9dda6

SHA256
229dd2c4945486e8ecb8a6df976027060aa247007ec8693c716f272e2883fd12

SHA512
e3942b75a4413f3e9d1512eea41f3b1bf90b4bb33be6d4fd79c5ff21856b1ecf3ab56a19bb3fed65475d34a1d84ba12fab2ffe94121b53e09e5e99d7a31d6c64

Download Submit
memory/528-101-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/528-102-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/528-108-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/528-112-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/528-116-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/528-114-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/528-110-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/528-135-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/528-106-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/528-104-0x0000000000590000-0x00000000005B0000-memory.dmp

Filesize
128KB

Download
memory/2252-127-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2324-32-0x00000216A6D50000-0x00000216A6D51000-memory.dmp

Filesize
4KB

Download
memory/2324-38-0x00000216A6D50000-0x00000216A6D51000-memory.dmp

Filesize
4KB

Download
memory/2324-33-0x00000216A6D50000-0x00000216A6D51000-memory.dmp

Filesize
4KB

Download
memory/2324-31-0x00000216A6D50000-0x00000216A6D51000-memory.dmp

Filesize
4KB

Download
memory/2324-43-0x00000216A6D50000-0x00000216A6D51000-memory.dmp

Filesize
4KB

Download
memory/2324-42-0x00000216A6D50000-0x00000216A6D51000-memory.dmp

Filesize
4KB

Download
memory/2324-41-0x00000216A6D50000-0x00000216A6D51000-memory.dmp

Filesize
4KB

Download
memory/2324-40-0x00000216A6D50000-0x00000216A6D51000-memory.dmp

Filesize
4KB

Download
memory/2324-39-0x00000216A6D50000-0x00000216A6D51000-memory.dmp

Filesize
4KB

Download
memory/3612-177-0x00000000022E0000-0x0000000002313000-memory.dmp

Filesize
204KB

Download
memory/3612-153-0x00000000007F0000-0x0000000000828000-memory.dmp

Filesize
224KB

Download
memory/3612-199-0x0000000002820000-0x0000000002903000-memory.dmp

Filesize
908KB

Download
memory/3868-26-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3868-29-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3868-19-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3868-20-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3868-27-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3868-30-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3868-28-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3868-24-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3868-18-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3868-25-0x0000020C724E0000-0x0000020C724E1000-memory.dmp

Filesize
4KB

Download
memory/3976-56-0x0000020449AC0000-0x0000020449AE2000-memory.dmp

Filesize
136KB

Download
memory/3976-60-0x000002044A010000-0x000002044A02E000-memory.dmp

Filesize
120KB

Download
memory/3976-58-0x000002044A050000-0x000002044A0C6000-memory.dmp

Filesize
472KB

Download
memory/3976-57-0x0000020449F80000-0x0000020449FC4000-memory.dmp

Filesize
272KB

Download
memory/4712-126-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4712-152-0x00000000023D0000-0x000000000240A000-memory.dmp

Filesize
232KB

Download
memory/4712-192-0x0000000000400000-0x00000000004E7000-memory.dmp

Filesize
924KB

Download
memory/4712-184-0x00000000023D0000-0x000000000240A000-memory.dmp

Filesize
232KB

Download