darkcomet | a8ff58bbe5af1f5c5385e68c117cdf123a37a63b9fe5b052a241a1362acc89b1

Analysis

max time kernel
66s
max time network
175s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-11-2024 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RNSM00359.7z
Size

7.2MB
MD5

0f92fb45fb5c5f8e6549365f4983306a
SHA1

e5a2b0085cbe8597ef0600935c50ac612cc60090
SHA256

a8ff58bbe5af1f5c5385e68c117cdf123a37a63b9fe5b052a241a1362acc89b1
SHA512

4fcd433a5aabaf037d14c2162796212fe3aadc2e18166bbf060bb197df26330a304b0c0fe69ed4a27cf5485024a4f5f35cea95ff093477cbdace140f4df4126c
SSDEEP

196608:Nh3wKMzBwYMPxmM1NaLQG4Vm7Tz29eNNFNgaIiEZX:T3w3zBj1QG4I7+uFNciEN

Malware Config

Extracted

Path

C:\Users\Public\Videos\how_to_back_files.html

Ransom Note

<html> <style type="text/css"> body { background-color: #404040; } { margin: 0; padding: 0; } h1, h3{ text-align: center; text-transform: uppercase; font-weight: normal; } /*---*/ .tabs1{ width: 800px; display: block; margin: auto; position: relative; } .tabs1 .head{ text-align: center; float: top; text-transform: uppercase; font-weight: normal; display: block; padding: 15px; color: #000000; background: #4A83FD; } .tabs1 .identi { margin-left: 15px; line-height: 13px; font-size: 13px; text-align: center; float: top; display: block; padding: 15px; background: #303030; color: #DFDFDF; } /*---*/ .tabs{ width: 800px; display: block; margin: auto; position: relative; } .tabs .tab{ float: left; display: block; } .tabs .tab>input[type="radio"] { position: absolute; top: -9999px; left: -9999px; } .tabs .tab>label { display: block; padding: 6px 21px; font-size: 18x; text-transform: uppercase; cursor: pointer; position: relative; color: #FFF; background: #4A83FD; } .tabs .content { z-index: 0;/* or display: none; */ overflow: hidden; width: 800px; /*padding: 25px;*/ position: absolute; top: 32px; left: 0; background: #303030; color: #DFDFDF; opacity:0; transition: opacity 400ms ease-out; } .tabs .content .text{ width: 700px; padding: 25px; } .tabs>.tab>[id^="tab"]:checked + label { top: 0; background: #303030; color: #F5F5F5; } .tabs>.tab>[id^="tab"]:checked ~ [id^="tab-content"] { z-index: 1;/* or display: block; */ opacity: 1; transition: opacity 400ms ease-out; } </style> <head> <meta charset="utf-8"> <title>HOW TO DECRYPT YOUR FILES</title> </head> <body> <div class="tabs1"> <div class="head" ><h3>Your personal ID</h3></div> <div class="identi"> <pre>��50 A3 D7 DE 49 07 72 3E 16 27 10 80 84 91 08 F7 49 16 66 4D EF 08 8F 2E 1B 27 32 62 2D E8 09 50 DD 95 CC C9 3B 5F 31 B6 E0 01 85 48 38 3F EC 49 EE B8 7D CE 62 EF CF D6 02 03 91 53 5A ED 69 95 EA 3E 24 0C 9C 00 DF 31 D5 A4 31 B2 5C 6F DF 39 02 2B 40 40 D8 31 4F 16 62 EA C1 0F 4B C2 35 D6 BC 4A D0 F7 07 B9 D3 E0 59 90 C2 6E 4A 4E F1 D0 68 B9 80 89 DF 00 A9 55 74 5D A3 B6 94 9B EA 44 D6 41 0A 35 5A 55 EE E2 FE 88 3B 9C 77 00 0F 93 7D FF 0A FE 49 22 5D E2 3B C3 EE 32 7A 44 51 D3 03 C2 A1 23 16 84 9B 45 C2 45 AD 46 B2 2C 7E AA AD 80 19 8D EB 0E 51 FD 21 65 86 01 CA 0D 7A 10 31 2A 62 CA D5 CC D1 0F 25 D2 19 ED 5F F5 32 3C BC 7B 61 0A CA 88 A8 4E E4 38 1C CD 55 99 CC 92 DD F2 02 55 E4 A9 32 11 A6 02 E8 DC EF F4 84 B8 B6 4E BF 98 89 71 1C 0A 0B 24 8C 59 18 09 CF 16 </pre> </div> </div>  <div class="tabs">  <div class="tab"> <input type="radio" name="tabs" checked="checked" id="tab1" /> <label for="tab1">English</label> <div id="tab-content1" class="content"> <h1>☠ Your files are encrypted! ☠</h1> <hr/> <h3>All your important data has been encrypted.</h3> <br/> <div class="text">  To recover data you need decryptor.</br> To get the decryptor you should:</br> <p>Send 1 test image or text file <span> [email protected]</span>.</br> In the letter include your personal ID (look at the beginning of this document).</p> We will give you the decrypted file and assign the price for decryption all files</p> After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder.</br> <center>Attention!</center></br> <ul> <li>Only [email protected] can decrypt your files</li> <li>Do not trust anyone [email protected]</li> <li>Reserv email:[email protected]</li> <li>Attempts to self-decrypting files will result in the loss of your data</li> <li>Decoders other users are not compatible with your data, because each user's unique encryption key</li> </ul>  </div> </div> </div>  </ul>  </div> </div>  </div> </div> </body> </html> ��

Emails

[email protected]</span>.</br>

[email protected]

[email protected]</li>

email:[email protected]</li>

Extracted

Path

C:\Users\Admin\Saved Games\!HELP_SOS.hta

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <HTA:APPLICATION ID='App' APPLICATIONNAME="Decryption Instructions" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; line-height: 1.2; } h2 { color: #555; text-align: center; line-height: 1.2; } ol li { padding-bottom: 13pt; } .container { background-color: #EEE; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .filecontainer{ padding: 5% 10%; display: none; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .key{ background-color: #A1D490; border: 1px solid #506A48; display: block; text-align: center; margin: 0.5em 0; padding: 1em 1.5em; word-wrap: break-word; } .keys{ margin: 3em 0; } .filename{ border: 3px solid #AAA; display: block; text-align: center; margin: 0.5em 0em; padding: 1em 1.5em; background-color: #DCC; } .us{ text-decoration: strong; color: #333; } .info{ background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text{ text-align: justify; } #file{ background-color: #FCC; } .lsb{ display: none; margin: 3%; text-align: center; } .ls{ border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 0.2em 0.1em; line-height: 2em; display: inline-block; } .ls:hover{ background-color: #D0D0D0; } .l{ display:none; } .lu{ display:none; } </style> <script language="vbscript"> Function GetCmd GetCmd = App.commandLine End Function </script> <script language="javascript"> function openlink(url){ new ActiveXObject("WScript.Shell").Run(url); return false; } function aIndexOf(arr, v){ for(var i = 0; i < arr.length; i++) if(arr[i] == v) return i; return -1; } function tweakClass(cl, f){ var els; if(document.getElementByClassName != null){ els = document.getElementsByClassName(cl); } else{ els = []; var tmp = document.getElementsByTagName('*'); for (var i = 0; i < tmp.length; i++){ var c = tmp[i].className; if( (c == cl) || ((c.indexOf(cl) != 1) && ((' '+c+' ').indexOf(' '+cl+' ') != -1)) ) els.push(tmp[i]); } } for(var i = 0; i < els.length; i++) f(els[i]); } function show(el){ el.style.display = 'block'; } function hide(el){ el.style.display = 'none'; } var langs = ["en","de","it","fr","es","no","pt","nl","kr","ms","zh","tr","vi","hi","jv","fa","ar"]; function setLang(lang){ if(aIndexOf(langs, lang) == -1) lang = langs[0]; for(var i = 0; i < langs.length; i++){ var clang = langs[i]; tweakClass('l-'+clang, function(el){ el.style.display = (clang == lang) ? 'block' : 'none'; }); tweakClass('ls-'+clang, function(el){ el.style.backgroundColor = (clang == lang) ? '#BBB' : ''; }); } } function newXHR() { if (window.XMLHttpRequest) return new window.XMLHttpRequest; try { return new ActiveXObject("MSXML2.XMLHTTP.3.0"); } catch(error) { return null; } } function getPage(url, cb) { try{ var xhr = newXHR(); if(!xhr) return cb('no xhr'); xhr.onreadystatechange = function() { if(xhr.readyState != 4) return; if(xhr.status != 200 || !xhr.responseText) return cb(xhr.status) cb(null, xhr.responseText); }; xhr.open("GET", url+((url.indexOf('?') == -1) ? "?" : "&") + "_=" + new Date().getTime(), true); xhr.send(); } catch(e){ cb(e); } } function decodeTxString(hex){ var m = '0123456789abcdef'; var s = ''; var c = 0xAA; hex = hex.toLowerCase(); for(var i = 0; i < hex.length; i+=2){ var a = m.indexOf(hex.charAt(i)); var b = m.indexOf(hex.charAt(i+1)); if(a == -1 || b == -1) throw hex[i]+hex[i+1]+' '+a+' '+b; s+= String.fromCharCode(c = (c ^ ((a << 4) | b))); } return s; } var OR = 'OP_RE'+'TURN '; var sources = [ {bp:'btc.b'+'lockr.i'+'o/api/v1/', txp:'tx/i'+'nfo/', adp:'add'+'ress/txs/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = 0; i < json.data.txs.length - 1; i++) res.push(json.data.txs[i].tx); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.vouts; for(var i = 0; i < os.length; i++) if(os[i].extras.asm.indexOf(OR) == 0) return decodeTxString(os[i].extras.asm.substr(10)); return null; } }, {bp:'ch'+'ain.s'+'o/api/v2/', txp:'get_t'+'x_out'+'puts/btc/', adp:'get_tx_uns'+'pent/btc/', ptxs: function(json){ if(json.status != 'success') return null; var res = []; for(var i = json.data.txs.length - 1; i >= 0; i--) res.push(json.data.txs[i].txid); return res; }, ptx: function(json){ if(json.status != 'success') return null; var os = json.data.outputs; for(var i = 0; i < os.length; i++) if(os[i].script.indexOf(OR) == 0) return decodeTxString(os[i].script.substr(10)); return null; } }, {bp:'bit'+'aps.co'+'m/api/', txp:'trans'+'action/', adp:'ad'+'dress/tra'+'nsactions/', adpb:'/0/sen'+'t/all', ptxs: function(json){ var res = []; for(var i = 0; i < json.length; i++) res.push(json[i][1]); return res; }, ptx: function(json){ var os = json.output; for(var i = 0; i < os.length; i++) if(os[i].script.asm.indexOf(OR) == 0) return decodeTxString(os[i].script.asm.substr(10)); return null; } }, {bp:'api.b'+'lockcyp'+'her.com/v1/b'+'tc/main/', txp:'txs/', adp:'addrs/', ptxs: function(json){ var res = []; var m = {}; for(var i = 0; i < json.txrefs.length; i++){ var tx = json.txrefs[i].tx_hash; if(m[tx]) continue; m[tx] = 1; res.push(tx); } return res; }, ptx: function(json){ var os = json.outputs; for(var i = 0; i < os.length; i++) if(os[i].data_hex != null) return decodeTxString(os[i].data_hex); return null; } } ]; function eachUntil(a,f,c){ var i = 0; var n = function(){ if(i >= a.length) return c('f'); f(a[i++], function(err, res){ if(err == null) return c(null, res); n(); }); }; n(); } function getJson(url, cb){ getPage(url, function(err, res){ if(err != null) return cb(err); var json; try{ if(window.JSON && window.JSON.parse){ json = window.JSON.parse(res); } else{ json = eval('('+res+')'); } } catch(e){ cb(e); } cb(null, json); }); } function getDomains(ad, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp; url+= s.adp+ad; if(s.adpb) url+= s.adpb; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptxs(json)); } catch(e){ cb(e); } }); }, function(err, txs){ if(err != null) return cb(err); if(txs.length == 0) return cb('f'); eachUntil(txs, function(tx, cb){ eachUntil(sources, function(s, cb){ var url = 'http://'+s.bp+s.txp+tx; getJson(url, function(err, json){ if(err != null) return cb(err); try{ cb(null, s.ptx(json)); } catch(e){ cb(e); } }); }, function(err, res){ if(err != null) return cb(err); if(res == null) return cb('f'); cb(null, res.split(':')); }); }, cb); }); } function updateLinks(){ tweakClass('lu', hide); tweakClass('lu-updating', show); getDomains('1783wBG'+'sr'+'1zkxenfE'+'ELXA25PLSkL'+'dfJ4B7', function(err, ds){ tweakClass('lu', hide); if(err != null){ tweakClass('lu-error', show); return; } tweakClass('lu-done', show); var html = ''; for(var i = 0; i < ds.length; i++) html+= '<div class="key"><a href="http://7gie6ffnkrjykggd.'+ds[i]+'/login/AZCAY6NouKhAQX_fcSppltUhBenfffskU2VKQdwR7uS3miZqbc3bgljA" onclick="javascript:return openlink(this.href)">http://7gie6ffnkrjykggd.'+ds[i]+'/</a></div>'; tweakClass('links', function(el){ el.innerHTML = html; }); }); return false; } function onPageLoaded(){ try{ tweakClass('lsb', show); }catch(e){} try{ tweakClass('lu-orig', show); }catch(e){} try{ setLang('en'); }catch(e){} try{ var args = GetCmd().match(/"[^"]+"|[^ ]+/g); if(args.length > 1){ var file = args[args.length-1]; if(file.charAt(0) == '"' && file.charAt(file.length-1) == '"') file = file.substr(1, file.length-2); document.getElementById('filename').innerHTML = file; show(document.getElementById('file')); document.title = 'File is encrypted'; } }catch(e){} } </script> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> <span class='ls ls-en' onclick="javascript:return setLang('en')">English</span> <span class='ls ls-de' onclick="javascript:return setLang('de')">Deutsch</span> <span class='ls ls-it' onclick="javascript:return setLang('it')">Italiano</span> <span class='ls ls-fr' onclick="javascript:return setLang('fr')">Français</span> <span class='ls ls-es' onclick="javascript:return setLang('es')">Español</span> <span class='ls ls-no' onclick="javascript:return setLang('no')">Norsk</span> <span class='ls ls-pt' onclick="javascript:return setLang('pt')">Português</span> <span class='ls ls-nl' onclick="javascript:return setLang('nl')">Nederlands</span> <br/><span class='ls ls-kr' onclick="javascript:return setLang('kr')">한국어</span> <span class='ls ls-ms' onclick="javascript:return setLang('ms')">Bahasa Melayu</span> <span class='ls ls-zh' onclick="javascript:return setLang('zh')">中文</span> <span class='ls ls-tr' onclick="javascript:return setLang('tr')">Türkçe</span> <span class='ls ls-vi' onclick="javascript:return setLang('vi')">Tiếng Việt</span> <span class='ls ls-hi' onclick="javascript:return setLang('hi')">हिन्दी</span> <span class='ls ls-jv' onclick="javascript:return setLang('jv')">Basa Jawa</span> <span class='ls ls-fa' onclick="javascript:return setLang('fa')">فارسی</span> <span class='ls ls-ar' onclick="javascript:return setLang('ar')">العربية</span> </div> <div id='file' class='container filecontainer'> <div class='filename'> <div style='float:left; padding:18px 0'><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADEAAABACAYAAACz4p94AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAARCQAAEQkAGJrNK4AAAAB3RJTUUH4QEcFBoaYAOrHQAABThJREFUaN7tmlloXGUUx3/3ziRtTa2xcZ1gtaJFDFjtwSqllaKiiEilKOKDNS2UivXF+qD0QRBRUMQXN/TBBcFifahYFC0urfpghSMqaDSkdQMvojZpIk2zTMaHe776MZ17M6u9ozkwzAwz3/ed/9m+s9yABkhEUFX/+43ATcBy4FxgMdABTAB/Aj8CXwO7VfVdb10AlPy9aqGgTuYDVS3Z56XA48AtdWz1OrBdVQ82AiaoVfJATlWLIrIAeAbYWKciS975LwJ3q+pEJQ03DYRJKVDVGRFZCew0kylnqFaaAULgB+B2Vd1fru3ZKFcDAFS1JCLXA7uBMxs1S29t0fzn5kKhMBBF0WAURYgIURQ1DsIAhKaBVcAbwKk0l0JgGlgIrCkUChpF0U/VAgmrOCBvPrAEeBY4jdZQ3jRyDvCEiJxl2ne+mLowTQs5VZ0yJ95mobMaRx0A3gMGgSPAycCFwHXARQlrfKFeDjwMbG7IsT0zKorIauBtYFGFvxY9s3wZ2Kaqwyn7dgNPpkQ1t9/PwGZV3TNbxErThAOwCOhPADBtexwGNqrqrrR4bxFnBNgkIm8CrwFdCX66BNgA7KlLE2aDeVWdFpHlwPsVfMEBGAXuUtUd1YRGH6CIrLdAESZoYxC4Q1U/r8exQwMQAFdb+CuP7U6LO6oF4MK0d+47ZlpJfJ0HXFsm3OpB2HsPsCZBUtgF9VSZo85KFq7zqnrUTOq3ChYyA3QCq7x1NYFwZnYKsKJCFOqwz59YJKo5VTAmAQ4CuxKiHUCviCyryZzMhIqeOnsSDh8B9qnqTJqU0kKyAT8MfJwiyB5gWa0+ETjGgPOBeQkSGgG+rPdmM99wfjUEHEoA0Q0srRmEaSRv+VFHAogx84lGyO01ChxI+E8XcHq9aUdnhahU8uL471bszJoWVEFHbL8kHhfXCyIE5qesGXX+UW9F5mli0jSbRPMaAdGZ8vtUtSG1ykg1mXIRdzaaxVYjSU7kPmFKaAsq5DW+dBY2WAyV89GV8ntXran4tGfzW4B7K0grAI5WMIF6zAjgD2ATsDXhrPFaGwGZJhE59jrOPMraMIuBK4EzTFqlE8x7YNr6TFUP+dkwQCAiobuhRWQt8DTQl2FlfAtsVdW9DoyviUeA7U1owbSSfL4eU9UHjlVRInI/8FDGATizcvytLhQKQRRFewMRuQJ4y+y/Xcg13IaA/tBCWxftRe5+uwC4NQTWzpabZFgbAFeF1qzKtSEIp40+l+QFtC91hvwHaA7E/xlEKesgZrz6u19VA/eytH64FUGkmSCKtt8XwKWq+opL0GxE8AKwknh6mkkQ03bXRMTT0F9d7m/pfdGy5SHgPtclyRoIZyLfAR95APC6If4A5sOsgfB7UQe88jbJoceI+6+ZdeyOKrWWzxqIwJN+H/F8rlJDzR8XrMiyT1wM3OnX7V797oBeQzxYbF6lJCLTTcpi3fhrBNiiqjsrNCBuIx5Ozs+qT+SJW5vdxHPoS3yHlrjH8nyzAbTCsZ1ZjfPPoMa/DMdpAc0lgHMg2gREqcxPSrSoHdoqx+4Ceu3Sc4x3c/wkNpMgclZT9AIPisjZFl57gUeZZeKThcuuvDhyAppsFfOt9gl/385/w7FLtDmFwF9ebdxO5IQ/HBIPLabaGMT+kLitP9GGAELi4ecHIfAqyc9VZJWc+SvwUi6KorFCofANsA44qQ0AuEfrfgHuUdWB0IqWT4Ebml3At4hywPfAelXd5y47sIfY7XbdQNytuwxYkCHmR4GvgOfcM4fGL38Dzdjo/H/3PFAAAAAASUVORK5CYII=" style='padding:0 7.5px'/></div> <div> <h2 class='l l-en' style='display:block'>The file is encrypted but can be restored</h2><h2 class='l l-de' >Die Datei ist verschlüsselt, aber kann wiederhergestellt werden</h2><h2 class='l l-it' >Il file è crittografato, ma può essere ripristinato</h2><h2 class='l l-fr' >Le fichier est crypté mais peut être restauré</h2><h2 class='l l-es' >El archivo está encriptado pero puede ser restaurado</h2><h2 class='l l-no' >Filen er kryptert men kan bli gjenopprettet</h2><h2 class='l l-pt' >O arquivo está criptografado, mas poderá ser descriptografado</h2><h2 class='l l-nl' >Het bestand is versleuteld maar kan worden hersteld</h2><h2 class='l l-kr' >파일은 암호화되었지만 복원 할 수 있습니다</h2><h2 class='l l-ms' >Fail ini dienkripsikan tetapi boleh dipulih semula.</h2><h2 class='l l-zh' >文件已被加密，但是可以解密</h2><h2 class='l l-tr' >Dosya şifrelenmiş ancak geri yüklenebilir.</h2><h2 class='l l-vi' >Tập tin bị mã hóa nhưng có thể được khôi phục</h2><h2 class='l l-hi' >फाइल एनक्रिप्‍टड हैं लेकिन रिस्‍टोर की जा सकती हैं</h2><h2 class='l l-jv' >File ini dienkripsi tetapi dapat dikembalikan</h2><h2 class='l l-fa' >این فایل رمزگذاری شده است اما می تواند بازیابی شود</h2><h2 class='l l-ar' > الملف مشفر لكن من الممكن إسترجاعه </h2> <p><span id='filename'></span></p> </div> </div> <h2 class='l l-en' style='display:block'>The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware".</h2><h2 class='l l-de' >Die Datei, die Sie öffnen wollten, und andere wichtige Dateien auf ihrem Computer wurden von "SAGE 2.2 Ransomware" verschlüsselt.</h2><h2 class='l l-it' >Il file che hai tentato di aprire e altri file importanti del tuo computer sono stati crittografati da "SAGE 2.2 Ransomware".</h2><h2 class='l l-fr' > Le fichier que vous essayez d’ouvrir et d’autres fichiers importants sur votre ordinateur ont été cryptés par "SAGE 2.2 Ransomware".</h2><h2 class='l l-es' >El archivo que intentó abrir y otros importantes archivos en su computadora fueron encriptados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-no' >Filen du prøvde åpne og andre viktige filer på datamaskinen din ble kryptert av "SAGE 2.2 Ransomware".</h2><h2 class='l l-pt' >O arquivo que você está tentando acessar está criptografado, outros arquivos importantes em seu computador também foram criptografados por "SAGE 2.2 Ransomware".</h2><h2 class='l l-nl' >Het bestand dat je probeert te openen en andere belangrijke bestanden op je computer zijn beveiliged door "SAGE 2.2 Ransomware".</h2><h2 class='l l-kr' >컴퓨터에서 여는 파일 및 기타 중요한 파일은 "SAGE 2.2 Ransomware"에 의해 암호화되었습니다.</h2><h2 class='l l-ms' >Fail yang anda cuba buka dan fail penting yang lain di komputer anda telah dienkripskan oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-zh' >您试图打开的文件以及您计算机上的其它文件已经用"SAGE 2.2 Ransomware"进行了加密。</h2><h2 class='l l-tr' >Açmaya çalıştığınız dosya ve diğer önemli dosyalarınızı bilgisayarınızda "SAGE 2.2 Ransomware" tarafından şifrelenmiş.</h2><h2 class='l l-vi' >Tập tin mà bạn cố mở và những tập tin quan trọng khác trên máy tính của bạn bị mã hóa bởi "SAGE 2.2 Ransomware".</h2><h2 class='l l-hi' >वो फाइल जिसे आपने खोलने की कोशिश की और आपके कंप्‍यूटर पर बाकी महत्‍वपूर्ण फाइले हमारी ओर से इंक्रिप्टिड की गई हैं "SAGE 2.2 Ransomware"।</h2><h2 class='l l-jv' >File yang Anda coba untuk buka dan file penting lain di komputer Anda yang dienkripsi oleh "SAGE 2.2 Ransomware".</h2><h2 class='l l-fa' >فایلی که ش�

URLs

http://'+s.bp

http://'+s.bp+s.txp+tx

Extracted

Family

darkcomet

Botnet

Sifoon

google.serveftp.com:2022

Mutex

DC_MUTEX-XZGC6H1

Attributes

gencode
gX9JgH0D7xKB
install
false
offline_keylogger
true
password
H91B4UD
persistence
false

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

shadowpro87.ddns.net:1177

Mutex

9165950e91e4e361fa21d31cf1cfc39b

Attributes

reg_key
9165950e91e4e361fa21d31cf1cfc39b
splitter
|'|'|

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet
GlobeImposter
GlobeImposter is a ransomware first seen in 2017.
ransomware globeimposter
Globeimposter family
globeimposter
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi
Gozi family
gozi
HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Hawkeye_reborn family
hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger
M00nd3v_logger family
m00nd3v_logger
Njrat family
njrat
Troldesh family
troldesh
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
ransomware trojan troldesh
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/memory/8912-12544-0x0000000000530000-0x00000000005A6000-memory.dmp	Nirsoft

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/8912-12325-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/8912-12544-0x0000000000530000-0x00000000005A6000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/8912-12544-0x0000000000530000-0x00000000005A6000-memory.dmp	WebBrowserPassView

Renames multiple (429) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
evasion

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
25896	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe

Executes dropped EXE 36 IoCs

pid	Process
2864	HEUR-Trojan-Ransom.MSIL.Encoder.gen-8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263.exe
2228	HEUR-Trojan-Ransom.Win32.Blocker.gen-c3e42321bb29b53019db05c42ac32df3ad1d321bb2c14df6e2fdeba8b3395b2f.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1352	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
236	HEUR-Trojan-Ransom.Win32.Shade.gen-49d24b253fd993f0712463c14d10fb813f1859f566915248925410d89ea3261f.exe
2404	Trojan-Ransom.Win32.Agent.auwh-0e06e9f5f272d6b22274382cf282a4f58c37621a6855f69b1c91a7d72fc92354.exe
2344	Trojan-Ransom.Win32.Blocker.hrft-3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
1984	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
1812	Trojan-Ransom.Win32.Agent.abxy-241f67ece26c9e6047bb1a9fc60bf7c45a23ea1a2bb08a1617a385c71d008d79.exe
1704	Trojan-Ransom.Win32.Blocker.ahvx-aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8.exe
1976	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1928	Trojan-Ransom.Win32.CryptXXX.asdgay-470aa0c87d97ecff284568ce271a61160ed1a885ee16c4d69c2239b36ad5eefe.exe
1916	Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe
1380	Trojan-Ransom.Win32.Shade.prf-aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c.exe
1988	Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
1028	Trojan-Ransom.Win32.Hermez.gi-1d241bd0b71408abcf11871a9318cbfcd925b195814951c3123abca27554c6f4.exe
1592	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
2928	FB_739A.tmp.exe
904	FB_783D.tmp.com
340	1.exe
2952	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
3024	Rj3fNWF3.exe
2116	xk.exe
1660	IExplorer.exe
2424	WINLOGON.EXE
2104	CSRSS.EXE
2160	SERVICES.EXE
1732	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
2192	LSASS.EXE
2320	SMSS.EXE
988	Rj3fNWF3.exe
2752	Rj3fNWF3.exe
2748	Rj3fNWF3.exe
2136	Rj3fNWF3.exe
1428	Rj3fNWF3.exe

Loads dropped DLL 17 IoCs

pid	Process
2344	Trojan-Ransom.Win32.Blocker.hrft-3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
2344	Trojan-Ransom.Win32.Blocker.hrft-3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
1592	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
1592	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
2952	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	104.155.138.21
Destination IP	107.178.223.183
Destination IP	107.178.223.183
Destination IP	107.178.223.183

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0005000000019623-73.dat	vmprotect
behavioral1/memory/1916-84-0x0000000000400000-0x000000000092F000-memory.dmp	vmprotect
behavioral1/memory/1916-101-0x0000000000400000-0x000000000092F000-memory.dmp	vmprotect
behavioral1/memory/1916-619-0x0000000000400000-0x000000000092F000-memory.dmp	vmprotect
behavioral1/memory/1916-3161-0x0000000000400000-0x000000000092F000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	Trojan-Ransom.Win32.Shade.prf-aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ZDYY = "C:\\1.exe"	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe"	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tdupprsomey = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\kibsny.exe\""	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Local Security Authority Process = "C:\\Users\\Admin\\AppData\\Roaming\\Updater.exe"	vbc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe"	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 32 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	F:\desktop.ini	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2872745919-2748461613-2989606286-1000\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File created	F:\desktop.ini	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File created	C:\desktop.ini	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\desktop.ini	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\N:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\Y:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\M:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\G:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\O:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\W:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\V:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\X:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\J:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\L:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\R:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\I:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\Q:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\Z:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\T:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\E:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\Q:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\U:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\V:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\P:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\Y:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\I:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\N:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\Y:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\U:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\U:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\A:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\S:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\O:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\G:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\P:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\E:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\K:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\M:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\H:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\N:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\B:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\R:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\P:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\S:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\W:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\I:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\J:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\J:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\T:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\X:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\S:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\W:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\Z:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\E:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\G:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\K:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\L:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
File opened (read-only)	\??\H:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\K:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\T:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\Q:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\M:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\H:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\V:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\Z:	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened (read-only)	\??\L:	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
File opened (read-only)	\??\R:	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shell.exe	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File created	C:\Windows\system32\perfc009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00C.dat	OUTLOOK.EXE
File created	C:\Windows\SysWOW64\Mig2.scr	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File opened for modification	C:\Windows\SysWOW64\Mig2.scr	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File created	C:\Windows\system32\perfh009.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\IExplorer.exe	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File created	C:\Windows\system32\perfc007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh007.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc00A.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh00C.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfc010.dat	OUTLOOK.EXE
File created	C:\Windows\system32\perfh011.dat	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\shell.exe	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File created	C:\Windows\SysWOW64\IExplorer.exe	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	OUTLOOK.EXE
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	OUTLOOK.EXE
File created	C:\Windows\system32\perfh010.dat	OUTLOOK.EXE

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\1.bmp"	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DDx.bmp"	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1916	Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1804 set thread context of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1704 set thread context of 2500	1704	Trojan-Ransom.Win32.Blocker.ahvx-aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8.exe	104
PID 1704 set thread context of 2080	1704	Trojan-Ransom.Win32.Blocker.ahvx-aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8.exe	116

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1916-145-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-143-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-141-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-139-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-137-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-135-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-133-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-131-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-129-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-127-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-125-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-123-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-121-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-119-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-117-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-115-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-113-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-111-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-109-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-107-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-105-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-104-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1916-103-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/1380-149-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1380-148-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1380-147-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/1380-146-0x0000000000400000-0x0000000000608000-memory.dmp	upx
behavioral1/memory/2080-1659-0x0000000000400000-0x00000000004B7000-memory.dmp	upx
behavioral1/memory/2080-2754-0x0000000000400000-0x00000000004B7000-memory.dmp	upx

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\VSTAProjectUI.dll	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File created	C:\Program Files (x86)\how_to_back_files.html	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\how_to_back_files.html	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\how_to_back_files.html	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\VSTAClientPkg.dll	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\VSTAProject.dll	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\VSTAClientPkgUI.dll	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AssemblyInfoInternal.zip	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\how_to_back_files.html	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AppConfigurationInternal.zip	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\updater.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File created	C:\Program Files (x86)\MSBuild\how_to_back_files.html	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\how_to_back_files.html	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\how_to_back_files.html	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE
File created	C:\Windows\inf\Outlook\0009\outlperf.ini	OUTLOOK.EXE
File opened for modification	C:\Windows\xk.exe	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File created	C:\Windows\xk.exe	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
File created	C:\Windows\inf\Outlook\outlperf.h	OUTLOOK.EXE

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Updater.exe:ZONE.identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SMSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CSRSS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SERVICES.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LSASS.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FB_739A.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Blocker.hrft-3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Hermez.gi-1d241bd0b71408abcf11871a9318cbfcd925b195814951c3123abca27554c6f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Shade.prf-aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IExplorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Shade.gen-49d24b253fd993f0712463c14d10fb813f1859f566915248925410d89ea3261f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Agent.auwh-0e06e9f5f272d6b22274382cf282a4f58c37621a6855f69b1c91a7d72fc92354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.MSIL.Encoder.gen-8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.Blocker.ahvx-aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FB_783D.tmp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HEUR-Trojan-Ransom.Win32.Blocker.gen-c3e42321bb29b53019db05c42ac32df3ad1d321bb2c14df6e2fdeba8b3395b2f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINLOGON.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rj3fNWF3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe

Interacts with shadow copies 3 TTPs 20 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
29476	vssadmin.exe
29600	vssadmin.exe
2520	vssadmin.exe
608	vssadmin.exe
28784	vssadmin.exe
26544	vssadmin.exe
1548	vssadmin.exe
1240	vssadmin.exe
27796	vssadmin.exe
29016	vssadmin.exe
29228	vssadmin.exe
27280	vssadmin.exe
27404	vssadmin.exe
1612	vssadmin.exe
28196	vssadmin.exe
28476	vssadmin.exe
28888	vssadmin.exe
29348	vssadmin.exe
2124	vssadmin.exe
2184	vssadmin.exe

Modifies Control Panel 7 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR"	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600"	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\WallpaperStyle = "1"	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop\TileWallpaper = "1"	1.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Control Panel\Desktop	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "42"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "22"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "22"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "42"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "22"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D0E76E1-9D4D-11EF-B20A-C60424AAF5E1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "42"	IEXPLORE.EXE

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
Key created	\REGISTRY\USER\S-1-5-19	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
Key created	\REGISTRY\USER\S-1-5-20	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
Key created	\REGISTRY\USER\S-1-5-18	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CC-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CF-0000-0000-C000-000000000046}\ = "_RuleAction"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B0-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063062-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672DE-0000-0000-C000-000000000046}\ = "_OlkComboBox"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063006-0000-0000-C000-000000000046}\ = "MAPIFolder"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E7-0000-0000-C000-000000000046}\ = "_NavigationModules"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063074-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063081-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063039-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F0-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063042-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067353-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630EF-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006300C-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E4-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C8-0000-0000-C000-000000000046}\ = "_SelectNamesDialog"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302C-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672FB-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630DF-0000-0000-C000-000000000046}	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CF-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D0-0000-0000-C000-000000000046}\ = "_MoveOrCopyRuleAction"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630B2-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006305A-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F9-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063007-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CD-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CF-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D6-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063034-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063040-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CC-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063047-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307D-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063001-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D4-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630FE-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F4-0000-0000-C000-000000000046}	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00067355-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307D-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006307B-0000-0000-C000-000000000046}\ = "OutlookBarGroupsEvents"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303F-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A8-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006304F-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063087-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006303A-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302B-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063070-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063098-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\sage.notice\shell	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000672F5-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630D7-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CB-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630C3-0000-0000-C000-000000000046}\ = "Conflict"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063008-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063008-0000-0000-C000-000000000046}\TypeLib\Version = "9.4"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063072-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063009-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CE-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00063024-0000-0000-C000-000000000046}\TypeLib	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0006302C-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630A2-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OUTLOOK.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630CB-0000-0000-C000-000000000046}\ProxyStubClsid32	OUTLOOK.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000630E5-0000-0000-C000-000000000046}\TypeLib\ = "{00062FFF-0000-0000-C000-000000000046}"	OUTLOOK.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Updater.exe:ZONE.identifier	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2776	schtasks.exe
756	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1924	OUTLOOK.EXE

Suspicious behavior: CmdExeWriteProcessMemorySpam 17 IoCs

pid	Process
2864	HEUR-Trojan-Ransom.MSIL.Encoder.gen-8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263.exe
2228	HEUR-Trojan-Ransom.Win32.Blocker.gen-c3e42321bb29b53019db05c42ac32df3ad1d321bb2c14df6e2fdeba8b3395b2f.exe
1352	HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1984	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
236	HEUR-Trojan-Ransom.Win32.Shade.gen-49d24b253fd993f0712463c14d10fb813f1859f566915248925410d89ea3261f.exe
1812	Trojan-Ransom.Win32.Agent.abxy-241f67ece26c9e6047bb1a9fc60bf7c45a23ea1a2bb08a1617a385c71d008d79.exe
2404	Trojan-Ransom.Win32.Agent.auwh-0e06e9f5f272d6b22274382cf282a4f58c37621a6855f69b1c91a7d72fc92354.exe
1704	Trojan-Ransom.Win32.Blocker.ahvx-aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8.exe
2344	Trojan-Ransom.Win32.Blocker.hrft-3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
1988	Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
1928	Trojan-Ransom.Win32.CryptXXX.asdgay-470aa0c87d97ecff284568ce271a61160ed1a885ee16c4d69c2239b36ad5eefe.exe
1028	Trojan-Ransom.Win32.Hermez.gi-1d241bd0b71408abcf11871a9318cbfcd925b195814951c3123abca27554c6f4.exe
1916	Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe
1592	Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
1380	Trojan-Ransom.Win32.Shade.prf-aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	taskmgr.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1984	HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeRestorePrivilege	2204	7zFM.exe
Token: 35	2204	7zFM.exe
Token: SeSecurityPrivilege	2204	7zFM.exe
Token: SeDebugPrivilege	2880	taskmgr.exe
Token: SeDebugPrivilege	1704	Trojan-Ransom.Win32.Blocker.ahvx-aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8.exe
Token: SeDebugPrivilege	2864	HEUR-Trojan-Ransom.MSIL.Encoder.gen-8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263.exe
Token: SeBackupPrivilege	2244	vssvc.exe
Token: SeRestorePrivilege	2244	vssvc.exe
Token: SeAuditPrivilege	2244	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2080	vbc.exe
Token: SeSecurityPrivilege	2080	vbc.exe
Token: SeTakeOwnershipPrivilege	2080	vbc.exe
Token: SeLoadDriverPrivilege	2080	vbc.exe
Token: SeSystemProfilePrivilege	2080	vbc.exe
Token: SeSystemtimePrivilege	2080	vbc.exe
Token: SeProfSingleProcessPrivilege	2080	vbc.exe
Token: SeIncBasePriorityPrivilege	2080	vbc.exe
Token: SeCreatePagefilePrivilege	2080	vbc.exe
Token: SeBackupPrivilege	2080	vbc.exe
Token: SeRestorePrivilege	2080	vbc.exe
Token: SeShutdownPrivilege	2080	vbc.exe
Token: SeDebugPrivilege	2080	vbc.exe
Token: SeSystemEnvironmentPrivilege	2080	vbc.exe
Token: SeChangeNotifyPrivilege	2080	vbc.exe
Token: SeRemoteShutdownPrivilege	2080	vbc.exe
Token: SeUndockPrivilege	2080	vbc.exe
Token: SeManageVolumePrivilege	2080	vbc.exe
Token: SeImpersonatePrivilege	2080	vbc.exe
Token: SeCreateGlobalPrivilege	2080	vbc.exe
Token: 33	2080	vbc.exe
Token: 34	2080	vbc.exe
Token: 35	2080	vbc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2204	7zFM.exe
2204	7zFM.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
572	iexplore.exe
2880	taskmgr.exe
2880	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe
2880	taskmgr.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
616	Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
1916	Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe
1916	Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe
1916	Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe
340	1.exe
340	1.exe
340	1.exe
572	iexplore.exe
572	iexplore.exe
2116	xk.exe
1660	IExplorer.exe
2424	WINLOGON.EXE
2104	CSRSS.EXE
2160	SERVICES.EXE
3044	IEXPLORE.EXE
3044	IEXPLORE.EXE
2192	LSASS.EXE
2320	SMSS.EXE
1924	OUTLOOK.EXE
2500	vbc.exe
2080	vbc.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1380	Trojan-Ransom.Win32.Shade.prf-aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c.exe
236	HEUR-Trojan-Ransom.Win32.Shade.gen-49d24b253fd993f0712463c14d10fb813f1859f566915248925410d89ea3261f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2864	2676	cmd.exe	36
PID 2676 wrote to memory of 2864	2676	cmd.exe	36
PID 2676 wrote to memory of 2864	2676	cmd.exe	36
PID 2676 wrote to memory of 2864	2676	cmd.exe	36
PID 2676 wrote to memory of 2228	2676	cmd.exe	37
PID 2676 wrote to memory of 2228	2676	cmd.exe	37
PID 2676 wrote to memory of 2228	2676	cmd.exe	37
PID 2676 wrote to memory of 2228	2676	cmd.exe	37
PID 2676 wrote to memory of 1352	2676	cmd.exe	38
PID 2676 wrote to memory of 1352	2676	cmd.exe	38
PID 2676 wrote to memory of 1352	2676	cmd.exe	38
PID 2676 wrote to memory of 1352	2676	cmd.exe	38
PID 2676 wrote to memory of 1804	2676	cmd.exe	39
PID 2676 wrote to memory of 1804	2676	cmd.exe	39
PID 2676 wrote to memory of 1804	2676	cmd.exe	39
PID 2676 wrote to memory of 1804	2676	cmd.exe	39
PID 2676 wrote to memory of 1984	2676	cmd.exe	40
PID 2676 wrote to memory of 1984	2676	cmd.exe	40
PID 2676 wrote to memory of 1984	2676	cmd.exe	40
PID 2676 wrote to memory of 1984	2676	cmd.exe	40
PID 2676 wrote to memory of 236	2676	cmd.exe	41
PID 2676 wrote to memory of 236	2676	cmd.exe	41
PID 2676 wrote to memory of 236	2676	cmd.exe	41
PID 2676 wrote to memory of 236	2676	cmd.exe	41
PID 2676 wrote to memory of 1812	2676	cmd.exe	42
PID 2676 wrote to memory of 1812	2676	cmd.exe	42
PID 2676 wrote to memory of 1812	2676	cmd.exe	42
PID 2676 wrote to memory of 1812	2676	cmd.exe	42
PID 2676 wrote to memory of 2404	2676	cmd.exe	43
PID 2676 wrote to memory of 2404	2676	cmd.exe	43
PID 2676 wrote to memory of 2404	2676	cmd.exe	43
PID 2676 wrote to memory of 2404	2676	cmd.exe	43
PID 2676 wrote to memory of 1704	2676	cmd.exe	44
PID 2676 wrote to memory of 1704	2676	cmd.exe	44
PID 2676 wrote to memory of 1704	2676	cmd.exe	44
PID 2676 wrote to memory of 1704	2676	cmd.exe	44
PID 2676 wrote to memory of 2344	2676	cmd.exe	45
PID 2676 wrote to memory of 2344	2676	cmd.exe	45
PID 2676 wrote to memory of 2344	2676	cmd.exe	45
PID 2676 wrote to memory of 2344	2676	cmd.exe	45
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 1804 wrote to memory of 1976	1804	HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe	47
PID 2676 wrote to memory of 1988	2676	cmd.exe	46
PID 2676 wrote to memory of 1988	2676	cmd.exe	46
PID 2676 wrote to memory of 1988	2676	cmd.exe	46
PID 2676 wrote to memory of 1988	2676	cmd.exe	46
PID 2676 wrote to memory of 616	2676	cmd.exe	48
PID 2676 wrote to memory of 616	2676	cmd.exe	48
PID 2676 wrote to memory of 616	2676	cmd.exe	48
PID 2676 wrote to memory of 616	2676	cmd.exe	48
PID 2676 wrote to memory of 1928	2676	cmd.exe	49
PID 2676 wrote to memory of 1928	2676	cmd.exe	49
PID 2676 wrote to memory of 1928	2676	cmd.exe	49
PID 2676 wrote to memory of 1928	2676	cmd.exe	49
PID 2676 wrote to memory of 1028	2676	cmd.exe	50
PID 2676 wrote to memory of 1028	2676	cmd.exe	50

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00359.7z"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2204

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2880

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.MSIL.Encoder.gen-8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263.exe
  HEUR-Trojan-Ransom.MSIL.Encoder.gen-8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- - C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.MSIL.Encoder.gen-8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263.exe
    "HEUR-Trojan-Ransom.MSIL.Encoder.gen-8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263.exe"
    3⤵
    PID:8912
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp7494.tmp"
      4⤵
      PID:27068
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp6633.tmp"
      4⤵
      PID:3912
- C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Blocker.gen-c3e42321bb29b53019db05c42ac32df3ad1d321bb2c14df6e2fdeba8b3395b2f.exe
  HEUR-Trojan-Ransom.Win32.Blocker.gen-c3e42321bb29b53019db05c42ac32df3ad1d321bb2c14df6e2fdeba8b3395b2f.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C WScript "C:\ProgramData\ADwXcSSGvY\r.vbs"
    3⤵
    PID:25872
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C WScript "C:\ProgramData\ADwXcSSGvY\r.vbs"
    3⤵
    PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C WScript "C:\ProgramData\ADwXcSSGvY\r.vbs"
    3⤵
    PID:3520
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C WScript "C:\ProgramData\ADwXcSSGvY\r.vbs"
    3⤵
    PID:3440
- C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
  HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1352
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1340
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:2328
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:1300
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:2088
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:1476
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:2752
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:5704
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:7860
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:11120
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:10352
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:12964
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:15924
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:17716
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:15968
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:19848
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:21916
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:23148
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:24844
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:26892
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:3140
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:8036
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:10752
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:12488
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:16872
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:19020
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:21868
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:23344
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:24392
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:27536
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:29200
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:3184
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:7756
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:9524
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:14776
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:14616
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:18172
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:22452
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:26028
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:28948
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:27208
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:25852
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:26476
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:27444
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:28352
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:3148
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:3540
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:3568
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:3640
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns1.wowservers.ru
    3⤵
    PID:3688
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns2.wowservers.ru
    3⤵
    PID:5656
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup carder.bit ns2.wowservers.ru
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup ransomware.bit ns1.wowservers.ru
    3⤵
    PID:4004
- C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
  HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
    HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe
    3⤵
    - Executes dropped EXE
    PID:1976
- C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
  HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious behavior: RenamesItself
  PID:1984
- - C:\Windows\SysWOW64\shell.exe
    "C:\Windows\system32\shell.exe" "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe > nul
    3⤵
    PID:29684
- C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Shade.gen-49d24b253fd993f0712463c14d10fb813f1859f566915248925410d89ea3261f.exe
  HEUR-Trojan-Ransom.Win32.Shade.gen-49d24b253fd993f0712463c14d10fb813f1859f566915248925410d89ea3261f.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of UnmapMainImage
  PID:236
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Agent.abxy-241f67ece26c9e6047bb1a9fc60bf7c45a23ea1a2bb08a1617a385c71d008d79.exe
  Trojan-Ransom.Win32.Agent.abxy-241f67ece26c9e6047bb1a9fc60bf7c45a23ea1a2bb08a1617a385c71d008d79.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1812
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Agent.auwh-0e06e9f5f272d6b22274382cf282a4f58c37621a6855f69b1c91a7d72fc92354.exe
  Trojan-Ransom.Win32.Agent.auwh-0e06e9f5f272d6b22274382cf282a4f58c37621a6855f69b1c91a7d72fc92354.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2404
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:572
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:572 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:3044
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Blocker.ahvx-aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8.exe
  Trojan-Ransom.Win32.Blocker.ahvx-aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\iqxudoxv.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES986A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9869.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2820
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ynmiaxfp.cmdline"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2560
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA516.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA515.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1628
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2500
- - C:\Windows\SysWOW64\cmd.exe
    "cmd"
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:1508
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2080
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Blocker.hrft-3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
  Trojan-Ransom.Win32.Blocker.hrft-3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:2344
- - C:\Users\Admin\AppData\Local\Temp\FB_739A.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\FB_739A.tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\FB_783D.tmp.com
    "C:\Users\Admin\AppData\Local\Temp\FB_783D.tmp.com"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:904
  - - C:\Users\Admin\AppData\Roaming\config.exe
      "C:\Users\Admin\AppData\Roaming\config.exe"
      4⤵
      PID:2816
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\config.exe" "config.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:25896
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe
  Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1988
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
  Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:616
- - C:\Windows\xk.exe
    C:\Windows\xk.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2116
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1660
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2424
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2104
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2160
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2192
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2320
- - C:\Windows\xk.exe
    C:\Windows\xk.exe
    3⤵
    PID:27000
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    PID:26320
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    PID:2900
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
    3⤵
    PID:28592
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    PID:28324
- - C:\Windows\xk.exe
    C:\Windows\xk.exe
    3⤵
    PID:29064
- - C:\Windows\SysWOW64\IExplorer.exe
    C:\Windows\system32\IExplorer.exe
    3⤵
    PID:28996
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
    3⤵
    PID:28856
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
    3⤵
    PID:29124
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
    3⤵
    PID:29312
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
    3⤵
    PID:28868
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
    3⤵
    PID:29464
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
    3⤵
    PID:26368
- - C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
    3⤵
    PID:27184
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.CryptXXX.asdgay-470aa0c87d97ecff284568ce271a61160ed1a885ee16c4d69c2239b36ad5eefe.exe
  Trojan-Ransom.Win32.CryptXXX.asdgay-470aa0c87d97ecff284568ce271a61160ed1a885ee16c4d69c2239b36ad5eefe.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1928
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Hermez.gi-1d241bd0b71408abcf11871a9318cbfcd925b195814951c3123abca27554c6f4.exe
  Trojan-Ransom.Win32.Hermez.gi-1d241bd0b71408abcf11871a9318cbfcd925b195814951c3123abca27554c6f4.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1028
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
    3⤵
    PID:27132
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin Delete Shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:27796
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:28476
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:28196
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:28784
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:29016
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:28888
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:29228
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:29348
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:29476
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:29600
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:27280
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
      4⤵
      Interacts with shadow copies
      PID:27404
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
      4⤵
      Interacts with shadow copies
      PID:26544
  - - C:\Windows\SysWOW64\vssadmin.exe
      vssadmin Delete Shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\users\Admin\Desktop\DECRYPT_INFORMATION.html
    3⤵
    PID:28340
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\DECRYPT_INFORMATION.html
      4⤵
      PID:27064
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:27064 CREDAT:275457 /prefetch:2
        5⤵
        
        PID:28840
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe
  Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of SetWindowsHookEx
  PID:1916
- - C:\Windows\SysWOW64\net.exe
    net user Administrator 1861570A
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2940
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Administrator 1861570A
      4⤵
      System Location Discovery: System Language Discovery
      PID:1096
- - C:\Windows\SysWOW64\net.exe
    net user 7990 1861570A /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2560
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user 7990 1861570A /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:796
- - C:\Windows\SysWOW64\net.exe
    net user QQ507212108 1861570A /add
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2128
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user QQ507212108 1861570A /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2424
- - C:\1.exe
    C:\1.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Suspicious use of SetWindowsHookEx
    PID:340
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
  Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  PID:1592
- - C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
    "C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe" g
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Modifies Control Panel
    - Modifies data under HKEY_USERS
    - Modifies registry class
    PID:2952
  - - C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe
      "C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe" g
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1732
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe" /SC ONLOGON /RL HIGHEST /F
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:756
  - - C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      System Location Discovery: System Language Discovery
      Interacts with shadow copies
      PID:2520
  - - C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      System Location Discovery: System Language Discovery
      Interacts with shadow copies
      PID:1612
  - - C:\Windows\SysWOW64\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      4⤵
      System Location Discovery: System Language Discovery
      Interacts with shadow copies
      PID:2124
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      PID:2572
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2808
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /DELETE /TN /F "N0mFUQoa"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1152
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f16184093.vbs"
      4⤵
      PID:1824
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2776
- - C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
    "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3024
  - - C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
      "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:988
    - - C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2752
      - C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2748
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1428
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        9⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        10⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        11⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        12⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        13⤵
        
        PID:2584
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        14⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        15⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        16⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe
        
        "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g
        17⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        17⤵
        Interacts with shadow copies
        
        PID:1240
        
        C:\Windows\SysWOW64\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        17⤵
        Interacts with shadow copies
        
        PID:2184
        
        C:\Windows\SysWOW64\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        17⤵
        Interacts with shadow copies
        
        PID:608
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta"
        17⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"
        17⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /DELETE /TN /F "N0mFUQoa"
        17⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f16184093.vbs"
        17⤵
        
        PID:1040
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f252888.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2416
- C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Shade.prf-aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c.exe
  Trojan-Ransom.Win32.Shade.prf-aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of UnmapMainImage
  PID:1380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244

C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" -Embedding
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1924
- C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
  "C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 2424
  2⤵
  PID:3412
- - C:\Windows\SysWOW64\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 2424
    3⤵
    PID:3392

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:1564

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:8540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B149D0A0FCC429A74D89C0E9BA81C127
  2⤵
  PID:9564
- - C:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe" /shutdown
    3⤵
    PID:10340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AD63172EDB15564612DFDC4EC9AA8174 M Global\MSI0000
  2⤵
  PID:11992
- - C:\Windows\syswow64\wevtutil.exe
    "wevtutil.exe" im "C:\Program Files (x86)\Microsoft Office\Office14\BCSEvents.man"
    3⤵
    PID:23724
  - - C:\Windows\System32\wevtutil.exe
      "wevtutil.exe" im "C:\Program Files (x86)\Microsoft Office\Office14\BCSEvents.man" /fromwow64
      4⤵
      PID:22692
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 29F4A41876D491A4DF3E52B2205737A9
  2⤵
  PID:2612
- - C:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\bcssync.exe" /shutdown
    3⤵
    PID:3100

C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe
"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding
1⤵
PID:27636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.bmp

Filesize
15KB

MD5
5bc800a1b981f604a1574993bf7cc17a

SHA1
04776babdde0741adaed735b2d4215a786b06e57

SHA256
28b0f2e90457c0a8d117174e02a6d0bb99d75d7820cf08c47159027149d2184a

SHA512
f349d2abaf824bea2617b07c483380f9df29582fe96916fc3183534a2f273c8a53e405bac66c09646f1be4eeaf1f8a52cf3bab67eb1131319269dc2ccc396186

Download Submit
C:\1.exe

Filesize
760KB

MD5
381d2c8a0eeadb93b19ae600cf3e2a90

SHA1
dc739c8fab389ced0a556114632116f664196c06

SHA256
2b79b30f6ae5c01cc245e5511184a01fb24772b5c9099b0dc55c20bf9a81840a

SHA512
4d3a9932ab06ad05083892819c1939b9d9281ec2372f2ab7d97fa60ba52b4bcb8a98405bee28cda862846b6828094fb95ba4abe14b4f87f4a59afbbfb3d23d80

Download Submit
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_4d69f9e1-559c-46cf-82ac-67913db47c55[[email protected]].HRM

Filesize
338B

MD5
1322f0c3bbc90ea94af65c15ba5efc13

SHA1
30b3b53b7c4dac2456651475d25e0bcf15a688cb

SHA256
c2a3e4380b52bb6fc1eed399455463817bb4ec825173d82ad73a5b8cc941ec4c

SHA512
294eb539412fb367543735fc24a833b392f805d086dd4e72be2a11c98b8b8c25e99712c6a058fcdfb4ee31d0cd5576f067f1787423dad554d2c9f1c5525e19b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
99eee88210a373719c9f09a365c6cfe8

SHA1
cfbe8292a0c56c389b28a98c1f98e2dd5b50eba1

SHA256
c5b7182047ef0ad905c0682ebd4feb55a11e6c76c102e02df1692f340f3003f8

SHA512
57bd8baa3e2d5c316b17db91af0890d586780bc192b370fd7c9aa9b49cf3f689176f686169fa4dc9627f96dc3f0760e30c2896767822d3a85e4a92e4520bbb8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6893bb0adf12a0117697d6bbf5ce0a59

SHA1
ab1b973c4fa4afe927f2504583be666be3d37362

SHA256
d3238c165058a2734ac7d8902f068b4f8eec0c9caef252d29897365188b3eb03

SHA512
f187002f46e5390651d03e80ed21dbaeb793db167f22c16f0c5b3d1d5acd5eb4fdadbe0ce65ef8a58e6e348ee3da49756288606c2806876a7c6611f4b395adc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
402bbceb4232f08e8a1b114215910024

SHA1
fd94dc1b9029fc8398aa63cefe0ebf971268bb96

SHA256
3483f618a3cf8dafbc40b198dc4640bb037f287e12ac6ee4d851c695d9fcd44e

SHA512
42fa7d075b72e80aecd707fbbf31646ee72738807367770d548ecf423aa0d2af94eb081343e46b11c0ca91b4da43c80ebb96ed9fbb9629e47061fb1bdb3c9a74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8c31b48dd41f0391bc1b36e092d2d91

SHA1
a4a00248b26cfeb5a61d1dd0886a69754cd662ba

SHA256
d535e6e318e03a5e60119311f76a4e1702d1dcf3867cd1868a98c9dfa59d6383

SHA512
59ad75963bd0071bf46c0d5c11da47534edb3039064098353b275159d5afafd1fd3f142900f4abc27cc0d99504f762daf7ed60ef2f025c1c101f9a51b46919b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fce76e36092406b27af1fc5a9091fcb

SHA1
ac02948ee0407f5797c9a6668bf29a2d8f7547d6

SHA256
5556929841b201c683302e1fe521620e3d6aa400b224e86e63223bad07058fbc

SHA512
ef664605e219aa8c8a5d8f338832ce1045eddf6add79ba99891f5db168bc8bcf08573198993760b7c6a2cf89c5618abe2c04b64a1773cf7c3024632476b984a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc44e71439bad2ce0911b04c91f36821

SHA1
9b4c5b3db3c8c3ca98a99b73d66f68373fdeedac

SHA256
65c71e370dae65be76832029e28413afc32f61a7ff928db85cccab5281c931f8

SHA512
cc5ac2c45d70acd65bbc77c6e30feb177a1e2bfe1476615119888cb52d7c0fdecd6f59f156511b090e1fc7f99961817490f5fab72d02b02d43a5dea2c6f5550e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e99df294511b3c365a519b4ca75d2f3

SHA1
26fc873ef5ef675d5f77bb33276909912aa3a838

SHA256
e80f4713cbcec96534b7c7750b166e070ab586075f44a02a7a51ecc5e39767d2

SHA512
69641fe54ddf480730bef3ea982808694f83b04d2fdcd4139c08f3aa38eab04b39cbd42e5a8f0d46dbb58d3aaa2c1164d7154177f160e0d8dea8ad5fa78be1f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2d0b510f81c8ef0a4e6cc06d303c698

SHA1
4208855d755ab5b35af4ae9e85cb266338716ee8

SHA256
b2b11dfa58d51ebb478192269e5c99c6b7a916b2ba7ed304baad1318d1171919

SHA512
971e6f1f035d2c2ae292ce940450af7b348e4e05221b223a4cb4e466284b5cdd62afeaa04d2f3ba7af354697a84a250c1125840ff5733bbf5c7dcbb3a65cfae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd9c25848d72f3a81c2efa02cd70920d

SHA1
5126e6cfaaef397d71ce8e33441b5290cfd3c596

SHA256
0b0b79a26b9b5ef47e6a172f73629963ebdee593c45ec186e0993830fd49fefe

SHA512
5f4d96edf307efb5ff59bed7f0992b5a6b07f4405b8b132516918c2394b6651e8fd9208bd0885306db4ce45816363ca0f157a73f81b6f9748df4b6545614f1a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54818249dc555edc3fb431ab945f9648

SHA1
ac9f2d784206da8c4975ecdd3d2ef6a4a81e5488

SHA256
5b598c5d48fa2759fc5be837941807e1dcfe9a29a32279f12606a00b1149460b

SHA512
e34a3218fde4a243ca64535f53148cb8450423320827241b65fbe5d2de32452ac59f96a0990435406dc2af131f2f482092022f3120f9a9fb9f833d35d1e9c9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eafd9aefce8267aca6f0761c26328a35

SHA1
f81f62db9eda275637ccda242bec7e9fdb6f7612

SHA256
8ae03bf28cea11ce127b1f40f6120837896f3659d687b38a5e81603372607093

SHA512
1f5a4ea31e1485dfbbfbfa5081af96a9e9c35566c8eb3d3cba8a6c7b219639753c39d1320cb1800361194a618f27972f2678a014cd170480cb9d86c7a1b230c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e3909708812730f94f93d8f94620880

SHA1
7fbe4deb5618cdb8ab8646c1254ea11b63d31f07

SHA256
0318bed626985d14c874d5532e4c0a7a21f2b9f627c317bcb2d761544ee622ab

SHA512
e291f0ee9ba221c56277beef6fafa1daf357b9f536c6fe54a8ec7651b288885987c7264e312fc439b9564ebfa983c0b930fbb034395602ba0da256bfa7b8a0c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2d368d70b7719c11346f3c690ec674f

SHA1
8c4947627ae53c2b279f7401d1dbae68daeac4d8

SHA256
b89369106839d46409dcbae581bc1f3a40ef8108535f2851c22f9ba684c40ad1

SHA512
9ee78dd73716e1453b9bb406971a38c1871738c98b05a14a7f89895a35461b8097ce3dc976268cbae7f805b8f7bb29561dc77c157c1635bd7e7fb7026ae6f81a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1d325b1f0acabf253062782b6f621ca

SHA1
b06b351718af748d2b4c8d01ad89fea7f6c0989a

SHA256
50249e8cfc3ded1781c5490987e44ec44d1c312988ed77d61e8d4f0ed5ec55eb

SHA512
d141479645678c46e93043749812ede0a6a337443eadf8074f31cce85a24fb5bf47f90c328c0060ba88cacd9fb305a4422f45d7d4bbfeb2d97d8810a9cec7f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47e5f4deb41b371a6cf497d154c01f37

SHA1
6603e942cee1dbf6cc2cad435a8055da4de8a298

SHA256
e54d3a2d832f12e666632593bc6846ce1674f94c1110bf678401754037282d89

SHA512
e5881dc37793c54aca5261721a239e48e7f7722a7354ae131d59e935615f8a7145995617d4e5a7e65b14a967847543a0879ebaddff23a1ca53d5cb95a40f94fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25079e809fa8ae247d3776db537b918f

SHA1
3de25ccb6ec1cec2e9be7beedfc14967e0281c48

SHA256
67ddb695a692471e818ee03604e0d29ed47176650047b95e59d0bd6a36991447

SHA512
07b8b2a029e1eedb5c5df95d58c2b0a8b99b7ca60111ee0fd4bd8b34480b1d2bcc9bb0ac46d7eae5a5cff3e81d9c1793a848c867b8e06fa93e34b7283e2ae036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a61ad1dde9fd0df2e8fa1fa651d44049

SHA1
d3ed6ef7edc89790903106f15ef9f06c578b5e3b

SHA256
bd1648a50a22e8965a8db2dbbc4105ed5ffd4006a35d2936cab9282788fb0144

SHA512
1cbe20900816e4caabaab562f4b7caf067e6344dfd0abb2f167af3fa3ae5209c89a6acbd11dcfa2c3c7876909bbdcfa12c7bf6ac0d6ac42c4402b8537f522d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b29f61062fab1071fc63fa0be956a64d

SHA1
4a5891c1586e7565025f4c7b69f4139e3fbd7760

SHA256
8e509ea574b59f0c3f58c7eb38f926f5b9ff04a97a3c74abd8090999066cc88e

SHA512
663d8c23b4fc750f1b31d50f39e20d723f1fa29b9485615a9efb75889e6f3cab24c5076d08f5b404656dbe4c5552d6eed74e5ca27bf0daea4615f48e564803d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a45bfb5ab592e9b65fae1f0a9621b8d6

SHA1
6d73677a84edc687e842c413a9b092d8bfc7518c

SHA256
5d3d6d83361eccff6da9ab13e25c5ebbfc9eaa6e5ec751c8a8e0a516d65f4135

SHA512
af282ad0e0137188e27494b0632800d8072f8f15a345252159cbecb82f1ecf13f59c0d8ab4079895ab83aebc280d9db7a3a2ed6b418d27cee63cd1cbb182c87d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41534f5d0432264b933e4fad3c9379e0

SHA1
d2f708edbaadc1bc0758f978b67d0138b32bda24

SHA256
d3f5541729cf91bdf3dfab445dd791b410e6347932f056c0efb5f4d293ca2f7d

SHA512
450c73a902355985294da83e2e9adda7e546e806beb89e725c4ffc235e78d27f5491a83ddf955c5da624aa872f6ef399db59b751ec3a9875c0ac2fa5dbced6bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19c35d09382e2daf87344707aab71e7f

SHA1
245611049c09995a5b7040db1158d325b11b81fe

SHA256
fa0332d515a79ea32d233531a540184a4302a35c7db04069c929f621912e0c94

SHA512
eb92d11a4684d4d2bc82f8721528317a6660136435e0469506c5dbbc5d4b7d8c2d73103c33f0fda42b0a2d8e34b45be844341c9f09eed281389a91b560b87ae9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aaf577ac85a333cb2a107ea5ce78ad05

SHA1
e7d4a5795158c77fb94a30328c53fe8561698779

SHA256
8a323943f0335fa560b35505960b5338d731f8a43f92d3dc24ab96dd63f2dc7f

SHA512
5193c4ce65d1e224b4247b89db129de78eb687d513ee5545c581a897e3dbfddcaa4645490f45f303ea985878a4096d2719d8ccc3e77016d8233ce7f35725a151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fba04749328958a36e5a0950067e61a

SHA1
221deb8cb3d0dbe33bb71376f7f7df26eb5d8058

SHA256
78aecc6201967c8bc48e7c7abc2f42bd3527a144be67a446f94d472e1a73b158

SHA512
1ad362cbba43f3d1ee616ad59509f8ea427d8b1ae137e6f70c14cc60bb4e4653131cdbed313a9c4cdcb2716879bde83842c683d367ffd4637877e228d19de5c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8119f8f1b494afaa7838ab30f56da92d

SHA1
265f8e18f91849c7aed735c3e7d407cc4eb6d96a

SHA256
bef310db63fafacc234a8f995ce761054db3728c921ca4030f817e9cf8c6aa19

SHA512
3600c5b0e85e4751565af82983ffbf560be54c9e5a1d1f8f99cadded95469a45b95a52836f7f896e6969294beb6b6bfa058edee781e002318ed1139fb17afd3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b739f1ac128cf5ae8087ab55eec5ed5

SHA1
469a996b156da73837030be8fef2c3d45d834bfc

SHA256
a10660c3ee86d216bbc66a8a0bb6bdcc72fbcba2eedf24d8096e4fa223f4c6ba

SHA512
9c4099ac6f63d095e79dc333f6fa92caabb4fdef3348cd2a4a9330eaedd5af202896c787292e4e84a84fe1b6ba787d0c728e66b3652e830d8fc735504e331853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccb974f07bcb2e10b154a6251439c4ba

SHA1
02375e88e736b90bca8ae22ed8e985f816123ae9

SHA256
2ba5816d43f424933b024420c06b6b4807970d4c3aa3aa00797ad15db24c56cf

SHA512
ce3c332127d6221216d749562af5399b1285ff6a1f0d692add2fa481ad32b3824e753ad49a4262b554b984c6634e88ce2745b70b171d6920126b66fff61763f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7a71ecbee91bad65db442b087bc1df5

SHA1
a771e072af5a4d7637959cc6cffa2f1570122544

SHA256
0ec1eeeec10075f83048f1d7ec756359250c303778496774802f9180a89a83ee

SHA512
343afcd27b6d7a6cd07ad45af45bbcad4e89f20d0b431c42e59c82c07ed82afd3348842fc80cd4a5ff7acfa5c51f78cefd08804fd1dc99f91631fb8a366798e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c657b1653925dabd5381d39bb8e8e43

SHA1
c6b5947d5b34e7ed80a197e6443e75220ffdfedd

SHA256
feae3f99af884eef5fcb981a986926b6aa46a07f895ff1805a523a5da390a56f

SHA512
e29bfe60c0e98d54bdc1348b705577db3513d1e632257b748f72f1622b54f6223171264306d485e84451af734d92caf8c07abf9428abe373cf541ddb11882f1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f69d0e1ac55987d41427a172a444460

SHA1
f357e15927ba00d35ecbdf9b318b89b9e7598018

SHA256
8bdf6ffcf8acf652b27b2a09ecc2b6f0331788b861641668356674cc553fe127

SHA512
5f961e9377a8af1c2c8012b7a9fd80be5f10c041b4814b37dcac1a6d0b2a1520a67180c20a378a5254b3a0af837df8f4b215a45fdb1ac0d642ea78e17a6e1308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
3bc29a2663e78afb011656655bc8c28a

SHA1
a57268c98a0b5b5559c197d6be813ae5ad609ab3

SHA256
16cb303f318b69fb179e95edfd84406f18b19191df5ed716739d6dbfd7d284b2

SHA512
9d5259a9148ab259ae61231967d88752b6dea036a27a0b0f054182b0cf54fb613b839eaf57b9721346fe515705069a6b7e57ede7d96560bed94c400bb56849fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

Filesize
240KB

MD5
9c55eaebc8432b2b2513bf9028c23138

SHA1
bca2243d477eaabe1dd38397ce0faf468a827a21

SHA256
31f5e35370b2d6c4ffb6c78690e5ed19f26366d80f97c8c3c57fb3fca59b3a0d

SHA512
c72b4d1dc2b6f2940ebf0f6aa2b4194a7188dda13d71f8a39a7225f6b838cda97a77729043150c50069d9509f8c54aa13a5f0ad2d28c3a957db32e47977081b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\MAVV5Z7N\www.java[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\MAVV5Z7N\www.java[1].xml

Filesize
398B

MD5
ab692b0db88125a02bd6448288e69c1c

SHA1
ce48e4c3acd0796d9245f683b848a758b3fc7a79

SHA256
d61c9d2321d9154e6f45957c2ceb8943cb1d67839059e7d8f04db48dbabd1b5b

SHA512
86172e7e97df9d637e1eb8c49be176d43201914d3a036101cc57badba90074545b2b67c5726e557c24050edae231198fca7de3ffbdeb43b3ce3468c81b56eca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

Filesize
1KB

MD5
48dd6cae43ce26b992c35799fcd76898

SHA1
8e600544df0250da7d634599ce6ee50da11c0355

SHA256
7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

SHA512
c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\favicon[1].ico

Filesize
1KB

MD5
8e39f067cc4f41898ef342843171d58a

SHA1
ab19e81ce8ccb35b81bf2600d85c659e78e5c880

SHA256
872bad18b566b0833d6b496477daab46763cf8bdec342d34ac310c3ac045cefd

SHA512
47cd7f4ce8fcf0fc56b6ffe50450c8c5f71e3c379ecfcfd488d904d85ed90b4a8dafa335d0e9ca92e85b02b7111c9d75205d12073253eed681868e2a46c64890

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC0F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES986A.tmp

Filesize
1KB

MD5
a4d1214ab14bf20b73f87ced1af485d2

SHA1
e02ce8a68a7c0f62fad068ed33548cb4cfba00ef

SHA256
b9c141fe188a89e13f210e4355684a12ad72191ab8c472f0440e138ec74b565d

SHA512
5002f973a7823b661210bd9f8a856c1826b147be11eb4f2647ea978cb858c9ce5e3bd8e5324c32395f8dd871f408a59b8f929ad4e294634ebe2c52480ad4297c

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDC11.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\f1.vbs

Filesize
3KB

MD5
37219fd2d09abee4189a1ae33de93e2d

SHA1
5e4cc26e169b6bd16843bcc86806556dac372c57

SHA256
2a0d2418a2504ad14960dcff54f0892339eeed53e359585c9b04a29c4e6e4274

SHA512
626b89eb5b132ac43a6fb2d5dcc1c62349a6a48045a486835aa51c17348b0c4849cf5d56b4b56359c7bab5bdccaa04adf659f7486de84f9c14d86032272e5069

Download Submit
C:\Users\Admin\AppData\Local\Temp\f252888.vbs

Filesize
668B

MD5
f9cad0ff80b8c78c8a4e3eb844221c1e

SHA1
247bce91e5e9e3265fe60e7899a8dcfa6d099d1c

SHA256
cbc9450d85164e70fcc75ef46e5c2dd0327771750222008b2550c793746a4e82

SHA512
fc36900843a2cef407a85a4078ab44e46b7ad45d36b86c4372d10353af43c3e8f1df56458bd532525291ec438096027f6435199e5ab4258b67062ace02223c50

Download Submit
C:\Users\Admin\AppData\Local\Temp\iqxudoxv.0.vb

Filesize
254B

MD5
36757aabf0e4f39dfa4e7d0e2c0506fd

SHA1
3bebb1de5f217019420de8336b66b8768502cb41

SHA256
97b2b1e8c82404ea0cce8951b9a9dc503d3057c53d1734a18a5140061a5087df

SHA512
67abe6724460d9b9bf55f88230ca05f692cce346266486b73504bd1369aa814b0e1424a0572bdd0d48621bcb01a652ea757beb2ae5544ba9db2c790fed6d35b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\iqxudoxv.cmdline

Filesize
317B

MD5
0279eb5abd4324d86dd0e513372cefab

SHA1
3f2ab8ddfe2dffa8028becd1c2b6ec5ed50604e5

SHA256
44c7774f93c46eebd10a0bcebef44b5a3f0a55611576ad1db24704c976052d5b

SHA512
35b694a1225ee3f951088235b09400db251663a70cfe547530585c1549a2de6a38c9b22805d70706d0f83db69aa580126e7bc2ce940e7cca6040f2204be27c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbc9869.tmp

Filesize
652B

MD5
5d5b5e1b91c80f05016cdf28bc2067c6

SHA1
beaf64208d35043ad708c40007bb3e4218cd0edf

SHA256
d69c037ceaaa06ae56d9bd90334b61236e7b640836bfbb3e0746d927c3dc70bd

SHA512
94c1e05b5a0d8b8b82ffb5619f577a87fd4505f159d15160762e0059f685fad79b8137a4912a4f4117d108ac0bcffc5bc3183da92deaa2dc2078554ae313ebe5

Download Submit
C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.MSIL.Encoder.gen-8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263.exe

Filesize
1022KB

MD5
a433bc350134a927a092cb8d80883301

SHA1
bfa29e5ff6ba0e31080edbf291652bb3866adea5

SHA256
8c332fdaae2015d8799f28ff145e3c3bfc910b21e4bc060348bc14a02571d263

SHA512
1dd024b3beea5f2010a9abc112aaf8584b501a6713547513f83b818af0220102d7e5110e2da9acfd842a6d40a9eb2677005dcd78782a6b8dcefcb4deba7a3286

Download Submit
C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Blocker.gen-c3e42321bb29b53019db05c42ac32df3ad1d321bb2c14df6e2fdeba8b3395b2f.exe

Filesize
1.6MB

MD5
44b449a86cce2762f88533cc88224fb8

SHA1
ed10204843fcf17619104fb38155dd5c7e960e68

SHA256
c3e42321bb29b53019db05c42ac32df3ad1d321bb2c14df6e2fdeba8b3395b2f

SHA512
37f13cc02e1da96cb333cd17821ce7d542797579cbf09f101ccb4f98339fcac6f88bee257a2a619e4b57afbefce4c4139a907bf626df0c0bc753621eec61d0d8

Download Submit
C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61.exe

Filesize
212KB

MD5
a82d5bbfb026a00283a6fab1d4c530dc

SHA1
8974d9525d2b88d9f2a6ef26852f4afe63e6df04

SHA256
3d2eb2c3b8340f23e9430adc1520a663454d78a58123397306c1299278182b61

SHA512
5c73e2b419b9bc277a18fd49a54574f083c8e9d478caf3ad5bd02891ec449539bbcb5ffd96935ccd9e3c0d7b87a975ed6d655835f2fbd6dc1cde097802fd722e

Download Submit
C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Generic-3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589.exe

Filesize
134KB

MD5
177be764c1c73ef4026ef0cf4eb092fd

SHA1
16afc1cba4218a4fbe69a49f6d1925adfdb81d44

SHA256
3490a80aba091eae45ae42486dc547c57ed77eca58b4a7cf0fc8edb8c0059589

SHA512
151b719b9a9b4373990396091a908c98218495629a3e9f63188d9fb1ab037891e449fe026ef7b4a078b0df43410239dbd8f85ef9111984c6991a02d54e587f7c

Download Submit
C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Purgen.gen-57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d.exe

Filesize
212KB

MD5
57d1af97f896f63e67d416e617e8d57a

SHA1
9c8eec9dbee78ff521dd3eb6e71416071a86c660

SHA256
57d6047240c479e744ec79f261773e0af59294b9c64211baf52d968f23957e2d

SHA512
9c604720bceb5d69837be7a52d86b14d49bda4cc5b68d3336dc35ec75dfb25df8df3dd89fd3322e243d09d93cc931f8efc60facc851823b37174ba0769ccf8d7

Download Submit
C:\Users\Admin\Desktop\00359\HEUR-Trojan-Ransom.Win32.Shade.gen-49d24b253fd993f0712463c14d10fb813f1859f566915248925410d89ea3261f.exe

Filesize
1.0MB

MD5
793dea26a293ce3601186b4ca33adb6a

SHA1
ec858dfdf334a6827bda3649c5e244abb6ead095

SHA256
49d24b253fd993f0712463c14d10fb813f1859f566915248925410d89ea3261f

SHA512
ad17fe339721fb8c4395dda05e7c1535359ee85ec27fb7c20c1c3d806b6f03ac679bb397fe1e47345764dc094031fe95a7bc91c18ca1f92ad25cade843b16f92

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Agent.abxy-241f67ece26c9e6047bb1a9fc60bf7c45a23ea1a2bb08a1617a385c71d008d79.exe

Filesize
151KB

MD5
950ad3386d9ef1513dcc33a6955eaf40

SHA1
3f2fac9fba7463796d19863b2b8075aac1a6827b

SHA256
241f67ece26c9e6047bb1a9fc60bf7c45a23ea1a2bb08a1617a385c71d008d79

SHA512
5a6fca53319fe95bd8cc2871c4cdfdad94750d3af87cb39bcb45983f25e8b031467e6747af5c60108fd17ed0faaca5cbe7167bff57d26e20d71dd90df75987e3

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Agent.auwh-0e06e9f5f272d6b22274382cf282a4f58c37621a6855f69b1c91a7d72fc92354.exe

Filesize
304KB

MD5
903f9076aadc67938aed2929cc051d53

SHA1
ef6a480071e6fbe4b6304cf9245a0109824c0a89

SHA256
0e06e9f5f272d6b22274382cf282a4f58c37621a6855f69b1c91a7d72fc92354

SHA512
a37c1d3e11b47271c51c0451f1f5bfec49bf9ec3ccd035c1267ee403dc7a0ce216bf9de08895f269750f9f7070f63801ef0198f238163d0faa2cd2b5ace6b505

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Blocker.ahvx-aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8.exe

Filesize
427KB

MD5
203e091cc54f75ef817400b6b48dda07

SHA1
b34fa8dab0607e83847dd8fba28aef5c7af3907b

SHA256
aeb92c272f73c1988c1ff310bb4f0ac4382f2bf535163a2118a0842c398081f8

SHA512
3a78270f4ca58a25fe6df1a30272d97c745da7fe32b90a4068499d9994a1b0f6c658391506bb414dd709fa49fe5447031ab5e6c041612bd6cf628388d44648ac

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Blocker.hrft-3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3.exe

Filesize
852KB

MD5
176b5acb7e99a0f6b96e67008211a6ba

SHA1
3cc11249673f7d66ce36da881a461c12a435e421

SHA256
3bdc59efa34736457c7bb023c755470ef3bd29b81f733e59b2594f6373f876c3

SHA512
168744ff4454a49666092694bd2949d3bc5d50703d855077651fff3ba7be91e398d053a4fe797cdc74bfdfb52c8fa1e765bd4989ef46b47949610c5eb05ddf5a

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Blocker.hzrn-4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385.exe

Filesize
265KB

MD5
34e07acab1ab790cdb0c0967b65a3a42

SHA1
0eea0dbe1f7aad720ec0fc3f049d57fe0862150b

SHA256
4140a63746a4c34497872b7d392b0c5c4a832c2d128d00a29b60e504fb1d5385

SHA512
cf97e16cdf7415c35e358d5017794a4edcb74b431b3d737d3cd83e96f22f5adf8f80b873d9656a702eb30347410b4a7b3cfbc64ca459cd6fe0c570b31e1b48d1

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Blocker.kpuo-fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc.exe

Filesize
319KB

MD5
b027b503c1128e380f2ab028e30b2c67

SHA1
76e1c2d476a04d3bc3da4d5fc73e153ea847cf05

SHA256
fb520e7a482623c36218845e104d0b252ea7de1ae93ef2d2b4982c38e5e649bc

SHA512
1223c1dd68b202f679a194c13236c897ccf8db9a594a86024459e04fe12c1ccb31b0246784d3cb6117e48d1c756fbfa526f2371f7860385f3a0f4377cd776047

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.CryptXXX.asdgay-470aa0c87d97ecff284568ce271a61160ed1a885ee16c4d69c2239b36ad5eefe.exe

Filesize
1022KB

MD5
114d1985abea5e662059c9bd01d45310

SHA1
97b2e6b235fe314b995e20005dd2c2bea521b14a

SHA256
470aa0c87d97ecff284568ce271a61160ed1a885ee16c4d69c2239b36ad5eefe

SHA512
be575ac68c2d4e73645ffd5a5c71ed82061a66e111ceede93ccc0e1af89e1d5d33e1880b564b4da28d79ba13a7ba161b519592aa8eb959676eff757bebfd1fdf

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Hermez.gi-1d241bd0b71408abcf11871a9318cbfcd925b195814951c3123abca27554c6f4.exe

Filesize
328KB

MD5
3ef478a7c898e91f09385da44555d986

SHA1
07c1f289891b59892ae45253ffdc969f11267ac5

SHA256
1d241bd0b71408abcf11871a9318cbfcd925b195814951c3123abca27554c6f4

SHA512
e67b411fbc1a05a6482b03d8320fad0bd08836c5fa651b435473ee3233bb62240c1ffaab1ede7f58fee9eee70f4e313a230411a143495e2d30826546148cd4d1

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Mbro.bbvv-b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d.exe

Filesize
2.2MB

MD5
084f217e7ba8f8640fe5e6387358a230

SHA1
58fbdc2a0bb72742cd154d2f26749ccfd944a78e

SHA256
b1ed43ae9c7a83e1f74f0f88b19587e4b3c8cd4aa75a3bdfdf06b6efa761571d

SHA512
3069c9959af661280284b76443b9bf16569c91c7f74b4a4371c4c744bd667f9aecdaa1f5c881b59baf5e8e6b3330994b8c815de9cba68d6a0212a2ef6bdb70bf

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.SageCrypt.dhk-718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99.exe

Filesize
264KB

MD5
e2a49c9a5595bcb87c543621d559377f

SHA1
c3eb72a5dd9c4b88680d15fa9ae6c955ea2387bb

SHA256
718f64061f0fdcd190e45136f26cb423bd450b0423a943128e971d05bee50e99

SHA512
ad38132908173410d116d93c8b27472d3028450cb261df021c43ae05a9db69ddcdfb6436eb3ed242c15db397709ef9665ce648ec01f13b21efef6de24e33dba7

Download Submit
C:\Users\Admin\Desktop\00359\Trojan-Ransom.Win32.Shade.prf-aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c.exe

Filesize
1.4MB

MD5
02fd84c6593960c03958cf58cf4d063d

SHA1
bc9cc64e1538fcb4fc156a1403b83e08c2fac15d

SHA256
aa130fb22d7a8b354d0588858583bd29a2a0efa8a3f0b9830aa6e57f3a49558c

SHA512
337c17b32d4a266790c0f57c4468793edb36157dcfe396f8938473f1b6ef1eaac57437301e902cba3963947e320763c16e48b2795e5d9ef54cfec5508c099565

Download Submit
C:\Users\Admin\Saved Games\!HELP_SOS.hta

Filesize
107KB

MD5
76558871238a4b8eea25821ab4293326

SHA1
b72237b7ed81bc122b7833ce8981922b11206a36

SHA256
ebe049ca149a2652e26a1f931b9aea2d91a84a44082b1b1955868f1fb51f0b54

SHA512
21ef1d0c72684e89c7c39f27ac2856d6d8c6f545ed6b76ce4431ad101f9baa4b85e502ed5c3bbd705fc1b26d2eef6b08e1f5c7c4412ae89ae7217446958df2ae

Download Submit
C:\Users\Public\Videos\how_to_back_files.html

Filesize
4KB

MD5
a693ea3f3fd73660dd59146924661b39

SHA1
bc5070a44b1287dc535de8a36bc959e1a798606e

SHA256
2b9e3947d2dca95d0946d36aaf8fee2cf60144b44b28c07c04f7e52ddb6b3096

SHA512
688532215170488df7f2aa1b76f3675a206743501f624b5bee88a952da31fe8c2c7c5d9aa7e282d47ad9410441d028f558e38dd12ffe835d9c36359b576b8004

Download Submit
C:\Windows\Installer\MSI2B38.tmp

Filesize
85KB

MD5
5577a98daef4ba33e900a3e3108d6cc1

SHA1
5af817186ab0376a0433686be470ea2b48c74f5f

SHA256
148199b4f3b6b2030e2aeb63a66e8e333e692d38691bcbe39139cf02bb61b31d

SHA512
d37d511975b5331a5b1cdda736890c7d4f2dcba4abac2b9399c977bdb7e09c964327e3f771cd592e2632b0e776545c490f29fd391ec13c7948557957cd805dd5

Download Submit
C:\Windows\Installer\MSI2B49.tmp

Filesize
571KB

MD5
5a1e6b155435693938596d58eaca74bb

SHA1
27fb323ccc215136ef350469072b6ad559d39c3d

SHA256
f2d5eb947b85f763f72de7f800118844a5207c9e3dd456f13186c2aaf0c485ac

SHA512
4fee8576ef5541d4923aacb514b09e1e4dc8d6cbb1dcaada67c65240358147b971c2a1d034faf50c594ae7edb4a3c68dd4ffbbb69893413ffb52e71a86c65388

Download Submit
C:\Windows\Installer\MSI2B98.tmp

Filesize
32KB

MD5
8d4c7e2792f92d8e7cba3098a54c8e66

SHA1
d21b486f78aef95b7041d7e6966568ac3c550e3a

SHA256
aaf3e53a1a1aeadac1339b20e256eabc29502a9a583a7c18b29d6bba2adb1ab0

SHA512
b81598b2c47ebe78fb9851254b576885e7ba68b637337378c9e8e7928c72ffc89734c9a729dcb947aa64f8a89f07ef9c1751f64526e60cd72931b92662d2b91a

Download Submit
C:\Windows\Installer\MSI8AE6.tmp

Filesize
257KB

MD5
d1f5ce6b23351677e54a245f46a9f8d2

SHA1
0d5c6749401248284767f16df92b726e727718ca

SHA256
57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc

SHA512
960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba

Download Submit
C:\Windows\Installer\MSI9460.tmp

Filesize
363KB

MD5
4a843a97ae51c310b573a02ffd2a0e8e

SHA1
063fa914ccb07249123c0d5f4595935487635b20

SHA256
727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086

SHA512
905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2

Download Submit
C:\Windows\Installer\MSIC907.tmp

Filesize
350KB

MD5
9caf5e1999a4bd6ab8c4d4ea07818a7d

SHA1
fb1fe1d18fb670fbbf7461f449a473778b711717

SHA256
813ebc09bb3144d76f6f3a1550877c21590e0776f893915ca1178672e84ca1e7

SHA512
d40a70f7718adc63a21758ce43bd0c3f71abf4a4b7dd0639be3decf326a1b3281ac1043c519fd3f5cbae5ed6b3e59e3bd8d583c2ae253529fdd6d5225f41ab74

Download Submit
C:\Windows\Installer\MSIDBDD.tmp

Filesize
107KB

MD5
9f0b9bc54bb73dfb7cf85520da1a08cb

SHA1
236f7b770317d782f0817fbf7542140cb1e1526e

SHA256
0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f

SHA512
8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d

Download Submit
C:\Windows\Installer\MSIDD45.tmp

Filesize
148KB

MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
C:\Windows\Installer\MSIE277.tmp

Filesize
134KB

MD5
b8255a1bc3c307557741d2c99b8256d1

SHA1
48cc6f3c1a566f06684c5184cf830cbd7db638c2

SHA256
796aea9a46fb7704222a7fe1f4e27455b14640c816d6f961344f89dc47537b33

SHA512
85f685ad84f2208ad87ff34fb5e99edae50fc938a9335cb9747b7707d237c1b397c318090112eee0e9f04777ee004e26e7377f57c3e31159a96638b65110a69c

Download Submit
C:\Windows\SysWOW64\IExplorer.exe

Filesize
319KB

MD5
b27a04ee4aea674e6d583240815fec0e

SHA1
3740c640e57b0a54f6f9d99f6c3633bd819eebad

SHA256
73c15bc81fb037570ed24078dcc9bfd8d218d11707e337c1438d31eb96dc9c81

SHA512
7065da8b78b3ea0949c2cc10048d673d785a4000cc63d6fc2bc1941a0f4063d749bba705d20daaaea3425c359ecf465d110d25280dfbf03cd657bbf4b3d54385

Download Submit
C:\Windows\xk.exe

Filesize
319KB

MD5
348f35a9e5cc0e4bf0d6a98e312b2137

SHA1
7788e047b2b58c9ecfbd7603ff9ba081acd8ab38

SHA256
9b6d6b6f533820151c98d39eeacc666766d1f1aa65a2b956a52f9d188508ab7d

SHA512
e64fd29ff081db150499587a889110dcc0912bb5e370733695a5c66074df2514fbffd42b160664c99efe9053749028893587123fae5eeb8d7f41c476ca63a277

Download Submit
C:\XK\Folder.htt

Filesize
640B

MD5
5d142e7978321fde49abd9a068b64d97

SHA1
70020fcf7f3d6dafb6c8cd7a55395196a487bef4

SHA256
fe222b08327bbfb35cbd627c0526ba7b5755b02ce0a95823a4c0bf58e601d061

SHA512
2351284652a9a1b35006baf4727a85199406e464ac33cb4701a6182e1076aaff022c227dbe4ad6e916eba15ebad08b10719a8e86d5a0f89844a163a7d4a7bbf9

Download Submit
C:\desktop.ini

Filesize
217B

MD5
c00d8433fe598abff197e690231531e0

SHA1
4f6b87a4327ff5343e9e87275d505b9f145a7e42

SHA256
52fb776a91b260bf196016ecb195550cdd9084058fe7b4dd3fe2d4fda1b6470e

SHA512
a71523ec2bd711e381a37baabd89517dff6c6530a435f4382b7f4056f98aff5d6014e85ce3b79bd1f02fdd6adc925cd3fc051752c1069e9eb511a465cd9908e1

Download Submit
F:\DECRYPT_INFORMATION.html

Filesize
6KB

MD5
c3a884a06711793e2c4b892d31fec4ac

SHA1
10574e8f335986b79af4c54d88cd50be15c20fcd

SHA256
f5d3604bd6eb5a6779ab9b157e624ccaeb5e870408e3f33e5c89f615cc88b2df

SHA512
d5ff061078789a76c345f123eabe77eb205003a3e1a29096034a3057fc49f66c0ed82b5d88a20b0c745f94d257ef7d809509c08f7f1a4415b3bb5e92ba5548d8

Download Submit
\Users\Admin\AppData\Local\Temp\FB_739A.tmp.exe

Filesize
383KB

MD5
561674e508d910f7f3ad690e63c5a4ff

SHA1
7f74325e9927d35ae3115f25254d1027c5d6ada3

SHA256
d5b0f4f52fff7353781c712b8991d9bea2ceb9cb4b669d9fed4b578e6219eefa

SHA512
9d193c401e04c13f278420a15efc1339f22a6bdac13c6d1bb780b2f70a15308086d4d2a400b5f7d9aee4d77203572ac8103bd51d10e5031b3e456931ef40d45c

Download Submit
\Users\Admin\AppData\Local\Temp\FB_783D.tmp.com

Filesize
265KB

MD5
bbb0eaa3d707e757e7e92de8968f9fa5

SHA1
bade9eb744210496c4f53ddc44264d21f3c32732

SHA256
098f80e542a1e3c972a14a416077f8013730f2119d793b5009e9cc1a663a54a2

SHA512
9ef6b4f79af70c4c5239ade6309e35ccc66fcf52791ea73d84754e8236ac4ab75b68a1ad33519969a5b7884191b9f7a238f1e723dbbebbc2927922eedfb37d71

Download Submit
\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

Filesize
319KB

MD5
c971ae4d6c5c79d1b7666086cdf437ee

SHA1
4d5860d4189a827effedf62adaf8104650513d23

SHA256
4f4bc666e62a96bade6e1e6f75473a2173a20e0f437fbb40764cf092369eb508

SHA512
5ad50916a996257ba0d34fffff95faacae4e25cf270e218826ae723b9a2ce7fc9ba524fbe5f63f5140790979b5f9ebfb2f8abcc33b3348d0e6a02ca7d4b76dc0

Download Submit
memory/616-77-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/904-3313-0x00000000005D0000-0x00000000005DE000-memory.dmp

Filesize
56KB

Download
memory/904-167-0x0000000000B50000-0x0000000000B9A000-memory.dmp

Filesize
296KB

Download
memory/1380-146-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1380-147-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1380-148-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1380-149-0x0000000000400000-0x0000000000608000-memory.dmp

Filesize
2.0MB

Download
memory/1916-129-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-3161-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/1916-109-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-111-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-113-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-115-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-117-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-119-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-121-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-123-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-125-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-127-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-619-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/1916-131-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-133-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-135-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-137-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-107-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-105-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-139-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-141-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-143-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-145-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-93-0x0000000077020000-0x0000000077021000-memory.dmp

Filesize
4KB

Download
memory/1916-95-0x0000000077020000-0x0000000077021000-memory.dmp

Filesize
4KB

Download
memory/1916-99-0x00000000762B0000-0x00000000762B1000-memory.dmp

Filesize
4KB

Download
memory/1916-101-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/1916-104-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1916-84-0x0000000000400000-0x000000000092F000-memory.dmp

Filesize
5.2MB

Download
memory/1916-103-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1976-82-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1976-62-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1976-64-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1984-59-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/2080-1659-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2080-2754-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/2228-49-0x0000000000400000-0x00000000005A0000-memory.dmp

Filesize
1.6MB

Download
memory/2816-3386-0x0000000001220000-0x000000000126A000-memory.dmp

Filesize
296KB

Download
memory/2864-53-0x0000000000CD0000-0x0000000000DD6000-memory.dmp

Filesize
1.0MB

Download
memory/2864-176-0x00000000002A0000-0x00000000002C0000-memory.dmp

Filesize
128KB

Download
memory/2880-3022-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-2914-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-6682-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-6660-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-5760-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-5759-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-5113-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-5115-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-4491-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-4213-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-10439-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-3142-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-3141-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-18229-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-3019-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-10441-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-2916-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-2915-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-2911-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-35-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-2249-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-2246-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-1723-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-1724-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-34-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-36-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-18226-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2880-13159-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2928-90-0x00000000011A0000-0x0000000001208000-memory.dmp

Filesize
416KB

Download
memory/8912-12544-0x0000000000530000-0x00000000005A6000-memory.dmp

Filesize
472KB

Download
memory/8912-12325-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download