Overview

overview

10

Static

static

1

RNSM00375.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    130s
  • max time network
    388s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 18:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00375.7z

  • Size

    40.8MB

  • MD5

    b9cb855d8759e858e4c7267043774061

  • SHA1

    b08bf37327071e56097f20d9e20820bd08a1d06c

  • SHA256

    184d8f3a951d0a05dc121e7fe26c18edef88b710465f500c08eceefbf4600a80

  • SHA512

    67f17a2ec8166849c2eb14331d76d226ee1b18f38dfdd1910551f7a4f5e01489cc2c7a2900990aaa55a5fc114d86845d19ff17209ebfe061b22f325dd2050b3f

  • SSDEEP

    786432:/ZmXo4mvRp5JhfkurS0EIrGosbXA9gdOwwJmTHU1EGInRa9:4yzzI0NYj6Cz2GHWEGIn49

Score
10/10
azorultburancrimsonratdharmagandcrabsystembcbackdoorcredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceprivilege_escalationransomwareratspywarestealertrojanupxvmprotect

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    A1234567X

Extracted

Family

crimsonrat

C2

216.176.190.98

Extracted

Family

systembc

C2

146.0.75.34:4083

Attributes
  • dns

    5.132.191.104

    92.163.33.248

    206.189.120.27

Extracted

Family

azorult

C2

http://hyuifrfrfy.temp.swtest.ru/index.php

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\PKXIUTMLZ-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .PKXIUTMLZ The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/903c55d7ccdfd7b2 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAEI3ENusXqwzkrIk9imahOiUQhE+9gv27UoDsE18ZngAy+exQXd/x4DGw8lbv40c281vm0IPfhQ1Nc8IndNiyXVRb4MZq447YWvP3e2v0y2ASbEvAeJlNhhkUlQnrNqsEwScUq9RIDFWSDy0et1jPBpMUlo795zkdAgJaoT2Z8cknRrCITXhuCHYDlMjSaaUw4MhGWSe8cumfuxmvWHgLUHQOZOz5sSH4KrKl/zBXm6WWChtX0aCCCy7w+/0oooJIKjhauLvMY1eQQuqSXJ6BHE6EkH/4bkMP91t0cM5nslcNefT6lhYyaQpW4KoexkeaOKVSBcFFupqs/EcQHArzpb9kFUqR08AQxSI5di8h8UhB6JSYkjDSK0mFJEMOIoEHwmhoO/TIVhH8bI2VCBve+BBiCyE+yBPYEFyiMuXoR+ixaHJs3hupMgXGM/cCvh5+m5f6qFtIKIUnKLf/ioV/98zSyLlsOhmC+ZAfYcDHa0gmynoIQFepnJCQmDYLRGEsPUOwgS+5CbYQlzsAdj7Wd9T94HEA1NB/aG2H85BM5DjmOH1I9ZcfqxAGfLTnQsPUK6GELw4nhvqu2HCioJNjC3kdP9S1okPWXs1Fe7mfc8Zyny8JVvrX2qi+edt+1Ajc8qkOCGWCNPtEUcFVcwnZbmyhWUQtycYjaxlRURXvnukG168pnfYQRMD8eZ9gKu/q2vjol3KP2tYm++DQZTzdQGah8oT81UveXtMPWXry4fW7K2J3AnMrS0UQbE46aQz+bNaXitqiTmhKgf47+EyOtfzLNyNHJn3izPppxbR1c+VZ9EaJ3O/JqkGbbYkHRIm85QGKZk7b33ceu0x2ZKxtuDpg8raLk/ZK8v7eAVNH0y67M6TufrnCuy1K8r4xqF6Z95W0FUcObItX6YjmUqilRqSthq0uHVK2QAhomRfc5WkhPEDWSM8TjFtW7TOujxnbR6XfGkrW+KmTTB8IAIgkA7FNwAmDwCNLI+FFmdmth07grhD+onVoSQ84O61gIE4eOfHXcr/R2FeELZJNbukmNmqQVZfA63d7O3bjXs0VA0r0x73wN4x4HRwWVgmTGPHJmhKiZfIQyKaWjifeD65Hj+/yI1DsLNmy78NUEFUN43DXx/VhLFpkUZbtPRLpIXq5StLm4pXnkBY0UhNmyWjd+gPjeyKXlpdOUjHLM/WlzlvP5Jfaa/qXStlWubM54chEPEhlXldI2OGE7kXDOqSkNT37kaIbbamD3o3Yyr5v6svf0wlWGRuhzTHuRL+UdQVQqhnUBKeVF/RU4wtxt0cZcPvpYxE04vCl92Tp853akmwY1V/r+7TAIhIYU0iA0bhOe+oriMZB9n4C5tTVL3l7ym5yeheQihRdvPouAx/B4WMWEzzw31oo7Pi1rVxPSYb6mmvlHO9ywnku6LI+T/CnXHU9tgr4vmmJFMQ4hqfj3pH4hjIvPG5ePjEr1Gayb/rTWNga9WYEOoCqaqDJum25JIy8+9zSgqsXTWQ0fYQniW1zEIotMp5r/J9AGwnlVuDP91VzR3MTD+YuMCZmedH9oLzFJT1+bf4t2ZUdwozl5RNGMH1fpRYOUvIyFO0wLStN496p6N2Izf5SHHgei+qsryuF8MzSfVNKOKnZv/SL3W94vPMh3TpFTeh8ZLWihQ32ZW0xOODqtPJxCPTyIXDL7GSkaWLjU+S8TDj1VD/aKRx88vxHUL2wwdA7d/OL/JLmr/nWnpddjOtAgFfibQh+DWjGuN502mVg9PhgfEBqXGGo7SbTyo5cTq/hG0tTj2hsIKaWfozHcEIqXZS8xTOFYsjNKaCweKDrKIpmSO/IFiWaAazo4r+BMxxcqIsK5ruZY6tC8XPYNQ/6Pw1novJqFBnwbnkNzCsvL5Az4t1H6vI0HV8mCMoZjx+hLWH3oIUiMga1aW34iD0Ax/j5hscB6BLrmcc4SukXvcNYxEniy5oAaD8dD+p0i2fT2hZsxlr4N8lCOxWNu2VFwA1DyM0Y5i/eaZKLZZ26gZ2xOQYHRs3KGdEOkCVRQN4WUEnOI1PbpJyACEUjaDp27MebobJaGaPvSOu0imd9k3XJp+cdGwA8SUo6Z0bJ+TfrDeX1OzEGnkZR6GKdvT6s/xIBWR3WdteDxHwYIJKnu2ID7QmYwqJDulEnJVv8KlynyjLtfyDm5f6R205d9DAgerFlWxMVHqGkfU8HJl7giv7GignADGqTScA6zMMgt3fdcRanaJgGzgVFOA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZOToZRrHYT7nNWvLfaTG+Hhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6eKk/2U2QusjGt5YOFqEBnTt/hGCEY8b9ScV4ou4Oab3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pChFF3vDLM+ao1wIZOHQRRlOKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9TQ3fC3KZHEuHtKkisBZ9MNJGhHpcOfb/HRd0Psok9V+butLOnzJ/9bHYIh8gz4+xNRettGP+Pbn3W/eJIXs9ebdQm9EdhJFLd2qBgkWnMLQYzygtAfj75QWEAiTIEnbJST+zbSAE= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/903c55d7ccdfd7b2

Extracted

Path

C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
==== GERMAN ==== Alle Ihre Dateien, Dokumente, Fotos, Datenbanken und andere wichtige Dateien werden verschlusselt. Sie konnen es nicht selbst entschlusseln! Die einzige Methode Zum Wiederherstellen von Dateien muss ein eindeutiger privater Schlussel erworben werden. Nur wir konnen Ihnen diesen Schlussel geben und nur wir konnen Ihre Dateien wiederherstellen. Um sicher zu gehen, dass wir den Entschlusseler haben und er funktioniert, konnen Sie einen senden Senden Sie eine E-Mail an [email protected] oder [email protected] und entschlusseln Sie eine Datei kostenlos. Aber diese Datei sollte nicht wertvoll sein! Mochten Sie Ihre Dateien wirklich wiederherstellen? Schreiben Sie eine E-Mail an [email protected] [email protected] (reservieren) Ihre personliche ID: <! - ID -> Beachtung! * Benennen Sie verschlusselte Dateien nicht um. * Versuchen Sie nicht, Ihre Daten mit Software von Drittanbietern zu entschlusseln. Dies kann zu dauerhaftem Datenverlust fuhren. * Entschlusselung Ihrer Dateien mit Hilfe von Dritten moglich verursachen Sie erhohten Preis (sie addieren ihre Gebuhr zu unserem) oder Sie konnen Opfer eines Betrugs werden. ==== ENGLISH ==== All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email [email protected] or [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email [email protected] [email protected] (reserve) Your personal ID: 39C30A83-A525-95CF-6195-C1AA1476D328 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Azorult family
    azorult
  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Buran family
    buran
  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Crimsonrat family
    crimsonrat
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Dharma family
    dharma
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Systembc family
    systembc
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Contacts a large (3335) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Renames multiple (334) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (519) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Clears Network RDP Connection History and Configurations 1 TTPs 4 IoCs

    Remove evidence of malicious network connections to clean up operations traces.

    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 11 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • VMProtect packed file 5 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 50 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 4 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 25 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00375.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:532
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3936
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Drops startup file
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4116
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.MSIL.Blocker.gen-63f8cd6de7a667edb95fe51990274dd30a774905401b8642e071049b1d477a7e.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-63f8cd6de7a667edb95fe51990274dd30a774905401b8642e071049b1d477a7e.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1844
        • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.MSIL.Blocker.gen-63f8cd6de7a667edb95fe51990274dd30a774905401b8642e071049b1d477a7e.exe
          HEUR-Trojan-Ransom.MSIL.Blocker.gen-63f8cd6de7a667edb95fe51990274dd30a774905401b8642e071049b1d477a7e.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2496
      • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.MSIL.Foreign.gen-ff4c5f6a1a5b68b956970751d56ee7905ec48ad39cc05416ee8ee958ecd0c40e.exe
        HEUR-Trojan-Ransom.MSIL.Foreign.gen-ff4c5f6a1a5b68b956970751d56ee7905ec48ad39cc05416ee8ee958ecd0c40e.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2592
      • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.MSIL.Gen.gen-937aa346ee2e2e9d234c52d278bd2d53cd7e1078aaf3bdb6654dcdf08c924e19.exe
        HEUR-Trojan-Ransom.MSIL.Gen.gen-937aa346ee2e2e9d234c52d278bd2d53cd7e1078aaf3bdb6654dcdf08c924e19.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        PID:1600
        • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.MSIL.Gen.gen-937aa346ee2e2e9d234c52d278bd2d53cd7e1078aaf3bdb6654dcdf08c924e19.exe
          "HEUR-Trojan-Ransom.MSIL.Gen.gen-937aa346ee2e2e9d234c52d278bd2d53cd7e1078aaf3bdb6654dcdf08c924e19.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:11956
          • C:\Windows\SysWOW64\wbem\wmic.exe
            "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
            5⤵
              PID:9188
        • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Agent.gen-434a7f3d787dab3c5e3daa30c4205ee503f1442ef64d88f5af5dd7cfca2fdec0.exe
          HEUR-Trojan-Ransom.Win32.Agent.gen-434a7f3d787dab3c5e3daa30c4205ee503f1442ef64d88f5af5dd7cfca2fdec0.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:832
          • C:\Users\Admin\AppData\Local\Temp\Build.exe
            "C:\Users\Admin\AppData\Local\Temp\Build.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1696
        • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Blocker.gen-defa67780ca672a33df0f9b81634a2dd03877e1761ded62985800dcd24fbbec6.exe
          HEUR-Trojan-Ransom.Win32.Blocker.gen-defa67780ca672a33df0f9b81634a2dd03877e1761ded62985800dcd24fbbec6.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1528
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 8988
            4⤵
            • Program crash
            PID:8572
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 8988
            4⤵
            • Program crash
            PID:9008
        • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Crypren.vho-372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe
          HEUR-Trojan-Ransom.Win32.Crypren.vho-372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe
          3⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: RenamesItself
          • Suspicious use of WriteProcessMemory
          PID:1240
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1228
            • C:\Windows\system32\mode.com
              mode con cp select=1251
              5⤵
                PID:6412
              • C:\Windows\system32\vssadmin.exe
                vssadmin delete shadows /all /quiet
                5⤵
                • Interacts with shadow copies
                PID:7176
            • C:\Windows\system32\cmd.exe
              "C:\Windows\system32\cmd.exe"
              4⤵
                PID:9392
                • C:\Windows\system32\mode.com
                  mode con cp select=1251
                  5⤵
                    PID:6552
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin delete shadows /all /quiet
                    5⤵
                    • Interacts with shadow copies
                    PID:4492
                • C:\Windows\System32\mshta.exe
                  "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                  4⤵
                    PID:8332
                  • C:\Windows\System32\mshta.exe
                    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                    4⤵
                      PID:6768
                  • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-17b284c20aa2bcbce2ad04a9dd72850e37ebc0bfa1510b20ca9e9895bf9c7cdd.exe
                    HEUR-Trojan-Ransom.Win32.GandCrypt.gen-17b284c20aa2bcbce2ad04a9dd72850e37ebc0bfa1510b20ca9e9895bf9c7cdd.exe
                    3⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:400
                    • C:\Windows\V49050494020\winsvcin32.exe
                      C:\Windows\V49050494020\winsvcin32.exe
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3936
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 452
                      4⤵
                      • Program crash
                      PID:13076
                  • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Gen.gen-de0c5066fdbae982f39d31b0058c568181a6d7e8047daf756080507f8a9af2fa.exe
                    HEUR-Trojan-Ransom.Win32.Gen.gen-de0c5066fdbae982f39d31b0058c568181a6d7e8047daf756080507f8a9af2fa.exe
                    3⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:7780
                  • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Gen.vho-339a9c6239d8eb3f0225d3165a42222d5a4c74896ae8e8e212a6e44990db8c55.exe
                    HEUR-Trojan-Ransom.Win32.Gen.vho-339a9c6239d8eb3f0225d3165a42222d5a4c74896ae8e8e212a6e44990db8c55.exe
                    3⤵
                    • Looks for VirtualBox Guest Additions in registry
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:920
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\Desktop\00375\HEB2EA~1.EXE
                      4⤵
                        PID:6928
                      • C:\Windows\SysWOW64\cmd.exe
                        /a /c ping 127.0.0.1 -n 3&del "C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Gen.vho-339a9c6239d8eb3f0225d3165a42222d5a4c74896ae8e8e212a6e44990db8c55.exe"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:3756
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1 -n 3
                          5⤵
                          • System Location Discovery: System Language Discovery
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:10856
                    • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-986918f3afe3dddc8a37c2761b27e41f19dd85b2122172a70c2865b21f9689d9.exe
                      HEUR-Trojan-Ransom.Win32.PolyRansom.gen-986918f3afe3dddc8a37c2761b27e41f19dd85b2122172a70c2865b21f9689d9.exe
                      3⤵
                      • Modifies WinLogon for persistence
                      • Drops startup file
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • Drops autorun.inf file
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      PID:2640
                    • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Shade.vho-a0d4700887c4093807fb98f2dd415aae6d2b81798d322961576ebbd1335365c2.exe
                      HEUR-Trojan-Ransom.Win32.Shade.vho-a0d4700887c4093807fb98f2dd415aae6d2b81798d322961576ebbd1335365c2.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:6660
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 6660 -s 1340
                        4⤵
                        • Program crash
                        PID:7388
                    • C:\Users\Admin\Desktop\00375\Trojan-Ransom.MSIL.Blocker.bl-269662d5d2d7522fa2b88be8de2a3540e1443fba1a9d6c8139177a3a5a78bd2d.exe
                      Trojan-Ransom.MSIL.Blocker.bl-269662d5d2d7522fa2b88be8de2a3540e1443fba1a9d6c8139177a3a5a78bd2d.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3960
                      • C:\Users\Admin\AppData\Roaming\Google Auto Updater.exe
                        "C:\Users\Admin\AppData\Roaming\Google Auto Updater.exe"
                        4⤵
                          PID:10916
                      • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Bitman.adnq-899aa66611f7a6a058a8ef90aef6e0436d9b0b49a4fb5ede2c3dfe574aa708e7.exe
                        Trojan-Ransom.Win32.Bitman.adnq-899aa66611f7a6a058a8ef90aef6e0436d9b0b49a4fb5ede2c3dfe574aa708e7.exe
                        3⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:5236
                        • C:\windows\explorer.exe
                          "C:\windows\explorer.exe"
                          4⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Loads dropped DLL
                          • Enumerates connected drives
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          PID:11640
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00375\unit.bat" "
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:8840
                          • C:\Windows\SysWOW64\PING.EXE
                            ping -n 0.5 127.0.0.1
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:1944
                          • C:\Windows\SysWOW64\net.exe
                            net user administrator /active:yes
                            5⤵
                            • System Location Discovery: System Language Discovery
                            PID:13024
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 user administrator /active:yes
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:812
                      • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Bitman.aewz-ef7f38b6083f22d04a2c5787a5d7a784e891d9cc329ed046ad5ad128ca1e5042.exe
                        Trojan-Ransom.Win32.Bitman.aewz-ef7f38b6083f22d04a2c5787a5d7a784e891d9cc329ed046ad5ad128ca1e5042.exe
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3640
                      • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Blocker.lckf-e710fe80032398181efcc316de4386658013eb2cd544454158b81a022c13460b.exe
                        Trojan-Ransom.Win32.Blocker.lckf-e710fe80032398181efcc316de4386658013eb2cd544454158b81a022c13460b.exe
                        3⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Drops desktop.ini file(s)
                        • System Location Discovery: System Language Discovery
                        PID:8560
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Build.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Build.exe"
                          4⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:8376
                      • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Blocker.mbys-25748e57d896e6abe9949d52c87aaf3d3800e88d2fca9763bf38db8973bc3a2b.exe
                        Trojan-Ransom.Win32.Blocker.mbys-25748e57d896e6abe9949d52c87aaf3d3800e88d2fca9763bf38db8973bc3a2b.exe
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6704
                      • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Crusis.drr-7b3e28d2f4946196b60ac5feb807984cc6ea82ef7ab535dbc291707c19e8eb69.exe
                        Trojan-Ransom.Win32.Crusis.drr-7b3e28d2f4946196b60ac5feb807984cc6ea82ef7ab535dbc291707c19e8eb69.exe
                        3⤵
                        • Executes dropped EXE
                        • Enumerates connected drives
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of SetWindowsHookEx
                        PID:9880
                        • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Crusis.drr-7b3e28d2f4946196b60ac5feb807984cc6ea82ef7ab535dbc291707c19e8eb69.exe
                          C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Crusis.drr-7b3e28d2f4946196b60ac5feb807984cc6ea82ef7ab535dbc291707c19e8eb69.exe
                          4⤵
                          • Drops startup file
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          PID:9440
                          • C:\Windows\system32\cmd.exe
                            "C:\Windows\system32\cmd.exe"
                            5⤵
                              PID:10800
                              • C:\Windows\system32\mode.com
                                mode con cp select=1251
                                6⤵
                                  PID:8932
                                • C:\Windows\system32\vssadmin.exe
                                  vssadmin delete shadows /all /quiet
                                  6⤵
                                  • Interacts with shadow copies
                                  PID:7568
                              • C:\Windows\system32\cmd.exe
                                "C:\Windows\system32\cmd.exe"
                                5⤵
                                  PID:5896
                                  • C:\Windows\system32\mode.com
                                    mode con cp select=1251
                                    6⤵
                                      PID:12328
                                    • C:\Windows\system32\vssadmin.exe
                                      vssadmin delete shadows /all /quiet
                                      6⤵
                                      • Interacts with shadow copies
                                      PID:12136
                                  • C:\Windows\System32\mshta.exe
                                    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                    5⤵
                                      PID:5908
                                    • C:\Windows\System32\mshta.exe
                                      "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                                      5⤵
                                        PID:5116
                                  • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Crusis.dsz-970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4.exe
                                    Trojan-Ransom.Win32.Crusis.dsz-970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetThreadContext
                                    • System Location Discovery: System Language Discovery
                                    PID:11060
                                    • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Crusis.dsz-970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4.exe
                                      C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Crusis.dsz-970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4.exe
                                      4⤵
                                      • Executes dropped EXE
                                      PID:12812
                                  • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.CryFile.aabg-dc276b7ca4a980cf487b73b4ef9c40fb93f1b00b5c757a726057ab21a0372ecf.exe
                                    Trojan-Ransom.Win32.CryFile.aabg-dc276b7ca4a980cf487b73b4ef9c40fb93f1b00b5c757a726057ab21a0372ecf.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:8764
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /e:on /c md "C:\Users\Admin\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.CryFile.aabg-dc276b7ca4a980cf487b73b4ef9c40fb93f1b00b5c757a726057ab21a0372ecf.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" & reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe\" -start"
                                      4⤵
                                        PID:5852
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe\" -start"
                                          5⤵
                                            PID:8668
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
                                          4⤵
                                            PID:4600
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                              5⤵
                                                PID:5864
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                                                5⤵
                                                  PID:13040
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                                                  5⤵
                                                    PID:9544
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
                                                    5⤵
                                                      PID:7660
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
                                                      5⤵
                                                        PID:12788
                                                        • C:\Windows\System32\Conhost.exe
                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                          6⤵
                                                            PID:400
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
                                                          5⤵
                                                            PID:9724
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                                                            5⤵
                                                              PID:11184
                                                              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                wmic shadowcopy delete
                                                                6⤵
                                                                  PID:9088
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                                                                5⤵
                                                                  PID:6248
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    6⤵
                                                                      PID:1944
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
                                                                    5⤵
                                                                    • Clears Network RDP Connection History and Configurations
                                                                    PID:2120
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
                                                                      6⤵
                                                                      • Clears Network RDP Connection History and Configurations
                                                                      PID:10792
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
                                                                    5⤵
                                                                    • Clears Network RDP Connection History and Configurations
                                                                    PID:7952
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
                                                                      6⤵
                                                                      • Clears Network RDP Connection History and Configurations
                                                                      PID:11484
                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                    "C:\Windows\system32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
                                                                    5⤵
                                                                      PID:8384
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
                                                                        6⤵
                                                                          PID:6988
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        "C:\Windows\system32\cmd.exe" /C attrib "%userprofile%\documents\Default.rdp" -s -h
                                                                        5⤵
                                                                          PID:3752
                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                            attrib "C:\Users\Admin\documents\Default.rdp" -s -h
                                                                            6⤵
                                                                            • Views/modifies file attributes
                                                                            PID:9184
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\system32\cmd.exe" /C del "%userprofile%\documents\Default.rdp"
                                                                          5⤵
                                                                            PID:8336
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Application
                                                                            5⤵
                                                                              PID:8656
                                                                              • C:\Windows\SysWOW64\wevtutil.exe
                                                                                wevtutil.exe clear-log Application
                                                                                6⤵
                                                                                • Clears Windows event logs
                                                                                PID:12192
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Security
                                                                              5⤵
                                                                                PID:13268
                                                                                • C:\Windows\SysWOW64\wevtutil.exe
                                                                                  wevtutil.exe clear-log Security
                                                                                  6⤵
                                                                                  • Clears Windows event logs
                                                                                  PID:7452
                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log System
                                                                                5⤵
                                                                                  PID:6460
                                                                                  • C:\Windows\SysWOW64\wevtutil.exe
                                                                                    wevtutil.exe clear-log System
                                                                                    6⤵
                                                                                    • Clears Windows event logs
                                                                                    PID:4176
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\system32\cmd.exe" /C sc config eventlog start=disabled
                                                                                  5⤵
                                                                                    PID:8240
                                                                                    • C:\Windows\SysWOW64\sc.exe
                                                                                      sc config eventlog start=disabled
                                                                                      6⤵
                                                                                      • Launches sc.exe
                                                                                      PID:12724
                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                                                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
                                                                                    5⤵
                                                                                      PID:10196
                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                                                                      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 1
                                                                                      5⤵
                                                                                        PID:9692
                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                                                                        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 2
                                                                                        5⤵
                                                                                          PID:11084
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 11084 -s 528
                                                                                            6⤵
                                                                                            • Program crash
                                                                                            PID:5600
                                                                                        • C:\Windows\SysWOW64\notepad.exe
                                                                                          "C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
                                                                                          5⤵
                                                                                            PID:14996
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            "C:\Windows\system32\cmd.exe" /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" & if not exist "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" exit )
                                                                                            5⤵
                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                            PID:14948
                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                              ping -n 3 127.1
                                                                                              6⤵
                                                                                              • System Network Configuration Discovery: Internet Connection Discovery
                                                                                              • Runs ping.exe
                                                                                              PID:14832
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "C:\Windows\system32\cmd.exe" /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.CryFile.aabg-dc276b7ca4a980cf487b73b4ef9c40fb93f1b00b5c757a726057ab21a0372ecf.exe" & if not exist "C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.CryFile.aabg-dc276b7ca4a980cf487b73b4ef9c40fb93f1b00b5c757a726057ab21a0372ecf.exe" exit )
                                                                                          4⤵
                                                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                                                          PID:6452
                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                            ping -n 3 127.1
                                                                                            5⤵
                                                                                            • System Network Configuration Discovery: Internet Connection Discovery
                                                                                            • Runs ping.exe
                                                                                            PID:10976
                                                                                      • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Crypmod.acmi-2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe
                                                                                        Trojan-Ransom.Win32.Crypmod.acmi-2bf305e40252953154a29d0887a6703973a4523a77ed89de6b8803f5dd360f57.exe
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:8672
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 8672 -s 236
                                                                                          4⤵
                                                                                          • Program crash
                                                                                          PID:11196
                                                                                      • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Crypmodadv.xzh-eb4c891dca0ae8172da731f80cd9576c191f964e27c075142ce6ee371690ec5f.exe
                                                                                        Trojan-Ransom.Win32.Crypmodadv.xzh-eb4c891dca0ae8172da731f80cd9576c191f964e27c075142ce6ee371690ec5f.exe
                                                                                        3⤵
                                                                                        • Executes dropped EXE
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:12444
                                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                                          C:\Windows\System32\svchost.exe {"variant":0,"path":"C:\\Users\\Admin\\Desktop\\00375\\Trojan-Ransom.Win32.Crypmodadv.xzh-eb4c891dca0ae8172da731f80cd9576c191f964e27c075142ce6ee371690ec5f.exe","processid":12444}
                                                                                          4⤵
                                                                                            PID:9848
                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                      C:\Windows\system32\vssvc.exe
                                                                                      1⤵
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:6936
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1528 -ip 1528
                                                                                      1⤵
                                                                                        PID:7716
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 400 -ip 400
                                                                                        1⤵
                                                                                          PID:5364
                                                                                        • C:\ProgramData\vnovgpq\dbxw.exe
                                                                                          C:\ProgramData\vnovgpq\dbxw.exe start2
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:9144
                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                          1⤵
                                                                                            PID:6800
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 8672 -ip 8672
                                                                                            1⤵
                                                                                              PID:7844
                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                              C:\Windows\system32\AUDIODG.EXE 0x4ec 0x470
                                                                                              1⤵
                                                                                                PID:5548
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:7840
                                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\00375\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
                                                                                                  2⤵
                                                                                                    PID:15240
                                                                                                • C:\Windows\system32\werfault.exe
                                                                                                  werfault.exe /h /shared Global\2ae9f69cf9b34811bb8c110edb57beb9 /t 8460 /p 6768
                                                                                                  1⤵
                                                                                                    PID:11712
                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                    1⤵
                                                                                                      PID:9560
                                                                                                    • C:\Windows\system32\werfault.exe
                                                                                                      werfault.exe /h /shared Global\c74e3da86921414d9df551345cb32084 /t 5216 /p 8332
                                                                                                      1⤵
                                                                                                        PID:7824
                                                                                                      • C:\Windows\system32\werfault.exe
                                                                                                        werfault.exe /h /shared Global\74ebdca47f5346d38929125d6cd0fef9 /t 2088 /p 5116
                                                                                                        1⤵
                                                                                                          PID:6184
                                                                                                        • C:\Windows\system32\werfault.exe
                                                                                                          werfault.exe /h /shared Global\0c640aa412a84e21b1f0afe7a51e24b8 /t 2240 /p 5908
                                                                                                          1⤵
                                                                                                            PID:7540
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 11084 -ip 11084
                                                                                                            1⤵
                                                                                                              PID:11652
                                                                                                            • C:\Windows\system32\efsui.exe
                                                                                                              efsui.exe /efs /keybackup
                                                                                                              1⤵
                                                                                                                PID:2340
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6660 -ip 6660
                                                                                                                1⤵
                                                                                                                  PID:2696
                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                  1⤵
                                                                                                                    PID:13364
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:13528
                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                      1⤵
                                                                                                                        PID:15912
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:11780
                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                          1⤵
                                                                                                                            PID:16836
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:17208
                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                              1⤵
                                                                                                                                PID:17804
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                  PID:17832

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                Reconnaissance

                                                                                                                                Resource Development

                                                                                                                                Initial Access

                                                                                                                                Replication Through Removable Media

                                                                                                                                1
                                                                                                                                T1091

                                                                                                                                Execution

                                                                                                                                Windows Management Instrumentation

                                                                                                                                1
                                                                                                                                T1047

                                                                                                                                Persistence

                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                3
                                                                                                                                T1547

                                                                                                                                Active Setup

                                                                                                                                1
                                                                                                                                T1547.014

                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                1
                                                                                                                                T1547.001

                                                                                                                                Winlogon Helper DLL

                                                                                                                                1
                                                                                                                                T1547.004

                                                                                                                                Event Triggered Execution

                                                                                                                                1
                                                                                                                                T1546

                                                                                                                                Component Object Model Hijacking

                                                                                                                                1
                                                                                                                                T1546.015

                                                                                                                                Privilege Escalation

                                                                                                                                Boot or Logon Autostart Execution

                                                                                                                                3
                                                                                                                                T1547

                                                                                                                                Active Setup

                                                                                                                                1
                                                                                                                                T1547.014

                                                                                                                                Registry Run Keys / Startup Folder

                                                                                                                                1
                                                                                                                                T1547.001

                                                                                                                                Winlogon Helper DLL

                                                                                                                                1
                                                                                                                                T1547.004

                                                                                                                                Event Triggered Execution

                                                                                                                                1
                                                                                                                                T1546

                                                                                                                                Component Object Model Hijacking

                                                                                                                                1
                                                                                                                                T1546.015

                                                                                                                                Defense Evasion

                                                                                                                                Direct Volume Access

                                                                                                                                1
                                                                                                                                T1006

                                                                                                                                Hide Artifacts

                                                                                                                                1
                                                                                                                                T1564

                                                                                                                                Hidden Files and Directories

                                                                                                                                1
                                                                                                                                T1564.001

                                                                                                                                Indicator Removal

                                                                                                                                5
                                                                                                                                T1070

                                                                                                                                Clear Network Connection History and Configurations

                                                                                                                                1
                                                                                                                                T1070.007

                                                                                                                                Clear Windows Event Logs

                                                                                                                                1
                                                                                                                                T1070.001

                                                                                                                                File Deletion

                                                                                                                                3
                                                                                                                                T1070.004

                                                                                                                                Modify Registry

                                                                                                                                4
                                                                                                                                T1112

                                                                                                                                Subvert Trust Controls

                                                                                                                                1
                                                                                                                                T1553

                                                                                                                                Install Root Certificate

                                                                                                                                1
                                                                                                                                T1553.004

                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                1
                                                                                                                                T1497

                                                                                                                                Credential Access

                                                                                                                                Credentials from Password Stores

                                                                                                                                2
                                                                                                                                T1555

                                                                                                                                Credentials from Web Browsers

                                                                                                                                1
                                                                                                                                T1555.003

                                                                                                                                Windows Credential Manager

                                                                                                                                1
                                                                                                                                T1555.004

                                                                                                                                Unsecured Credentials

                                                                                                                                1
                                                                                                                                T1552

                                                                                                                                Credentials In Files

                                                                                                                                1
                                                                                                                                T1552.001

                                                                                                                                Discovery

                                                                                                                                Browser Information Discovery

                                                                                                                                1
                                                                                                                                T1217

                                                                                                                                Network Service Discovery

                                                                                                                                1
                                                                                                                                T1046

                                                                                                                                Peripheral Device Discovery

                                                                                                                                2
                                                                                                                                T1120

                                                                                                                                Query Registry

                                                                                                                                6
                                                                                                                                T1012

                                                                                                                                Remote System Discovery

                                                                                                                                1
                                                                                                                                T1018

                                                                                                                                System Information Discovery

                                                                                                                                6
                                                                                                                                T1082

                                                                                                                                System Location Discovery

                                                                                                                                1
                                                                                                                                T1614

                                                                                                                                System Language Discovery

                                                                                                                                1
                                                                                                                                T1614.001

                                                                                                                                System Network Configuration Discovery

                                                                                                                                1
                                                                                                                                T1016

                                                                                                                                Internet Connection Discovery

                                                                                                                                1
                                                                                                                                T1016.001

                                                                                                                                Virtualization/Sandbox Evasion

                                                                                                                                1
                                                                                                                                T1497

                                                                                                                                Lateral Movement

                                                                                                                                Replication Through Removable Media

                                                                                                                                1
                                                                                                                                T1091

                                                                                                                                Collection

                                                                                                                                Data from Local System

                                                                                                                                1
                                                                                                                                T1005

                                                                                                                                Command and Control

                                                                                                                                Exfiltration

                                                                                                                                Impact

                                                                                                                                Inhibit System Recovery

                                                                                                                                2
                                                                                                                                T1490

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini
                                                                                                                                  Filesize

                                                                                                                                  129B

                                                                                                                                  MD5

                                                                                                                                  a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                  SHA1

                                                                                                                                  2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                  SHA256

                                                                                                                                  e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                  SHA512

                                                                                                                                  d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                  Download Submit

                                                                                                                                • C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.id-CCDFD7B2.[[email protected]].bot
                                                                                                                                  Filesize

                                                                                                                                  378B

                                                                                                                                  MD5

                                                                                                                                  b672ae256bd14f677fcf5fc043263569

                                                                                                                                  SHA1

                                                                                                                                  8472419a218d3a90a426d13d1b9f8d57f941e838

                                                                                                                                  SHA256

                                                                                                                                  ca52f8496b3f077d4fa0dcd1659009e4cc6855eb4ee9c77af724da9b8c6e694b

                                                                                                                                  SHA512

                                                                                                                                  be340276a36cd678cbed40ddb202ec7a6ebc04b6c65612aa6d05e35cc88f28e077ce21da9082799e8e89aee7466e43b83fef41a14aa760f248f10014de2bed62

                                                                                                                                  Download Submit

                                                                                                                                • C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.id-CCDFD7B2.[[email protected]].bot.exe
                                                                                                                                  Filesize

                                                                                                                                  889KB

                                                                                                                                  MD5

                                                                                                                                  49ef4eebc5b7457bafbd742356ec4600

                                                                                                                                  SHA1

                                                                                                                                  3759798b18bf6ca6930a869d5c4202c672365f84

                                                                                                                                  SHA256

                                                                                                                                  59b610d3d51f12d41044d69a4b00697eb23a2ab12daa0b674fec1fb45b97d0fd

                                                                                                                                  SHA512

                                                                                                                                  62db43a3e45ffbaa0e0b01362f73a17c1fcc98f14f81d662aec151d2da5b4142e45356372abae2a772995bb507bc2becad3e47b8b16de80034c9e2d90b3c8e57

                                                                                                                                  Download Submit

                                                                                                                                • C:\Program Files\7-Zip\Lang\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  03227431712543826cc39e64468732a5

                                                                                                                                  SHA1

                                                                                                                                  9bfce4209d51016a95725a8ac151b22d253625e3

                                                                                                                                  SHA256

                                                                                                                                  be18f4da5b3dd7ac31f980d64949a606ea8d564bf6f45ae32aaa45aa30974247

                                                                                                                                  SHA512

                                                                                                                                  68608897a00c90f5b0124cba0fae1815fe09cc523e4092c57fc773b2b2a40628f945525d72989b756d1f5f7728d93804df2298bf0c02d3d0999718559845c85b

                                                                                                                                  Download Submit

                                                                                                                                • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-CCDFD7B2.[[email protected]].bot
                                                                                                                                  Filesize

                                                                                                                                  2.7MB

                                                                                                                                  MD5

                                                                                                                                  a834fe459ee077424933ccb49ff7568d

                                                                                                                                  SHA1

                                                                                                                                  75f3d738703472319a91f1ef853919db7ebfe32c

                                                                                                                                  SHA256

                                                                                                                                  b486e2699576dd423f55b4f7909003c93b8cc025571c250f017456bf3505616f

                                                                                                                                  SHA512

                                                                                                                                  646cd0457aacc989e9e3a4aaf4c9c9ca7807549278413e5eb6e1b2941cfb76dfe9568141b661c097884275db92b104a462e8d68431442d4e132ecfc1d09edc80

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                                                                                  Filesize

                                                                                                                                  64KB

                                                                                                                                  MD5

                                                                                                                                  d2fb266b97caff2086bf0fa74eddb6b2

                                                                                                                                  SHA1

                                                                                                                                  2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                                                                                  SHA256

                                                                                                                                  b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                                                                                  SHA512

                                                                                                                                  c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                                                                                  Filesize

                                                                                                                                  4B

                                                                                                                                  MD5

                                                                                                                                  f49655f856acb8884cc0ace29216f511

                                                                                                                                  SHA1

                                                                                                                                  cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                                                                                  SHA256

                                                                                                                                  7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                                                                                  SHA512

                                                                                                                                  599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                                                                                  Filesize

                                                                                                                                  944B

                                                                                                                                  MD5

                                                                                                                                  6bd369f7c74a28194c991ed1404da30f

                                                                                                                                  SHA1

                                                                                                                                  0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                                                                                  SHA256

                                                                                                                                  878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                                                                                  SHA512

                                                                                                                                  8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\HEUR-Trojan-Ransom.MSIL.Blocker.gen-63f8cd6de7a667edb95fe51990274dd30a774905401b8642e071049b1d477a7e.exe.log
                                                                                                                                  Filesize

                                                                                                                                  20B

                                                                                                                                  MD5

                                                                                                                                  b3ac9d09e3a47d5fd00c37e075a70ecb

                                                                                                                                  SHA1

                                                                                                                                  ad14e6d0e07b00bd10d77a06d68841b20675680b

                                                                                                                                  SHA256

                                                                                                                                  7a23c6e7ccd8811ecdf038d3a89d5c7d68ed37324bae2d4954125d9128fa9432

                                                                                                                                  SHA512

                                                                                                                                  09b609ee1061205aa45b3c954efc6c1a03c8fd6b3011ff88cf2c060e19b1d7fd51ee0cb9d02a39310125f3a66aa0146261bdee3d804f472034df711bc942e316

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
                                                                                                                                  Filesize

                                                                                                                                  174B

                                                                                                                                  MD5

                                                                                                                                  e0fd7e6b4853592ac9ac73df9d83783f

                                                                                                                                  SHA1

                                                                                                                                  2834e77dfa1269ddad948b87d88887e84179594a

                                                                                                                                  SHA256

                                                                                                                                  feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

                                                                                                                                  SHA512

                                                                                                                                  289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  419a089e66b9e18ada06c459b000cb4d

                                                                                                                                  SHA1

                                                                                                                                  ed2108a58ba73ac18c3d2bf0d8c1890c2632b05a

                                                                                                                                  SHA256

                                                                                                                                  c48e42e9ab4e25b92c43a7b0416d463b9ff7c69541e4623a39513bc98085f424

                                                                                                                                  SHA512

                                                                                                                                  bbd57bea7159748e1b13b3e459e2c8691a46bdc9323afdb9dbf9d8f09511750d46a1d98c717c7adca07d79edc859e925476dd03231507f37f45775c0a79a593c

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
                                                                                                                                  Filesize

                                                                                                                                  1024KB

                                                                                                                                  MD5

                                                                                                                                  ec12e1051ea6b3e05bbbb9e52eb465aa

                                                                                                                                  SHA1

                                                                                                                                  80ded3704f78b702b424d37d7c8e2a922d572c8c

                                                                                                                                  SHA256

                                                                                                                                  0c019c175d8c6186daf7851d82280d46cd08efc4c81159a306a127baf7a2b4e2

                                                                                                                                  SHA512

                                                                                                                                  fa0aca6873450af98fb45d6e4da2cc3d86180f2e0aa57d64b26763f922205a122daf42bfcbdce5c750622dc094abc433f73041e320363499c8bb113d3bdc1856

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
                                                                                                                                  Filesize

                                                                                                                                  1024KB

                                                                                                                                  MD5

                                                                                                                                  777dd969da3dd17026244668b774e058

                                                                                                                                  SHA1

                                                                                                                                  e0a066d28dfc6bcca1c13a50bfc4b35a37541b7a

                                                                                                                                  SHA256

                                                                                                                                  221f1bd7bad281fe93374736df606e52ce7393ae4fe0bdd4682935b90f184e59

                                                                                                                                  SHA512

                                                                                                                                  1f1a19b1a969a62cd8c83622e89077492457dd00f28505f0fe49a600688b18bf0407cae61e0da9f0d23fd0f6d874125fe83a5666ca7975976d612743fda08158

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                                                  Filesize

                                                                                                                                  7KB

                                                                                                                                  MD5

                                                                                                                                  77b65a77cac00fe47b16dd4819c4a4c7

                                                                                                                                  SHA1

                                                                                                                                  5d174cc05cfc487ee35db8aaa770930a26529bc0

                                                                                                                                  SHA256

                                                                                                                                  31aa3f7fa15dc18c49e4e36554fbaed761808284a0fa4a792a48e46d267e0383

                                                                                                                                  SHA512

                                                                                                                                  abcc320916161427a5b5683edd9242ad065680eee55f35b770e24c58f3ddb5b77bc1f58bc4c5fb851bec15b441a8de904a10dbb7eeaf6dcdf9460470d3d33d78

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  2dd3f3c33e7100ec0d4dbbca9774b044

                                                                                                                                  SHA1

                                                                                                                                  b254d47f2b9769f13b033cae2b0571d68d42e5eb

                                                                                                                                  SHA256

                                                                                                                                  5a00cc998e0d0285b729964afd20618cbaecfa7791fecdb843b535491a83ae21

                                                                                                                                  SHA512

                                                                                                                                  c719d8c54a3a749a41b8fc430405db7fcde829c150f27c89015793ca06018ad9d6833f20ab7e0cfda99e16322b52a19c080e8c618f996fc8923488819e6e14bb

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
                                                                                                                                  Filesize

                                                                                                                                  1024KB

                                                                                                                                  MD5

                                                                                                                                  fbf438df723b937ddcd51725ec29603c

                                                                                                                                  SHA1

                                                                                                                                  3f4b90ec46a385020ef676131ba0846da3bffa65

                                                                                                                                  SHA256

                                                                                                                                  faeecb324b7c8fb0c506a17952395702e21583b60ed7faa9bb950c11465f696f

                                                                                                                                  SHA512

                                                                                                                                  53c4b7c901f6a24ef7def37f7710255630078b5bb3c2bafdb01e57aff947d8920383b65161a7557646643ea2f3ad83b5b8111d25d0077fed4b4ce0dfa2b32708

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  635e15cb045ff4cf0e6a31c827225767

                                                                                                                                  SHA1

                                                                                                                                  f1eaaa628678441481309261fabc9d155c0dd6cb

                                                                                                                                  SHA256

                                                                                                                                  67219e5ad98a31e8fa8593323cd2024c1ca54d65985d895e8830ae356c7bdf1d

                                                                                                                                  SHA512

                                                                                                                                  81172ae72153b24391c19556982a316e16e638f5322b11569d76b28e154250d0d2f31e83e9e832180e34add0d63b24d36dd8a0cee80e8b46d96639bff811fa58

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
                                                                                                                                  Filesize

                                                                                                                                  1024KB

                                                                                                                                  MD5

                                                                                                                                  335984248499cdd351fb4358e9198aa7

                                                                                                                                  SHA1

                                                                                                                                  587d3d936e4cb41ccc51296a65b4cfd2f96401e4

                                                                                                                                  SHA256

                                                                                                                                  e90a7f1d89f524ba998027435ccd2f243dc82aab18b69c5c3996150d2cdec3c0

                                                                                                                                  SHA512

                                                                                                                                  0353c97114ec97a357f4ad67272064567abae6cb727328eb3ee625d168942f76a2672c85a6ab0d6ba01050c76e0daef51b3fcbeaf3a1ef78d0e356e0c2a0d3e2

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  2d84ad5cfdf57bd4e3656bcfd9a864ea

                                                                                                                                  SHA1

                                                                                                                                  b7b82e72891e16d837a54f94960f9b3c83dc5552

                                                                                                                                  SHA256

                                                                                                                                  d241584a3fd4a91976fafd5ec427e88f6e60998954dec39e388af88316af3552

                                                                                                                                  SHA512

                                                                                                                                  0d9bc1ee51a4fb91b24e37f85afbf88376c88345483d686c6cff84066544287c98534aa701d7d4d52e53f10a3bea73ee8bc38d18425fde6d66352f8b76c0cbb5

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  60476a101249aedff09a43e047040191

                                                                                                                                  SHA1

                                                                                                                                  de5b6a0adc7de7180e19286cf0f13567278cdb64

                                                                                                                                  SHA256

                                                                                                                                  35bc77a06bfdde8c8f3a474c88520262b88c7b8992ee6b2d5cf41dddc77a83fb

                                                                                                                                  SHA512

                                                                                                                                  f1d2dcc562a36434c6c6405ec4eac7ecfa76fc5a940114da6f94495b77584a132d5d82ad3556df749490be096cfd238fa8b484b7c734cbc4d074e963e5d451f4

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  ae6fbded57f9f7d048b95468ddee47ca

                                                                                                                                  SHA1

                                                                                                                                  c4473ea845be2fb5d28a61efd72f19d74d5fc82e

                                                                                                                                  SHA256

                                                                                                                                  d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9

                                                                                                                                  SHA512

                                                                                                                                  f119d5ad9162f0f5d376e03a9ea15e30658780e18dd86e81812dda8ddf59addd1daa0706b2f5486df8f17429c2c60aa05d4f041a2082fd2ec6ea8cc9469fade3

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                                                                                                                                  Filesize

                                                                                                                                  1024KB

                                                                                                                                  MD5

                                                                                                                                  2a84d4f24c54ad34d0c9efdd52022f84

                                                                                                                                  SHA1

                                                                                                                                  c737cd070c91faae135c7d9d359dfd2ce4083424

                                                                                                                                  SHA256

                                                                                                                                  86d5d7b1f83c5ac9c21da39f907cbf88631f513197821048176088a707623687

                                                                                                                                  SHA512

                                                                                                                                  2d2f45274a82dd88c97e29cba0d84ddc69157064333fb5f500e39d28ff21a17a2131f19ac30f63d7187e3903cde0bf6c7dca342f1c71982d074cb1dc38301a88

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
                                                                                                                                  Filesize

                                                                                                                                  1024KB

                                                                                                                                  MD5

                                                                                                                                  5b570e9cb9a51d33db8a681210ded73a

                                                                                                                                  SHA1

                                                                                                                                  a117eb7347ee76e609b8d4c3383c498d5f86cf5e

                                                                                                                                  SHA256

                                                                                                                                  d53b2cd27fb83d0a913dc9b78c3c9af503d67f21b9e6b8b668e922c48a904e14

                                                                                                                                  SHA512

                                                                                                                                  519510b9df1dccf27a382984f39edf660951a3653274514e0a33eeeef2b074c25a6a65cb9bee04dd0a07b79d0adcc3e03aad48db00d2f10bd3a59ed56484f45a

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  d192f7c343602d02e3e020807707006e

                                                                                                                                  SHA1

                                                                                                                                  82259c6cb5b1f31cc2079a083bc93c726bfc4fbf

                                                                                                                                  SHA256

                                                                                                                                  bb4d233c90bdbee6ef83e40bff1149ea884efa790b3bef496164df6f90297c48

                                                                                                                                  SHA512

                                                                                                                                  aec90cf52646b5b0ef00ceb2a8d739befe456d08551c031e8dec6e1f549a6535c1870adb62eec0a292787ae6a7876388dd1b2c884cba8cc6e2d7993790102f43

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  f732bf1006b6529cffba2b9f50c4b07f

                                                                                                                                  SHA1

                                                                                                                                  d3e8d4af812bbc4f4013c53c4ffab992d1d714e3

                                                                                                                                  SHA256

                                                                                                                                  77739084a27cb320f208ac1927d3d9c3cac42748dbdf6229684ef18352d95067

                                                                                                                                  SHA512

                                                                                                                                  064d56217aeb2980a3bfaa1e252404613624d600c3a08b5cf0adcb259596a1c60ee903fdc2650972785e5ae9b7b51890ded01ec4da7b4de94ebda08aeaf662df

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  fc94fe7bd3975e75cefad79f5908f7b3

                                                                                                                                  SHA1

                                                                                                                                  78e7da8d08e8898e956521d3b1babbf6524e1dca

                                                                                                                                  SHA256

                                                                                                                                  ee1ed3b49720b22d5fda63d3c46d62a96ca8838c76ab2d2f580b1e7745521aa5

                                                                                                                                  SHA512

                                                                                                                                  4ceaf9021b30734f4ce8b4d4a057539472e68c0add199cf9c3d1c1c95320da3884caf46943fc9f7281607ab7fa6476027860ebed8bbaa9c44b3f4056b5e074d3

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                                                  Filesize

                                                                                                                                  7KB

                                                                                                                                  MD5

                                                                                                                                  625aeb0cc04ccdc849ee752bc6029fb4

                                                                                                                                  SHA1

                                                                                                                                  cc4fe622784f1538f1c2581421c0007310d9ed0a

                                                                                                                                  SHA256

                                                                                                                                  bdee55d37993d6e5bbe80c092bd3741155e1fc28f7b779d69b9fb88a6ad90241

                                                                                                                                  SHA512

                                                                                                                                  786c4c82bfcd26292651d2d85155fe0f9bee85d9461f7d9cbdab27409b199b3ed3410d29b7aac41a74727b4b044ab49e870ffa23f3e705af3c28443984e75fda

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                                                  Filesize

                                                                                                                                  7KB

                                                                                                                                  MD5

                                                                                                                                  2fc152502892211a3f66e39e96e2217b

                                                                                                                                  SHA1

                                                                                                                                  c32dafbd78e1661808ab3f03b010d00cc041d3a2

                                                                                                                                  SHA256

                                                                                                                                  8a2b6ddf80bbeb19a420e48c9f9b95ab791be59c67a4a27d929f43738d3bc240

                                                                                                                                  SHA512

                                                                                                                                  e8a0d98411e6c2d0ff1b2603008194597924349e2704cd8b846a5ff5799404bd7574ea9b3a1f927ed55ad42e4fa18a73c581eb4dcdf9412a25936a8bd864615c

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
                                                                                                                                  Filesize

                                                                                                                                  14KB

                                                                                                                                  MD5

                                                                                                                                  e678da4e0ed73b4d45686e586fe04eb6

                                                                                                                                  SHA1

                                                                                                                                  841993ae263464db0f51e4ff04235620c935a243

                                                                                                                                  SHA256

                                                                                                                                  7d98d8e1d37a49c7a153a53e0d390f1a7abc830c39256520648ae5425a715388

                                                                                                                                  SHA512

                                                                                                                                  513656507624a049319026dc9c14ce62217a787dac8532299bc622fc3110d114f72063b6f4c4fc1217af718d9d64a59c98613a18d81b9f4841c99c0656b313b5

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  379523b9f5d5b954e719b664846dbf8f

                                                                                                                                  SHA1

                                                                                                                                  930823ec80b85edd22baf555cad21cdf48f066aa

                                                                                                                                  SHA256

                                                                                                                                  3c9002caedf0c007134a7e632c72588945a4892b6d7ad3977224a6a5a7457bf4

                                                                                                                                  SHA512

                                                                                                                                  eca44de86bbc3309fa6eab400154d123dcd97dc1db79554ce58ce2426854197e2365f5eee42bac6e6e9455561b206f592e159ef82faf229212864894e6021e98

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  5f243bf7cc0a348b6d31460a91173e71

                                                                                                                                  SHA1

                                                                                                                                  5696b34625f027ec01765fc2be49efcfd882bf8e

                                                                                                                                  SHA256

                                                                                                                                  1b1aed169f2acfae4cf230701bda91229cb582ff2ce29a413c5b8fe3b890d289

                                                                                                                                  SHA512

                                                                                                                                  9e08dfbbf20668b86df696a0d5969e04e6ee4a67e997ff392099bc7ff184b1b8965502215744be7fe423668b69099242bba54df3f0bfe4e70acdc7cad8195b02

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db
                                                                                                                                  Filesize

                                                                                                                                  24B

                                                                                                                                  MD5

                                                                                                                                  db7c049e5e4e336d76d5a744c28c54c8

                                                                                                                                  SHA1

                                                                                                                                  a4db9c8586b9e4fa24416eb0d00f06a9ebd16b02

                                                                                                                                  SHA256

                                                                                                                                  e8830e7ac4088cf3dd464caec33a0035d966a7de5ae4efc3580d59a41916ff7b

                                                                                                                                  SHA512

                                                                                                                                  b614037fb1c7d19d704bf15f355672114d25080223e7ee4424ad2cb7b89782219e7877b373bbc7fa44f3ad8df8a27eef4e8ccc765d44ec02a61e3b7fae88ae69

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LLDJA3WI\microsoft.windows[1].xml
                                                                                                                                  Filesize

                                                                                                                                  97B

                                                                                                                                  MD5

                                                                                                                                  73df3670a3a3f1489771ec3278819ed3

                                                                                                                                  SHA1

                                                                                                                                  15745fc2411f78ebfcd6c5bc2ac91e1d3f15747d

                                                                                                                                  SHA256

                                                                                                                                  870bcd8c5717a06eafb69a0e5f8704037aca21e2c56ed12890ea41041ba3141f

                                                                                                                                  SHA512

                                                                                                                                  dc94ce04d83f6ec2493fc48c81d2e7b60a0ce9da628fff30041414ee5356d6e924658b22fbdbfd61bcae379386b7f597aaafc3180b67b5e574c584e95732c6a5

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  6d004bd43c5298557e3c265263880c47

                                                                                                                                  SHA1

                                                                                                                                  94af492a44d42ca7290c57a4ca370287fca17c43

                                                                                                                                  SHA256

                                                                                                                                  ad8deaaf246ffe41bd900e80c11cdd2dd0fd12e2fc3744385365a1105a7413eb

                                                                                                                                  SHA512

                                                                                                                                  6bcf05c7909531067f40bf44bfdb6e7132f66093bea2fcc22a4ceea8e1152db702755a79235293ca58b7021b791025c7e4a857675f6de8d58f88d5d33f18f432

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133752187338107237.txt
                                                                                                                                  Filesize

                                                                                                                                  2KB

                                                                                                                                  MD5

                                                                                                                                  ecaea544af9da1114077b951d8cb520d

                                                                                                                                  SHA1

                                                                                                                                  5820b2d71e7b2543cf1804eb91716c4e9f732fde

                                                                                                                                  SHA256

                                                                                                                                  9117b26ab2c8fdbb8223fe1f2d1770c50a6cf0d9849a5849d6aebcbe90435be6

                                                                                                                                  SHA512

                                                                                                                                  dc7bedbc581818011aa2d313429f234b12e5e9cf320b02b8d7ceeaf9cdc1c921ffc51af7f4080b02740f2d2146fbb006ccbf37cdcba3e3a10009142daffdb919

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  57fabde62c4e877249c09f43f901ba97

                                                                                                                                  SHA1

                                                                                                                                  60af379340f71b3f3467840bad4b597ef4aa6009

                                                                                                                                  SHA256

                                                                                                                                  ebc0df37d704d2e80aa91af898edc0b7ca9055f8bbfd9966e5edd51760ef144d

                                                                                                                                  SHA512

                                                                                                                                  ca19a32f66969b92f9de5da79a8424f76b71495b0e0f01f2f6d9bccd7874c1caf89f1bdf7e6dbefbae7acbd03c769c517220ec5ebb470ced38eefa63ae337a83

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  5575296714b58edbd5f53f22261345a9

                                                                                                                                  SHA1

                                                                                                                                  e8a3d378f76a99e267dd0ab92e5359bd2e223c35

                                                                                                                                  SHA256

                                                                                                                                  8c4bdbb7bf83e8e592094fdb6eb6a1c5a6d086818babfa61c76099f40d0daada

                                                                                                                                  SHA512

                                                                                                                                  4e0295427b5f2d7a35ec2d3370592196ff8a9506cdcd7e592e7d0f2cebd70662f6a6bb6d5054623e52acca7e4c3cd59f835af432c381aa0e7f7c6e63cb1f8a36

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                                                                                                  Filesize

                                                                                                                                  5KB

                                                                                                                                  MD5

                                                                                                                                  fcc7dfcc24aade6ebc1527e867325f6e

                                                                                                                                  SHA1

                                                                                                                                  7330c5b8055a32b35321332b4e6798e9a8bc3fc0

                                                                                                                                  SHA256

                                                                                                                                  dc26d7ffc507bde0bcbfc9822739bb5063910064a7ed8e91a63e2c6dccc0ac4a

                                                                                                                                  SHA512

                                                                                                                                  04a44f135b0fbd9a4be7f5dc11e57554931083b427b55b442792838b510141fc781b8d4b6a030627f3bc8f867e3eacb8ace7cef8e71cb96e06f592e34a7a84b6

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
                                                                                                                                  Filesize

                                                                                                                                  5KB

                                                                                                                                  MD5

                                                                                                                                  32c5caece42c6246b32d00e17684fbbf

                                                                                                                                  SHA1

                                                                                                                                  1254b78da2af2e0cdfc0489cf1e7c0d960ad3730

                                                                                                                                  SHA256

                                                                                                                                  768e489f0c004092840de506a696b9d980206376c8bbc2e7c86230baea44c84b

                                                                                                                                  SHA512

                                                                                                                                  e05b0d3eb375801f987e9df053e435f2fda97a2c51898e89bace0c8f1d4885a0a334614c742ad6176cf0a3973b21992b7960117621113e13e05c35344ea73fe0

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Build.exe
                                                                                                                                  Filesize

                                                                                                                                  160KB

                                                                                                                                  MD5

                                                                                                                                  4575a2a5b016a30f3272523c246adb4a

                                                                                                                                  SHA1

                                                                                                                                  27b4b10f8d97d58936b405d50949c5e34ae106fb

                                                                                                                                  SHA256

                                                                                                                                  787b16fbf8059055342c0669aefba7173a27a844fb9da936725f65516ce34a6b

                                                                                                                                  SHA512

                                                                                                                                  08d1a0dc25aaa0f4e0e2a003961364267ee2c2569223fb825e22e45a2e044b23606722c6dc4bc516aa488f9c175875540fa0e337b39f93950b333e1fa47b0cff

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3kyg3kd.wcy.ps1
                                                                                                                                  Filesize

                                                                                                                                  60B

                                                                                                                                  MD5

                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                  SHA1

                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                  SHA256

                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                  SHA512

                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  928c9edee0e5c4df0a681d79119aae6d

                                                                                                                                  SHA1

                                                                                                                                  2544b5bc452e2b9484b3e324e82713458f8de12a

                                                                                                                                  SHA256

                                                                                                                                  79fd84b161b13e6ba37e3254192e96d0466b223b507df8a5fa629f7452dd9106

                                                                                                                                  SHA512

                                                                                                                                  74283809e69ef4cfa30ef99accd088a67c2429c0cd883d2913b9ace270b45dcca91290250b8530ad62e131b667b337dfe89c8edd21ea9d540563b72700c68ca8

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  582198050ef73a6bde198761d0c8c925

                                                                                                                                  SHA1

                                                                                                                                  475e2c7d86a1a63c50434e09d26eeab6c7073de2

                                                                                                                                  SHA256

                                                                                                                                  79c58fc8dc6cb92f465e7915f6f724c4963cde8786eb69ddaa71da9c3b2301d3

                                                                                                                                  SHA512

                                                                                                                                  4d5fab2e28a037c627e55365e86b7f4e90b300213779b7c40ac92195f6cfbd40c87b40c32a6b2723f1052f515143def6b80b114697da2bd199b522507935baa4

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  9404df9b79dcc334f9745955d48ed7bf

                                                                                                                                  SHA1

                                                                                                                                  130f31043aa623fcc753ecb30f1f52fe8bd45c0e

                                                                                                                                  SHA256

                                                                                                                                  913d072a87a2104772846ba31d7eda52c4e4c61ecbe1d63b5e311f2759660831

                                                                                                                                  SHA512

                                                                                                                                  b80393ed57d1bc286da2efd81fa67b9f47649c54486fb3d7314719c467c6b018975f887c650d75ed4a23b9d111b47e1bcc6d5ee1762b4b7bb75f668c055f92b2

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  00777ab1a1062efe3090c49b1980a81b

                                                                                                                                  SHA1

                                                                                                                                  442a65817102f5de504307f4b76501507266f26b

                                                                                                                                  SHA256

                                                                                                                                  117adc459a102c26c295eebecf6cf4cba8d82397c7bdf8e15ceb06aa775f7af1

                                                                                                                                  SHA512

                                                                                                                                  23b2ff867b9fb906081b9878d0ae2ca97f91a12246da2ea75ce1fd695830406e006878523ff2f1862b70d95c19ea32d87cd336f5bb48580686f2072b5eadedc4

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
                                                                                                                                  Filesize

                                                                                                                                  204KB

                                                                                                                                  MD5

                                                                                                                                  2d94685fe0c23029a3622f6e035a88c1

                                                                                                                                  SHA1

                                                                                                                                  dd9fc80279ccb4204fad9453eb639ed3284182aa

                                                                                                                                  SHA256

                                                                                                                                  a8300625818fbb9167181835e8d31df730b24a5c6fc79be05b69e536010be58e

                                                                                                                                  SHA512

                                                                                                                                  45a2b88a80441bcd5cfa9204891adff188b053cd75cfc15a564518818f9dbeec9dd0d72bd591d08a86fa5de81372bbf02ae3f5a5873ee13079ab0b637671b8c5

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                                                                                                                  Filesize

                                                                                                                                  478KB

                                                                                                                                  MD5

                                                                                                                                  1575ea1792ec080b7825066f02a5dddc

                                                                                                                                  SHA1

                                                                                                                                  e647358f934f78866d1f97079f66c46448efd2f0

                                                                                                                                  SHA256

                                                                                                                                  dc276b7ca4a980cf487b73b4ef9c40fb93f1b00b5c757a726057ab21a0372ecf

                                                                                                                                  SHA512

                                                                                                                                  1e492379bea54ccc2db48b1bd2ded0d77470ae960a6f78e681647526b29152a4a1ca27acca9c7181477af3c19a4e4eac0182a259fd32893b33b33f40fe14e120

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.MSIL.Blocker.gen-63f8cd6de7a667edb95fe51990274dd30a774905401b8642e071049b1d477a7e.exe
                                                                                                                                  Filesize

                                                                                                                                  1.0MB

                                                                                                                                  MD5

                                                                                                                                  325faa4c5c4828638678a435803f7245

                                                                                                                                  SHA1

                                                                                                                                  fd7d12eae0145f9fc9973befa81d706c2c8faf98

                                                                                                                                  SHA256

                                                                                                                                  63f8cd6de7a667edb95fe51990274dd30a774905401b8642e071049b1d477a7e

                                                                                                                                  SHA512

                                                                                                                                  3ed7bbf727404853325590e41e1114c2cab4978bae1d7f6e7455cae63412fed87598c2880697506f54147bac901ee0254719ef6d44d0ea86dbfca0a7a3bf920a

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.MSIL.Foreign.gen-ff4c5f6a1a5b68b956970751d56ee7905ec48ad39cc05416ee8ee958ecd0c40e.exe
                                                                                                                                  Filesize

                                                                                                                                  9.0MB

                                                                                                                                  MD5

                                                                                                                                  2eb4469c76f5230c66626a6918c7664f

                                                                                                                                  SHA1

                                                                                                                                  6aedaf0ad86c7e45f19ff7a1ad1876bd18ff8b90

                                                                                                                                  SHA256

                                                                                                                                  ff4c5f6a1a5b68b956970751d56ee7905ec48ad39cc05416ee8ee958ecd0c40e

                                                                                                                                  SHA512

                                                                                                                                  723c8e35a2395b13da593eee13b42970b81429849e3b8e484767a2c5adcfe00d11cd78f1713e52e3f137f1df4cb3c9ab6660dc0cb89772690dace5a1ad740fbf

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.MSIL.Gen.gen-937aa346ee2e2e9d234c52d278bd2d53cd7e1078aaf3bdb6654dcdf08c924e19.exe
                                                                                                                                  Filesize

                                                                                                                                  408KB

                                                                                                                                  MD5

                                                                                                                                  c0501b92dd5b48899061747913560e08

                                                                                                                                  SHA1

                                                                                                                                  566af1bd7a02c0d725d62c503f5816a24b987a24

                                                                                                                                  SHA256

                                                                                                                                  937aa346ee2e2e9d234c52d278bd2d53cd7e1078aaf3bdb6654dcdf08c924e19

                                                                                                                                  SHA512

                                                                                                                                  d627bbf8028f6252b89e05a41edb98ddce9872ddfe26392d1e9d2b5c664f0ce27d54b6b793e016b7f25f65bf8fd5fc7d023581dc801d472d79b512c1170bee74

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Agent.gen-434a7f3d787dab3c5e3daa30c4205ee503f1442ef64d88f5af5dd7cfca2fdec0.exe
                                                                                                                                  Filesize

                                                                                                                                  1.0MB

                                                                                                                                  MD5

                                                                                                                                  acf6ba17e633617868bf6550972815f6

                                                                                                                                  SHA1

                                                                                                                                  654b94cdd7aff6288e604d3a34793a5f76bb48d0

                                                                                                                                  SHA256

                                                                                                                                  434a7f3d787dab3c5e3daa30c4205ee503f1442ef64d88f5af5dd7cfca2fdec0

                                                                                                                                  SHA512

                                                                                                                                  9171050dd83925b2d7040e167545f003ab3051a936b0e683637c4e1937142d291ecd5dda13cd7d4b4a182126596c224aa0eb78233a83a4a89666e025eec098f2

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Blocker.gen-defa67780ca672a33df0f9b81634a2dd03877e1761ded62985800dcd24fbbec6.exe
                                                                                                                                  Filesize

                                                                                                                                  298KB

                                                                                                                                  MD5

                                                                                                                                  fcf045b0b34b9780b99aba5669f9d0a9

                                                                                                                                  SHA1

                                                                                                                                  5e18b6881f4c4aefe1c8ebc9ddf76ceb584084ca

                                                                                                                                  SHA256

                                                                                                                                  defa67780ca672a33df0f9b81634a2dd03877e1761ded62985800dcd24fbbec6

                                                                                                                                  SHA512

                                                                                                                                  9139f0a3120fd57afaa23ff1dd36582d4bb88760213a95b2277ac3d5167aa72a38a708d295aef7a115bf02d66dc7626ce3b6f68341fd6c3197a569f2edebbf19

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Crypren.vho-372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d.exe
                                                                                                                                  Filesize

                                                                                                                                  222KB

                                                                                                                                  MD5

                                                                                                                                  765e03856ba709f12220f31638ae237c

                                                                                                                                  SHA1

                                                                                                                                  6283d47cc404e866c7f68a0cebc71527ef31aecb

                                                                                                                                  SHA256

                                                                                                                                  372dc363e3dcc4399b84f1c2e594e698bc1e65b9baf853dc1209ddaad52dde9d

                                                                                                                                  SHA512

                                                                                                                                  45763abf8a8984117a5351b1d32af3df618d86fba35e8dd74be4c9f4c031c79eb72d423ccbb70287fd8a697b962cebb3164b49889b839ebdbde8eb3f6263be2e

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Gen.gen-de0c5066fdbae982f39d31b0058c568181a6d7e8047daf756080507f8a9af2fa.exe
                                                                                                                                  Filesize

                                                                                                                                  209KB

                                                                                                                                  MD5

                                                                                                                                  6cd4e81f9a7bc69b3daaa886f0b3dba9

                                                                                                                                  SHA1

                                                                                                                                  bfe2e050599b0790a135cf2df1263ff990c26c77

                                                                                                                                  SHA256

                                                                                                                                  de0c5066fdbae982f39d31b0058c568181a6d7e8047daf756080507f8a9af2fa

                                                                                                                                  SHA512

                                                                                                                                  dd355996d447e1f9023d0be43ace9daded41722942447db010fe39ca4746bc645599d38e426d98cadec727f9dd5c0c17b15c46e0d127922693475779b8af466d

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Gen.vho-339a9c6239d8eb3f0225d3165a42222d5a4c74896ae8e8e212a6e44990db8c55.exe
                                                                                                                                  Filesize

                                                                                                                                  85KB

                                                                                                                                  MD5

                                                                                                                                  91ef3f669ffd18c3354659df16261e38

                                                                                                                                  SHA1

                                                                                                                                  48c7f18b8b069515de2c635f349611b37f05c51c

                                                                                                                                  SHA256

                                                                                                                                  339a9c6239d8eb3f0225d3165a42222d5a4c74896ae8e8e212a6e44990db8c55

                                                                                                                                  SHA512

                                                                                                                                  d5d1f355c57465d07acc7b55908c3def24edbbf1c2416cf9ab245c9ed26e1c3763e3f6df8b11e49ca8c4120c574e2d4ad525e1162fc6036c146c24dad32068c0

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-986918f3afe3dddc8a37c2761b27e41f19dd85b2122172a70c2865b21f9689d9.exe
                                                                                                                                  Filesize

                                                                                                                                  889KB

                                                                                                                                  MD5

                                                                                                                                  5968cd34bf0f6c8335698ce8c8c27282

                                                                                                                                  SHA1

                                                                                                                                  1bfaede242a6b3d53eb04e79c6eb1a40506aba4f

                                                                                                                                  SHA256

                                                                                                                                  986918f3afe3dddc8a37c2761b27e41f19dd85b2122172a70c2865b21f9689d9

                                                                                                                                  SHA512

                                                                                                                                  278e98d2e588411f9273fdadb7372edc4c7adadb4a982fd970af5549bdd7e7ed82e216df7c85d6250260c9447e056be9605b8de1b8372ec80c1957ca12b018ce

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\HEUR-Trojan-Ransom.Win32.Shade.vho-a0d4700887c4093807fb98f2dd415aae6d2b81798d322961576ebbd1335365c2.exe
                                                                                                                                  Filesize

                                                                                                                                  312KB

                                                                                                                                  MD5

                                                                                                                                  dc763b751059ce9b868dd74a63f00dcc

                                                                                                                                  SHA1

                                                                                                                                  087fe33af1f1ac0cb4dbaac1b25a25e45bde8f65

                                                                                                                                  SHA256

                                                                                                                                  a0d4700887c4093807fb98f2dd415aae6d2b81798d322961576ebbd1335365c2

                                                                                                                                  SHA512

                                                                                                                                  6e5c5ec73f1ba2a2810610863ddf2ebdeffcaa48fdf9ffe1a9ea9804c936efab1b0485e6f627729aa6c942dfdc185d589781cf4b75202fb4b469263542907180

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\Trojan-Ransom.MSIL.Blocker.bl-269662d5d2d7522fa2b88be8de2a3540e1443fba1a9d6c8139177a3a5a78bd2d.exe
                                                                                                                                  Filesize

                                                                                                                                  632KB

                                                                                                                                  MD5

                                                                                                                                  000e424a6ea3d3cc11a9e504534396b4

                                                                                                                                  SHA1

                                                                                                                                  13e49069cb11bdf810af79505194e3e29be8b156

                                                                                                                                  SHA256

                                                                                                                                  269662d5d2d7522fa2b88be8de2a3540e1443fba1a9d6c8139177a3a5a78bd2d

                                                                                                                                  SHA512

                                                                                                                                  3addb80328ee30eaf3c7552b993965e5062b888aa8e2dcd3ddcbad0cbece8760772134adaab20cffc7919a9bcfe1b677cd6715b9954755ccc9fa37a1111ad2d8

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Bitman.adnq-899aa66611f7a6a058a8ef90aef6e0436d9b0b49a4fb5ede2c3dfe574aa708e7.exe
                                                                                                                                  Filesize

                                                                                                                                  1.7MB

                                                                                                                                  MD5

                                                                                                                                  c21fd0696c8b2c2efd8dca884c6bd07e

                                                                                                                                  SHA1

                                                                                                                                  92660f8af906786be1b7ec7e14a83500ae2d815a

                                                                                                                                  SHA256

                                                                                                                                  899aa66611f7a6a058a8ef90aef6e0436d9b0b49a4fb5ede2c3dfe574aa708e7

                                                                                                                                  SHA512

                                                                                                                                  5de7a95f36faee34f8f458a48edff5ef86a587752388bcec18461a4033445ce1234b4d26f8e6bc46b0dbe994b2f3577e5b9d802d55308cc1a36999d5c2eb1f94

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Bitman.aewz-ef7f38b6083f22d04a2c5787a5d7a784e891d9cc329ed046ad5ad128ca1e5042.exe
                                                                                                                                  Filesize

                                                                                                                                  349KB

                                                                                                                                  MD5

                                                                                                                                  407c72631fff8e2e786e36b5ba6bac84

                                                                                                                                  SHA1

                                                                                                                                  9dcc3b6b9cb4c0d43bc5345fae65779dd75451d7

                                                                                                                                  SHA256

                                                                                                                                  ef7f38b6083f22d04a2c5787a5d7a784e891d9cc329ed046ad5ad128ca1e5042

                                                                                                                                  SHA512

                                                                                                                                  29295f4c0d1cdb7b2ededbac1f8811b7abae7579df29eeb02217b5cad4371f953d097143f3142c50341c4faebaf59c420e8d0f8aa04546ba1524407eb59fabcd

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Blocker.lckf-e710fe80032398181efcc316de4386658013eb2cd544454158b81a022c13460b.exe
                                                                                                                                  Filesize

                                                                                                                                  337KB

                                                                                                                                  MD5

                                                                                                                                  afb863ed2711a16c66312889d12fca7a

                                                                                                                                  SHA1

                                                                                                                                  8958ff08d6dcc858f1a6c8927c8c3280c15c32c3

                                                                                                                                  SHA256

                                                                                                                                  e710fe80032398181efcc316de4386658013eb2cd544454158b81a022c13460b

                                                                                                                                  SHA512

                                                                                                                                  aae186472d52f948a1b63e6fcbd4fb81549f32078df482cc980d8a271278812ece40b291e849ce75d1f06267585d75ec5b045429bf4cd0fbd8a12524ffc58115

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Blocker.mbys-25748e57d896e6abe9949d52c87aaf3d3800e88d2fca9763bf38db8973bc3a2b.exe
                                                                                                                                  Filesize

                                                                                                                                  959KB

                                                                                                                                  MD5

                                                                                                                                  549173de637d4a696f72cd0fdd27e880

                                                                                                                                  SHA1

                                                                                                                                  536fd3d0b5d6253be1117992b252fdb2d0e06687

                                                                                                                                  SHA256

                                                                                                                                  25748e57d896e6abe9949d52c87aaf3d3800e88d2fca9763bf38db8973bc3a2b

                                                                                                                                  SHA512

                                                                                                                                  d95f64ca7fbfc315be078985072627961c919cd09e23e2dcdd737c43b9083decf8d4b635977cfcaee047b6dbd5e3737de136b6a7216d16d5421ce0925b30b97b

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Desktop\00375\Trojan-Ransom.Win32.Crusis.dsz-970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4.exe
                                                                                                                                  Filesize

                                                                                                                                  420KB

                                                                                                                                  MD5

                                                                                                                                  859553e76bcfb7c19bbf1ad1290b360c

                                                                                                                                  SHA1

                                                                                                                                  6a71def09b4b0058ca6f0b077a93c22b4eb63082

                                                                                                                                  SHA256

                                                                                                                                  970959bc3aef1c6198b105a4983599ea566f29ca26f307258f86d0a6585502f4

                                                                                                                                  SHA512

                                                                                                                                  100dc319e1082da1f4a2d779642c785a89b2e00272ee85390c4cdcaa589ed0091eacdda5fc06ac9a87ea025b4fe0be62323ba51bd34b7968d96d8859f0676d2b

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\V49050494020\winsvcin32.exe
                                                                                                                                  Filesize

                                                                                                                                  153KB

                                                                                                                                  MD5

                                                                                                                                  764c5d6888c76e7fe9cce3e3c721e358

                                                                                                                                  SHA1

                                                                                                                                  66779739c200aa159e07b1fbff7d1798d83402b0

                                                                                                                                  SHA256

                                                                                                                                  7042f3f8bfc01f32e2c029eb0c8572d2cc2f7a23cf5bfaec49a4101b9126fe7d

                                                                                                                                  SHA512

                                                                                                                                  ceb86c190875b5de157921baebf3dbc1c0c7ca35bafd733fad354fd9477db5b15958baeb1347f128cb3484b7632f048a0cbd716f34378499539d592be9195861

                                                                                                                                  Download Submit

                                                                                                                                • F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\PKXIUTMLZ-DECRYPT.txt
                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  MD5

                                                                                                                                  ad9da2f4a21f8ca191047404714207a9

                                                                                                                                  SHA1

                                                                                                                                  b66a0550ecc0d9c10a749f0ca2dab1228252e609

                                                                                                                                  SHA256

                                                                                                                                  b668c47b5a4bc0a9f04933a6ffc98c6d5e37c561aba77cbc67d02a998c745edd

                                                                                                                                  SHA512

                                                                                                                                  926f67126c42944c20d15a05c3ac40c3a756797999f84426bb865aceb7eab33f6cbe7d3130adcbad710f7a7aabcf87f9a923e478572f599c1488a0325aed168d

                                                                                                                                  Download Submit

                                                                                                                                • F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini.id-CCDFD7B2.[[email protected]].bot
                                                                                                                                  Filesize

                                                                                                                                  378B

                                                                                                                                  MD5

                                                                                                                                  343425f808a377245025b1315891362d

                                                                                                                                  SHA1

                                                                                                                                  b51d4c5cdbbcf693f6720b467b1ccadbec73a5f6

                                                                                                                                  SHA256

                                                                                                                                  be54854f9eeb0e5deda1e1bd18be7d2bb256ae2df5dd48d9af80cc2717795957

                                                                                                                                  SHA512

                                                                                                                                  5159370b21db24a07025ed8c8fd9cc36c9398a2e922d4b734ace34fb6e8461ff057f495d53bee09a5e8e3ced5ff6374ae80ba26c62ac4e9bbabadb0808896cab

                                                                                                                                  Download Submit

                                                                                                                                • F:\AUTORUN.INF
                                                                                                                                  Filesize

                                                                                                                                  145B

                                                                                                                                  MD5

                                                                                                                                  ca13857b2fd3895a39f09d9dde3cca97

                                                                                                                                  SHA1

                                                                                                                                  8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

                                                                                                                                  SHA256

                                                                                                                                  cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

                                                                                                                                  SHA512

                                                                                                                                  55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

                                                                                                                                  Download Submit

                                                                                                                                • \??\c:\users\admin\appdata\local\temp\rarsfx0\build.exe
                                                                                                                                  Filesize

                                                                                                                                  112KB

                                                                                                                                  MD5

                                                                                                                                  6b1ad940e9f2625966b931ccf5ec0c7c

                                                                                                                                  SHA1

                                                                                                                                  43c7a1b89bfec4f206551014f7c5809f06705e61

                                                                                                                                  SHA256

                                                                                                                                  1dc756e129cf18fc15f8cf285ad72370193273750c5f39b687669c41152925d7

                                                                                                                                  SHA512

                                                                                                                                  a8211320ea41766a6a8cc73382fda007a6277a8e2df08dd59fdcb6710308d46bf25d702307c13f1e12ed3314678f5dd9a02d5c7b369789fe7a86c0cd779901ba

                                                                                                                                  Download Submit

                                                                                                                                • \??\c:\users\admin\desktop\00375\heur-trojan-ransom.win32.gandcrypt.gen-17b284c20aa2bcbce2ad04a9dd72850e37ebc0bfa1510b20ca9e9895bf9c7cdd.exe
                                                                                                                                  Filesize

                                                                                                                                  153KB

                                                                                                                                  MD5

                                                                                                                                  b4133fd2790bbb612c2986e662814c26

                                                                                                                                  SHA1

                                                                                                                                  9657eb2470705910f1c96ebd1d0a81b7f0d9969a

                                                                                                                                  SHA256

                                                                                                                                  17b284c20aa2bcbce2ad04a9dd72850e37ebc0bfa1510b20ca9e9895bf9c7cdd

                                                                                                                                  SHA512

                                                                                                                                  1cebc355b1730f57f608ec86852ba59434769d5fee9855b27b72d26ed7f0c86711bb988d1184c893373774f33521926757c12121fdda1cf23277967ce445dcd4

                                                                                                                                  Download Submit

                                                                                                                                • \??\c:\users\admin\desktop\00375\trojan-ransom.win32.crusis.drr-7b3e28d2f4946196b60ac5feb807984cc6ea82ef7ab535dbc291707c19e8eb69.exe
                                                                                                                                  Filesize

                                                                                                                                  496KB

                                                                                                                                  MD5

                                                                                                                                  d04bd9640cf05c1d8ec150b8ec3dea9d

                                                                                                                                  SHA1

                                                                                                                                  9f1d2b477e072b993144df959e46bff88885d161

                                                                                                                                  SHA256

                                                                                                                                  7b3e28d2f4946196b60ac5feb807984cc6ea82ef7ab535dbc291707c19e8eb69

                                                                                                                                  SHA512

                                                                                                                                  806ccb9ab75e0b0fd41bc6d1b9de3be1e58f75a8af3db1bffbb9c1137a40e49587c6fad8eb8c1dfae89aef5b23a90e2bbadfb02ff9600557e398d67407730542

                                                                                                                                  Download Submit

                                                                                                                                • memory/832-185-0x0000000005920000-0x0000000005976000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  344KB

                                                                                                                                  Download

                                                                                                                                • memory/832-169-0x0000000000CC0000-0x0000000000D28000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  416KB

                                                                                                                                  Download

                                                                                                                                • memory/832-173-0x00000000056E0000-0x0000000005772000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  584KB

                                                                                                                                  Download

                                                                                                                                • memory/832-170-0x00000000055A0000-0x000000000563C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  624KB

                                                                                                                                  Download

                                                                                                                                • memory/832-184-0x0000000005680000-0x000000000568A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  40KB

                                                                                                                                  Download

                                                                                                                                • memory/1240-5313-0x0000000000400000-0x0000000000528000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.2MB

                                                                                                                                  Download

                                                                                                                                • memory/1528-183-0x00000000053A0000-0x00000000053BC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  112KB

                                                                                                                                  Download

                                                                                                                                • memory/1528-182-0x0000000005370000-0x0000000005394000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  144KB

                                                                                                                                  Download

                                                                                                                                • memory/1528-178-0x0000000000B10000-0x0000000000B60000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  320KB

                                                                                                                                  Download

                                                                                                                                • memory/1600-5266-0x0000000006500000-0x0000000006520000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                  Download

                                                                                                                                • memory/1600-168-0x0000000000DF0000-0x0000000000E5A000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  424KB

                                                                                                                                  Download

                                                                                                                                • memory/1600-171-0x0000000005CB0000-0x0000000006254000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  5.6MB

                                                                                                                                  Download

                                                                                                                                • memory/1696-638-0x0000000004DE0000-0x0000000004DE6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  24KB

                                                                                                                                  Download

                                                                                                                                • memory/1696-205-0x0000000002690000-0x0000000002696000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  24KB

                                                                                                                                  Download

                                                                                                                                • memory/1696-204-0x0000000000420000-0x0000000000450000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  192KB

                                                                                                                                  Download

                                                                                                                                • memory/1696-215-0x0000000002500000-0x0000000002520000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  128KB

                                                                                                                                  Download

                                                                                                                                • memory/2496-177-0x0000000000400000-0x00000000005F8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  2.0MB

                                                                                                                                  Download

                                                                                                                                • memory/2640-8885-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  476KB

                                                                                                                                  Download

                                                                                                                                • memory/2640-15919-0x0000000000400000-0x0000000000477000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  476KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-116-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-121-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-112-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-111-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-110-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-117-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-122-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-118-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-119-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3936-120-0x0000024F94090000-0x0000024F94091000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  4KB

                                                                                                                                  Download

                                                                                                                                • memory/3960-26443-0x0000000016DC0000-0x0000000016DC6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  24KB

                                                                                                                                  Download

                                                                                                                                • memory/3960-26440-0x0000000018F80000-0x0000000018FB6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  216KB

                                                                                                                                  Download

                                                                                                                                • memory/4976-150-0x0000015E35AB0000-0x0000015E35B26000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  472KB

                                                                                                                                  Download

                                                                                                                                • memory/4976-152-0x0000015E34B40000-0x0000015E34B5E000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  120KB

                                                                                                                                  Download

                                                                                                                                • memory/4976-144-0x0000015E34A50000-0x0000015E34A72000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  136KB

                                                                                                                                  Download

                                                                                                                                • memory/4976-149-0x0000015E34AD0000-0x0000015E34B14000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  272KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10483-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10471-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-8907-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.9MB

                                                                                                                                  Download

                                                                                                                                • memory/6704-9188-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.9MB

                                                                                                                                  Download

                                                                                                                                • memory/6704-20450-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.9MB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10232-0x0000000002860000-0x00000000028A8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  288KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10503-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-17217-0x0000000000400000-0x00000000005E4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  1.9MB

                                                                                                                                  Download

                                                                                                                                • memory/6704-14794-0x0000000005990000-0x00000000059A4000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  80KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10237-0x0000000004D90000-0x0000000004DD8000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  288KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10470-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10473-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10477-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10479-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10507-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10486-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10489-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10505-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10475-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10481-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10487-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10491-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10493-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10495-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10497-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10499-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/6704-10501-0x0000000004D90000-0x0000000004DD0000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  256KB

                                                                                                                                  Download

                                                                                                                                • memory/7780-8906-0x0000000000400000-0x0000000000498000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  608KB

                                                                                                                                  Download

                                                                                                                                • memory/9880-26444-0x0000000000400000-0x0000000000481000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  516KB

                                                                                                                                  Download

                                                                                                                                • memory/9880-17216-0x0000000000400000-0x0000000000481000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  516KB

                                                                                                                                  Download

                                                                                                                                • memory/10916-52355-0x0000000018D40000-0x0000000018DA6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  408KB

                                                                                                                                  Download

                                                                                                                                • memory/11060-19134-0x0000000000400000-0x00000000004F6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  984KB

                                                                                                                                  Download

                                                                                                                                • memory/11060-23473-0x0000000000400000-0x00000000004F6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  984KB

                                                                                                                                  Download

                                                                                                                                • memory/11060-26343-0x0000000000400000-0x00000000004F6000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  984KB

                                                                                                                                  Download