Overview

overview

10

Static

static

1

RNSM00284.7z

windows7-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    191s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-11-2024 18:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00284.7z

  • Size

    13.9MB

  • MD5

    e20f6ad9e266cbabca31feedc697cfa5

  • SHA1

    be955cbc02286ea800dd11887f63a624a25a8013

  • SHA256

    312fdde51aed90d23843d50649032290c89b8af4661d61f5baa032b03ba870db

  • SHA512

    112fcb80fa932efe1bf09cdf7c32350634e3ab6ed1ceb0ce66fed93830ecc47b7397b5d404cc2d20dad8368ddbd4c0d25d11b4dd144d46ecad4963ef893f58ab

  • SSDEEP

    393216:vzae+bw+rVeYq6BywWZSh7T3M6ZEWu8inEOiCR+zqQ97r6oaKh:qBBdq60wWE1E5bjiCR+zqQ97r6oa6

Score
10/10
cerbergozilockytroldeshbankercollectiondefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Cerber 7 IoCs

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber
  • Cerber family
    cerber
  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Gozi family
    gozi
  • Locky

    Ransomware strain released in 2016, with advanced features like anti-analysis.

    ransomwarelocky
  • Locky family
    locky
  • Troldesh family
    troldesh
  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Contacts a large (1111) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 57 IoCs
  • Loads dropped DLL 37 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 10 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • AutoIT Executable 6 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 38 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 44 IoCs
  • Suspicious use of SetThreadContext 18 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 6 IoCs
    installer
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 48 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1112
    • C:\Windows\System32\vssadmin.exe
      "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Interacts with shadow copies
      PID:2148
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1160
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1200
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00284.7z"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3040
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1288
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1864
      • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.MSIL.Agent.gen-fb8769784b31275e40a5095bfdcbae98a529e0055cc6ae71d7d3295c7825ebdc.exe
        HEUR-Trojan-Ransom.MSIL.Agent.gen-fb8769784b31275e40a5095bfdcbae98a529e0055cc6ae71d7d3295c7825ebdc.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
      • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.Win32.Foreign.gen-80ff7a0cd359ecd7ba5c5938d72f5bcb8d25a59580f230cb5ef622bc42c04dac.exe
        HEUR-Trojan-Ransom.Win32.Foreign.gen-80ff7a0cd359ecd7ba5c5938d72f5bcb8d25a59580f230cb5ef622bc42c04dac.exe
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of SetWindowsHookEx
        • System policy modification
        PID:568
      • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.Win32.Foreign.vho-b129043616d6771e6cb5f4343e9c3ac3308251a5e5ba97d4c3d2750b65c84290.exe
        HEUR-Trojan-Ransom.Win32.Foreign.vho-b129043616d6771e6cb5f4343e9c3ac3308251a5e5ba97d4c3d2750b65c84290.exe
        3⤵
        • Cerber
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        PID:2968
      • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.Win32.Generic-58ecd6b9e87f80026e3b063750f46166cf1fe21a5021f43fefce930376a2c26b.exe
        HEUR-Trojan-Ransom.Win32.Generic-58ecd6b9e87f80026e3b063750f46166cf1fe21a5021f43fefce930376a2c26b.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.Win32.Generic-58ecd6b9e87f80026e3b063750f46166cf1fe21a5021f43fefce930376a2c26b.exe
          HEUR-Trojan-Ransom.Win32.Generic-58ecd6b9e87f80026e3b063750f46166cf1fe21a5021f43fefce930376a2c26b.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1056
          • C:\Users\Admin\AppData\Roaming\Orzia\anetu.exe
            "C:\Users\Admin\AppData\Roaming\Orzia\anetu.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:1936
            • C:\Users\Admin\AppData\Roaming\Orzia\anetu.exe
              "C:\Users\Admin\AppData\Roaming\Orzia\anetu.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:992
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_673e08b6.bat"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:644
      • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.Win32.Zerber.vho-c9c68614f632f4059f51fce30fa7168253d741d978c4d7b74cca1dcef2819bc9.exe
        HEUR-Trojan-Ransom.Win32.Zerber.vho-c9c68614f632f4059f51fce30fa7168253d741d978c4d7b74cca1dcef2819bc9.exe
        3⤵
        • Cerber
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        PID:600
      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.NSIS.Zerber.abe-64b2284a54aa668dbc01b3a290f53370231f9551094f4d41de429804656a8aae.exe
        Trojan-Ransom.NSIS.Zerber.abe-64b2284a54aa668dbc01b3a290f53370231f9551094f4d41de429804656a8aae.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        PID:480
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.NSIS.Zerber.abe-64b2284a54aa668dbc01b3a290f53370231f9551094f4d41de429804656a8aae.exe
          Trojan-Ransom.NSIS.Zerber.abe-64b2284a54aa668dbc01b3a290f53370231f9551094f4d41de429804656a8aae.exe
          4⤵
          • Executes dropped EXE
          PID:1736
      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Blocker.jybg-c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae.exe
        Trojan-Ransom.Win32.Blocker.jybg-c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        PID:588
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Blocker.jybg-c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae.exe
          Trojan-Ransom.Win32.Blocker.jybg-c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:3048
          • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Blocker.jybg-c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae.exe
            "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Blocker.jybg-c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae.exe" /stext C:\ProgramData\Mails.txt
            5⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:3004
          • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Blocker.jybg-c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae.exe
            "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Blocker.jybg-c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae.exe" /stext C:\ProgramData\Browsers.txt
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1996
      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Foreign.njli-c2b0f00850007b801b9c4f5ad65768bba99412923ec0ddd33a99bcb5d146a1c2.exe
        Trojan-Ransom.Win32.Foreign.njli-c2b0f00850007b801b9c4f5ad65768bba99412923ec0ddd33a99bcb5d146a1c2.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious behavior: MapViewOfSection
        PID:1488
        • C:\Windows\syswow64\svchost.exe
          C:\Windows\syswow64\svchost.exe
          4⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2940
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            5⤵
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:2844
      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Foreign.nyyz-e6cef31d573eb1d167a53ca06d6542d4f5257b83931c2ebd3de13f2fda526b3e.exe
        Trojan-Ransom.Win32.Foreign.nyyz-e6cef31d573eb1d167a53ca06d6542d4f5257b83931c2ebd3de13f2fda526b3e.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        PID:2016
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Foreign.nyyz-e6cef31d573eb1d167a53ca06d6542d4f5257b83931c2ebd3de13f2fda526b3e.exe
          Trojan-Ransom.Win32.Foreign.nyyz-e6cef31d573eb1d167a53ca06d6542d4f5257b83931c2ebd3de13f2fda526b3e.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:2908
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\35B2\1DE.bat" "C:\Users\Admin\AppData\Roaming\MICROS~1\Cmdinput\dimsssec.exe" "C:\Users\Admin\Desktop\00284\TROJAN~4.EXE""
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2740
            • C:\Windows\SysWOW64\cmd.exe
              cmd /C ""C:\Users\Admin\AppData\Roaming\MICROS~1\Cmdinput\dimsssec.exe" "C:\Users\Admin\Desktop\00284\TROJAN~4.EXE""
              6⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:660
              • C:\Users\Admin\AppData\Roaming\MICROS~1\Cmdinput\dimsssec.exe
                "C:\Users\Admin\AppData\Roaming\MICROS~1\Cmdinput\dimsssec.exe" "C:\Users\Admin\Desktop\00284\TROJAN~4.EXE"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2780
                • C:\Users\Admin\AppData\Roaming\MICROS~1\Cmdinput\dimsssec.exe
                  "C:\Users\Admin\AppData\Roaming\MICROS~1\Cmdinput\dimsssec.exe" "C:\Users\Admin\Desktop\00284\TROJAN~4.EXE"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: MapViewOfSection
                  PID:3012
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe
                    9⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: MapViewOfSection
                    PID:2640
      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
        Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Enumerates connected drives
        • Sets desktop wallpaper using registry
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:1816
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\Documents\Temp\CANCER~6887.exe"
          4⤵
          • Executes dropped EXE
          PID:17064
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\Pictures\Temp\CANCER~87255.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:8104
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\Shared\Temp\CANCER~15899.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:9676
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\AppData\CANCER~60671.exe"
          4⤵
          • Executes dropped EXE
          PID:8456
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\AppData\Local\CANCER~6148.exe"
          4⤵
          • Executes dropped EXE
          PID:8808
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\AppData\Roaming\CANCER~33585.exe"
          4⤵
          • Executes dropped EXE
          PID:7620
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\Program Data\CANCER~89709.exe"
          4⤵
          • Executes dropped EXE
          PID:4936
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Program Files\zzz_Cancer\CANCER~29930.exe"
          4⤵
          • Executes dropped EXE
          PID:7580
        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Program Files\_\CANCER~17627.exe"
          4⤵
            PID:6776
          • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
            "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Programs\Eww\CANCER~99196.exe"
            4⤵
              PID:15596
            • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
              "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Windows\XLIN\CANCER~17078.exe"
              4⤵
                PID:15428
              • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Windows\D-Link\Media\CANCER~26033.exe"
                4⤵
                  PID:15400
                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                  "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Temp\Cached\CANCER~57722.exe"
                  4⤵
                    PID:15384
                  • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                    "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\CANCER~52532.exe"
                    4⤵
                      PID:15364
                    • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                      "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Program Data\CANCER~60017.exe"
                      4⤵
                        PID:2764
                    • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.aam-07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced.exe
                      Trojan-Ransom.Win32.Locky.aam-07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced.exe
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      PID:1656
                      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.aam-07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced.exe
                        "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.aam-07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:996
                      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.aam-07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced.exe
                        "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.aam-07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced.exe"
                        4⤵
                        • Executes dropped EXE
                        PID:1104
                      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.aam-07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced.exe
                        "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.aam-07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced.exe"
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1976
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 200
                          5⤵
                          • Loads dropped DLL
                          • Program crash
                          PID:1644
                    • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.b-5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8.exe
                      Trojan-Ransom.Win32.Locky.b-5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8.exe
                      3⤵
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      PID:1988
                      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
                        C:\Users\Admin\AppData\Local\Temp\svchost.exe
                        4⤵
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1856
                      • C:\Windows\system32\cmd.exe
                        cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sys7EC1.tmp"
                        4⤵
                          PID:620
                      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.sg-d2954337252fb727b01a7e2a8e4c4b451cb00c9abe6dec34b8b143d845a00111.exe
                        Trojan-Ransom.Win32.Locky.sg-d2954337252fb727b01a7e2a8e4c4b451cb00c9abe6dec34b8b143d845a00111.exe
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                        PID:1640
                      • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.xfj-b56ad0d8b823c049dc99ae0897a90ee0c1bfe6e2e8496026a1be1c075524c489.exe
                        Trojan-Ransom.Win32.Locky.xfj-b56ad0d8b823c049dc99ae0897a90ee0c1bfe6e2e8496026a1be1c075524c489.exe
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                        PID:1664
                        • C:\Program Files\Internet Explorer\iexplore.exe
                          "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm
                          4⤵
                            PID:18136
                            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:18136 CREDAT:275457 /prefetch:2
                              5⤵
                                PID:8648
                            • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                              "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\DesktopOSIRIS.bmp"
                              4⤵
                                PID:18880
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sys86AD.tmp"
                                4⤵
                                  PID:19020
                              • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.xlf-60e67e18aecf1be2974966e38f4b179c2643953a27be20da69032fb38f529e29.exe
                                Trojan-Ransom.Win32.Locky.xlf-60e67e18aecf1be2974966e38f4b179c2643953a27be20da69032fb38f529e29.exe
                                3⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1984
                                • C:\Program Files\Internet Explorer\iexplore.exe
                                  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm
                                  4⤵
                                    PID:10080
                                  • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                                    "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\DesktopOSIRIS.bmp"
                                    4⤵
                                      PID:11112
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sysC429.tmp"
                                      4⤵
                                        PID:13468
                                    • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.xpc-f76b705326288636963dd42819ce4705615cbb5a34ce6e9fca3a5419d66ba1f8.exe
                                      Trojan-Ransom.Win32.Locky.xpc-f76b705326288636963dd42819ce4705615cbb5a34ce6e9fca3a5419d66ba1f8.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                      PID:2144
                                      • C:\Program Files\Internet Explorer\iexplore.exe
                                        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\DesktopOSIRIS.htm
                                        4⤵
                                          PID:12048
                                        • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                                          "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\DesktopOSIRIS.bmp"
                                          4⤵
                                            PID:17476
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\sys5419.tmp"
                                            4⤵
                                              PID:17584
                                          • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Shade.ljz-8afb1aea361d8097f47f263b6c777155fda1d485943e7fa0d7de24bfb7db8490.exe
                                            Trojan-Ransom.Win32.Shade.ljz-8afb1aea361d8097f47f263b6c777155fda1d485943e7fa0d7de24bfb7db8490.exe
                                            3⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            • Suspicious behavior: MapViewOfSection
                                            PID:2956
                                            • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Shade.ljz-8afb1aea361d8097f47f263b6c777155fda1d485943e7fa0d7de24bfb7db8490.exe
                                              Trojan-Ransom.Win32.Shade.ljz-8afb1aea361d8097f47f263b6c777155fda1d485943e7fa0d7de24bfb7db8490.exe
                                              4⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • System Location Discovery: System Language Discovery
                                              PID:1668
                                          • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Shade.low-9d9ea2fc9705bc38323cc006742d98f97b6f1093dc1042bcd69daa06be7445ac.exe
                                            Trojan-Ransom.Win32.Shade.low-9d9ea2fc9705bc38323cc006742d98f97b6f1093dc1042bcd69daa06be7445ac.exe
                                            3⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            • Suspicious behavior: MapViewOfSection
                                            PID:2696
                                            • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Shade.low-9d9ea2fc9705bc38323cc006742d98f97b6f1093dc1042bcd69daa06be7445ac.exe
                                              Trojan-Ransom.Win32.Shade.low-9d9ea2fc9705bc38323cc006742d98f97b6f1093dc1042bcd69daa06be7445ac.exe
                                              4⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:1264
                                          • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Snocry.cvs-e1c59c0eb434fb93001c0d766b6cb3191f6143c693b11bde5151d495a1834fb5.exe
                                            Trojan-Ransom.Win32.Snocry.cvs-e1c59c0eb434fb93001c0d766b6cb3191f6143c693b11bde5151d495a1834fb5.exe
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                            PID:2432
                                            • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Snocry.cvs-e1c59c0eb434fb93001c0d766b6cb3191f6143c693b11bde5151d495a1834fb5.exe
                                              C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Snocry.cvs-e1c59c0eb434fb93001c0d766b6cb3191f6143c693b11bde5151d495a1834fb5.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\delph1.dat"
                                              4⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Enumerates connected drives
                                              • System Location Discovery: System Language Discovery
                                              PID:2360
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /C echo. > "C:\Users\Admin\AppData\Roaming\Isass.exe":Zone.Identifier
                                                5⤵
                                                  PID:3984
                                                • C:\Users\Admin\AppData\Roaming\Isass.exe
                                                  C:\Users\Admin\AppData\Roaming\Isass.exe
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:6788
                                                  • C:\Users\Admin\AppData\Roaming\Isass.exe
                                                    C:\Users\Admin\AppData\Roaming\Isass.exe /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Local\Temp\delph1.dat"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1776
                                            • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.dass-fd4a9100bf1ee71981dc4538cccb5fd5f68db8c1b51d3d12412bb6c392e59c89.exe
                                              Trojan-Ransom.Win32.Zerber.dass-fd4a9100bf1ee71981dc4538cccb5fd5f68db8c1b51d3d12412bb6c392e59c89.exe
                                              3⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetThreadContext
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                              PID:2064
                                              • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.dass-fd4a9100bf1ee71981dc4538cccb5fd5f68db8c1b51d3d12412bb6c392e59c89.exe
                                                Trojan-Ransom.Win32.Zerber.dass-fd4a9100bf1ee71981dc4538cccb5fd5f68db8c1b51d3d12412bb6c392e59c89.exe
                                                4⤵
                                                • Cerber
                                                • Drops startup file
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Drops file in System32 directory
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Modifies data under HKEY_USERS
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2988
                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                                                  "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\Desktop\_READ_THIS_FILE_EYEY6_.hta"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:7808
                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                                                  "C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe" "C:\Users\Admin\Desktop\_READ_THIS_FILE_YT543_.txt"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:8688
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\system32\cmd.exe"
                                                  5⤵
                                                    PID:20964
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      taskkill /f /im "Trojan-Ransom.Win32.Zerber.dass-fd4a9100bf1ee71981dc4538cccb5fd5f68db8c1b51d3d12412bb6c392e59c89.exe"
                                                      6⤵
                                                      • Cerber
                                                      • Kills process with taskkill
                                                      PID:21404
                                              • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.fbbx-f33ce56c4ae43ce0f52ad3530fc6b8394e47d28d5c6981f1722b419673771415.exe
                                                Trojan-Ransom.Win32.Zerber.fbbx-f33ce56c4ae43ce0f52ad3530fc6b8394e47d28d5c6981f1722b419673771415.exe
                                                3⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                • Suspicious behavior: MapViewOfSection
                                                PID:820
                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.fbbx-f33ce56c4ae43ce0f52ad3530fc6b8394e47d28d5c6981f1722b419673771415.exe
                                                  Trojan-Ransom.Win32.Zerber.fbbx-f33ce56c4ae43ce0f52ad3530fc6b8394e47d28d5c6981f1722b419673771415.exe
                                                  4⤵
                                                  • Cerber
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2272
                                              • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.fxnh-f0e7364a7569254b85a977c07c65ba668e7e188bab5af80250daeb5e29610762.exe
                                                Trojan-Ransom.Win32.Zerber.fxnh-f0e7364a7569254b85a977c07c65ba668e7e188bab5af80250daeb5e29610762.exe
                                                3⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                PID:2112
                                              • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.gdwr-07da34d4b85beffa8f28af3116ee5dd7c9fe430c0792b1f5d3ef146a855eb2c5.exe
                                                Trojan-Ransom.Win32.Zerber.gdwr-07da34d4b85beffa8f28af3116ee5dd7c9fe430c0792b1f5d3ef146a855eb2c5.exe
                                                3⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2532
                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.gdwr-07da34d4b85beffa8f28af3116ee5dd7c9fe430c0792b1f5d3ef146a855eb2c5.exe
                                                  Trojan-Ransom.Win32.Zerber.gdwr-07da34d4b85beffa8f28af3116ee5dd7c9fe430c0792b1f5d3ef146a855eb2c5.exe
                                                  4⤵
                                                  • Cerber
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1500
                                              • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.qkw-b980472da4a223c4c07d406b1f86b0d9705a01bacab56930c6ffcb27e3c85288.exe
                                                Trojan-Ransom.Win32.Zerber.qkw-b980472da4a223c4c07d406b1f86b0d9705a01bacab56930c6ffcb27e3c85288.exe
                                                3⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                                                • Suspicious behavior: MapViewOfSection
                                                PID:1364
                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.qkw-b980472da4a223c4c07d406b1f86b0d9705a01bacab56930c6ffcb27e3c85288.exe
                                                  Trojan-Ransom.Win32.Zerber.qkw-b980472da4a223c4c07d406b1f86b0d9705a01bacab56930c6ffcb27e3c85288.exe
                                                  4⤵
                                                  • Cerber
                                                  • Executes dropped EXE
                                                  PID:2456
                                          • C:\Windows\system32\DllHost.exe
                                            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                            1⤵
                                              PID:1440
                                            • C:\Windows\system32\conhost.exe
                                              \??\C:\Windows\system32\conhost.exe "-1302882154-1818028051093790043-1770298503-120566053816624992562034640893417455455"
                                              1⤵
                                                PID:1824
                                              • C:\Windows\system32\conhost.exe
                                                \??\C:\Windows\system32\conhost.exe "-8691233731722743608-16039759401459726247196649821411198501828253431841236147313"
                                                1⤵
                                                  PID:2584
                                                • C:\Windows\system32\conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe "-4867871061683322829-21186686931187872054-1105586769-150273517314707487347924672"
                                                  1⤵
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:592
                                                • C:\Windows\system32\DllHost.exe
                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                  1⤵
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:2156
                                                • C:\Windows\system32\vssvc.exe
                                                  C:\Windows\system32\vssvc.exe
                                                  1⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2716
                                                • C:\Windows\system32\DllHost.exe
                                                  C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
                                                  1⤵
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:1004
                                                • C:\Windows\system32\conhost.exe
                                                  \??\C:\Windows\system32\conhost.exe "548002949-1496628644-1055361255-107219823984446616-188655823620620435441476897889"
                                                  1⤵
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:2744
                                                • C:\Windows\system32\DllHost.exe
                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                  1⤵
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  PID:6828
                                                • C:\Windows\system32\DllHost.exe
                                                  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                  1⤵
                                                    PID:16284
                                                  • C:\Windows\SysWOW64\DllHost.exe
                                                    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
                                                    1⤵
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies data under HKEY_USERS
                                                    PID:15668
                                                  • C:\Windows\system32\DllHost.exe
                                                    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                    1⤵
                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                    PID:15564
                                                  • C:\Windows\SysWOW64\DllHost.exe
                                                    C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
                                                    1⤵
                                                      PID:220
                                                    • C:\Windows\system32\AUDIODG.EXE
                                                      C:\Windows\system32\AUDIODG.EXE 0x564
                                                      1⤵
                                                        PID:17908
                                                      • C:\Windows\SysWOW64\DllHost.exe
                                                        C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
                                                        1⤵
                                                          PID:3788
                                                        • C:\Windows\system32\AUDIODG.EXE
                                                          C:\Windows\system32\AUDIODG.EXE 0x5e8
                                                          1⤵
                                                            PID:6592
                                                          • C:\Windows\system32\AUDIODG.EXE
                                                            C:\Windows\system32\AUDIODG.EXE 0x5f0
                                                            1⤵
                                                              PID:20104
                                                            • C:\Windows\system32\AUDIODG.EXE
                                                              C:\Windows\system32\AUDIODG.EXE 0x5f4
                                                              1⤵
                                                                PID:22060
                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                C:\Windows\system32\AUDIODG.EXE 0x604
                                                                1⤵
                                                                  PID:14248

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Reconnaissance

                                                                Resource Development

                                                                Initial Access

                                                                Execution

                                                                Windows Management Instrumentation

                                                                1
                                                                T1047

                                                                Persistence

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Privilege Escalation

                                                                Abuse Elevation Control Mechanism

                                                                1
                                                                T1548

                                                                Bypass User Account Control

                                                                1
                                                                T1548.002

                                                                Boot or Logon Autostart Execution

                                                                1
                                                                T1547

                                                                Registry Run Keys / Startup Folder

                                                                1
                                                                T1547.001

                                                                Defense Evasion

                                                                Abuse Elevation Control Mechanism

                                                                1
                                                                T1548

                                                                Bypass User Account Control

                                                                1
                                                                T1548.002

                                                                Direct Volume Access

                                                                1
                                                                T1006

                                                                Impair Defenses

                                                                1
                                                                T1562

                                                                Disable or Modify Tools

                                                                1
                                                                T1562.001

                                                                Indicator Removal

                                                                3
                                                                T1070

                                                                File Deletion

                                                                3
                                                                T1070.004

                                                                Modify Registry

                                                                4
                                                                T1112

                                                                Credential Access

                                                                Credentials from Password Stores

                                                                1
                                                                T1555

                                                                Credentials from Web Browsers

                                                                1
                                                                T1555.003

                                                                Unsecured Credentials

                                                                1
                                                                T1552

                                                                Credentials In Files

                                                                1
                                                                T1552.001

                                                                Discovery

                                                                Network Service Discovery

                                                                1
                                                                T1046

                                                                Peripheral Device Discovery

                                                                1
                                                                T1120

                                                                Query Registry

                                                                2
                                                                T1012

                                                                System Information Discovery

                                                                4
                                                                T1082

                                                                System Location Discovery

                                                                1
                                                                T1614

                                                                System Language Discovery

                                                                1
                                                                T1614.001

                                                                Lateral Movement

                                                                Collection

                                                                Data from Local System

                                                                1
                                                                T1005

                                                                Email Collection

                                                                1
                                                                T1114

                                                                Command and Control

                                                                Exfiltration

                                                                Impact

                                                                Defacement

                                                                1
                                                                T1491

                                                                Inhibit System Recovery

                                                                2
                                                                T1490

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml
                                                                  Filesize

                                                                  7B

                                                                  MD5

                                                                  44f601e6b6d1113354b901483b2e624c

                                                                  SHA1

                                                                  f39912a200b8a49c8ea43ec7085f498cae4324c7

                                                                  SHA256

                                                                  4dde4c53d78e3e01233b0019370fcdba1e04acf2070f83e843f990a7f6d941b3

                                                                  SHA512

                                                                  98d3dcc0a164d2cc56079d38fc0fb6a1de6113bc1451f2603c187c43b265e0884dc842956327340a5299536a5fe4234b11a5aed1b48da69b62788200578cf8e4

                                                                  Download Submit

                                                                • C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.es\OSIRIS-2e91.htm
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  9ad08cb43bc9838e9891fc218d8b96cd

                                                                  SHA1

                                                                  1849bfeefb3134680bb23fd6b98ed206a40abe43

                                                                  SHA256

                                                                  140122d24a0436df02bce876332c8a4c6d9241f53916a5a38fd9334cc071c602

                                                                  SHA512

                                                                  663225f94913a9121f529bc87fe2c67b6ede0175ffdae187450b479970107c664f1320f269465c1d5ce63235de44ff6029f50545f73e5c43d8772955d9562c38

                                                                  Download Submit

                                                                • C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\OSIRIS-6855.htm
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  7876196e374738d70a6ebc1921ed5b49

                                                                  SHA1

                                                                  8e76a4407f8ec1374234716975c9c1eb92cdbe43

                                                                  SHA256

                                                                  c8cd06585a2fc2c0eac9739200263f3a6cfb602ba84c4240690c5d77a7ac997a

                                                                  SHA512

                                                                  5484a1db3199b6c3ca833f359df5546ab3b935299e554cb9d1618b8ef0d7d19043fe0be247e3b18a19203ea645a8318dbdd4fad33eea2730cbab6e2dc9ca8cc9

                                                                  Download Submit

                                                                • C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\OSIRIS-4360.htm
                                                                  Filesize

                                                                  9KB

                                                                  MD5

                                                                  f301d34832fe2e9cd765dc6508a7fe92

                                                                  SHA1

                                                                  b65c1a9b0a62c8c5542afc36939f39d5726f665d

                                                                  SHA256

                                                                  b23ea288cb2211df2874ec2b4c3544a9a34fc986613cf2a364ca755474e076f2

                                                                  SHA512

                                                                  f3f457a803334a81d3fcc1fb232e3df339afae831d34f03a7c9e4400bcd801de7c273500c1f9da98c16ccdde7dabeb14b71684397d27e029d573613ac26229b2

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\35B2\1DE.bat
                                                                  Filesize

                                                                  112B

                                                                  MD5

                                                                  d3ba78ab4c862936257294dd2c947816

                                                                  SHA1

                                                                  07a5e7f01b7c0b3aced48183095de495c797b00c

                                                                  SHA256

                                                                  12c2cc2fa19f0230fde0ff150285fee992358d7cb8027649b846d4292c50c545

                                                                  SHA512

                                                                  8bff939cf4bc164b41437e1e8c92878ee044d6d521c87ffc888505816eb400469266971ad433e3db8593574853b3be5b34b1d089493657965246e365c584b7f3

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\autD96E.tmp
                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  e0be013e69b55b08c6fb06a4cdd26bb9

                                                                  SHA1

                                                                  7e33f6a08cc7e4917960de7cbfc8734e1ed1472e

                                                                  SHA256

                                                                  1bab4ebf3e8c368f58fd683ff078a7d6941885ff46c115f0814f56968bdce2f9

                                                                  SHA512

                                                                  3b9da4947be3474e3fd7d25a1351d92c45267c661aa0f6928eb1dc670116a2d7e9fb1c201fe76191be913cba11fea9c1d40a09edb821a12aa66cbec99fc62a97

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\delph1.bin
                                                                  Filesize

                                                                  105KB

                                                                  MD5

                                                                  af1991a884db5eecd55241d859d11021

                                                                  SHA1

                                                                  a560421bd55eed8ef52bfd3a07003ef32f1c417b

                                                                  SHA256

                                                                  c8f29fe24718c0664a8deea759b39b2e951a80cab2568599ed77b2e1eb7b60e4

                                                                  SHA512

                                                                  c40c9c09844d244540e4589e48265e7fc4da18e1c5bc6052b0ff17d842bb221822aea1beaae2a50066e2acd64fa6a58aa08671eb7f0c12052b7dc12443ad4564

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\ecolzud
                                                                  Filesize

                                                                  51KB

                                                                  MD5

                                                                  5945b457e6a22704f1715c12d96d97e6

                                                                  SHA1

                                                                  a0346b93dbe83e5b3b6f0d5ac1e91697ad84823e

                                                                  SHA256

                                                                  44ef29461edd58480464f5b9a8a2d68ce061f6792cdf0621b02b4106189b2378

                                                                  SHA512

                                                                  83030e5b7bc9a8d10a18313c105445741dca35e7cd1efb7787ca959c30c76399c1572af86999f6ea90a3b9d6c5be063c714134b5ac1759d535f44d6307b33394

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\igyyxbe
                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  614cf2d306f66b3635b27eeda61a56ff

                                                                  SHA1

                                                                  0585341ee37857422fba8faac7c8de250a801fed

                                                                  SHA256

                                                                  4043bd7ac630ecca22a91987086948b2a8df87bdafcccb3efce198c01a1a6f3b

                                                                  SHA512

                                                                  fc3009f33d820889632453dde343f4a979ef44292a2287d2344a0892dc3a4f8db739e37125b4eac75e8d000c8aabccab1d78dd017c31aa6695ad89dfb9a15e64

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\pd4ta.bin
                                                                  Filesize

                                                                  3KB

                                                                  MD5

                                                                  fb424c74c8f4efaf76ae6aa153cd9da9

                                                                  SHA1

                                                                  77a02556e59b14f86ad206a21f14619dfe33d31a

                                                                  SHA256

                                                                  bda503202f603ff9f32d06627b26a85954b5dca0b3bfb8f8944bff4a87058b7e

                                                                  SHA512

                                                                  eb2b1bfe7ced1623dd7789b00b25ef2b21a4344d4a06e667fd0c43e9f8ca007a917b3da6571854c047aabc9c63b41ff75a8f2ca6892e27a3ceb05247e9937ea3

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\planlogo.gif
                                                                  Filesize

                                                                  18KB

                                                                  MD5

                                                                  52efabdab8b4f0e23d4f4de2a0efba91

                                                                  SHA1

                                                                  4c78d905fa9225c8e7ce4f482be0490b3e2519d2

                                                                  SHA256

                                                                  818538cde0338c2935ace15543d3e5160836d13925bf5f5b92e6e1596db35d9e

                                                                  SHA512

                                                                  78d5efd108911bd44fb0e9eb82b72b03e6f4f1b595d4cbea4b11ca52a63f565e36541925895c0bd81cb48f650a63adf9d88103edd34dc5e3d1ff3d97c4f87164

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Temp\tmp_673e08b6.bat
                                                                  Filesize

                                                                  364B

                                                                  MD5

                                                                  e9364ca2b956f270c98d3e80ad1fcba6

                                                                  SHA1

                                                                  f572fdc9a3e445f440c45699ba2782c870205221

                                                                  SHA256

                                                                  25eacf3b2a66f75c69eb09d4b8d2a1de6dcffdb0158dcc94c9a959eeeab901f0

                                                                  SHA512

                                                                  459021c36db31be5bcf89dcb0f56f21b7f27f8c025ed073fdbf03745821fc69ae4ea95bcb8433fbdb4981900baddc52803b477537b3585fa7a1ff5f6833d39ab

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_CB9BAC2A7DD34BED8C239BA9B7372F23.dat
                                                                  Filesize

                                                                  940B

                                                                  MD5

                                                                  b2f1e30e15a4d4b2e098222c92d909cb

                                                                  SHA1

                                                                  022d7bd3a250d37834d0d6fbd27f63d97cbb71cc

                                                                  SHA256

                                                                  510889c9be43c0c8d7803dc5af97b2560beb781377bac0f4ee039f2bff8ef561

                                                                  SHA512

                                                                  18a4ac4e89703e0bd247feda54eb5d87f684ebaae1fd88b9ecfb6eb905c7b8c26f5d7a681bd8fab847e5470c0c666e860ea1bf8f84b259425dec417f3c8f23b8

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.MSIL.Agent.gen-fb8769784b31275e40a5095bfdcbae98a529e0055cc6ae71d7d3295c7825ebdc.exe
                                                                  Filesize

                                                                  207KB

                                                                  MD5

                                                                  8027c5d23113279e2590281319119728

                                                                  SHA1

                                                                  a6545cc8149b2624a731270204af0a2f2cd5ce12

                                                                  SHA256

                                                                  fb8769784b31275e40a5095bfdcbae98a529e0055cc6ae71d7d3295c7825ebdc

                                                                  SHA512

                                                                  0f912b5077b5f3db5b8f227e3098481306680c4d7219e6f7fbcd718683c98ca80397c4c8b9bbb8609421ba8809fa0869cf9e9dc1909bc463e4e806377871dadd

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.Win32.Foreign.gen-80ff7a0cd359ecd7ba5c5938d72f5bcb8d25a59580f230cb5ef622bc42c04dac.exe
                                                                  Filesize

                                                                  3.1MB

                                                                  MD5

                                                                  00a350897132e68bf9d6b1b6d11acb88

                                                                  SHA1

                                                                  035de4fbcc6b3f0f1436046b43fc9caa275593e5

                                                                  SHA256

                                                                  80ff7a0cd359ecd7ba5c5938d72f5bcb8d25a59580f230cb5ef622bc42c04dac

                                                                  SHA512

                                                                  adfa8de360769fd258ec42069434713bd10a53d23e0f6ea5e9da5a130ab1383d15c59f9349c7adec0ec73ac5ba336a6242b9a1c9fa95aa1259d5c0ee1a221117

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.Win32.Foreign.vho-b129043616d6771e6cb5f4343e9c3ac3308251a5e5ba97d4c3d2750b65c84290.exe
                                                                  Filesize

                                                                  249KB

                                                                  MD5

                                                                  a788815bbdd4495cb3dbfc532b5ead93

                                                                  SHA1

                                                                  4852539c0f33f3edf694751f58a7899f492d257d

                                                                  SHA256

                                                                  b129043616d6771e6cb5f4343e9c3ac3308251a5e5ba97d4c3d2750b65c84290

                                                                  SHA512

                                                                  475cf0e19ac027ece932c82e0bfb378b0d960d53525508980105594c7423ddf7ec59853b97fcdfc8d1ad746b0387916de441d4e681fa25e1b335d31da0ad3657

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.Win32.Generic-58ecd6b9e87f80026e3b063750f46166cf1fe21a5021f43fefce930376a2c26b.exe
                                                                  Filesize

                                                                  184KB

                                                                  MD5

                                                                  8254a63ed8b2e0001f58b4922637c4a4

                                                                  SHA1

                                                                  d3c414410c1feb8c2cd8660c1aa08d9780aed3d9

                                                                  SHA256

                                                                  58ecd6b9e87f80026e3b063750f46166cf1fe21a5021f43fefce930376a2c26b

                                                                  SHA512

                                                                  ba36d888af961015679e7e4d7e7089dc5709ae4386615a525519c6f24e2589bbd261185a4f257272f58178d7ae19b3481926724ed3a1da2962d6d6bd862667d5

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\HEUR-Trojan-Ransom.Win32.Zerber.vho-c9c68614f632f4059f51fce30fa7168253d741d978c4d7b74cca1dcef2819bc9.exe
                                                                  Filesize

                                                                  259KB

                                                                  MD5

                                                                  a64bc28d08d5375a5d3fd3b36cf2e700

                                                                  SHA1

                                                                  7428aae3ab1f695ec4dfd54dc6c40770edd30e2a

                                                                  SHA256

                                                                  c9c68614f632f4059f51fce30fa7168253d741d978c4d7b74cca1dcef2819bc9

                                                                  SHA512

                                                                  dbb6cc006357d4a3edd6a3a6f4bf2312fc32774540e8c1d961a253a78a6f1e81bf4739fe06e4a83d56293e4b122492059ea2ca10aa23e3472224abc3d9f6cec5

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.NSIS.Zerber.abe-64b2284a54aa668dbc01b3a290f53370231f9551094f4d41de429804656a8aae.exe
                                                                  Filesize

                                                                  756KB

                                                                  MD5

                                                                  a438050c49aced04ae3b2e2086657a8d

                                                                  SHA1

                                                                  ae9bc0298bcb80327b1621f1169ccf3882865189

                                                                  SHA256

                                                                  64b2284a54aa668dbc01b3a290f53370231f9551094f4d41de429804656a8aae

                                                                  SHA512

                                                                  98e2b33187bcb361faa42e8ab4a29524eee5d56ffa8bf503993f8c2682e118c97c3e9af639b196663d261e1744a84c695886cc9d8b059cdfc1e0b66beca10366

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Blocker.jybg-c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae.exe
                                                                  Filesize

                                                                  1.3MB

                                                                  MD5

                                                                  af0b3041efa3c657b235c06bae94fa39

                                                                  SHA1

                                                                  ea8e11bf1fa17c845883562c7fb8f1c990c9b869

                                                                  SHA256

                                                                  c638a00a3353e475b1f411274cc7f2d2983f60e36cff5ef724176bcd795c97ae

                                                                  SHA512

                                                                  fcd159fa9b9e432f56c7e5c0c1ae407fe97e030ae37719c7aa1645b2c9762dfa1adaf3b6e31b136dcbc75122e7319b3517223489d6c40d2b2d85bd59332c104d

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Foreign.njli-c2b0f00850007b801b9c4f5ad65768bba99412923ec0ddd33a99bcb5d146a1c2.exe
                                                                  Filesize

                                                                  443KB

                                                                  MD5

                                                                  07484140601b38187c94784180760bfa

                                                                  SHA1

                                                                  7e7f357debc701b26493fb240d6e99e1eee4f976

                                                                  SHA256

                                                                  c2b0f00850007b801b9c4f5ad65768bba99412923ec0ddd33a99bcb5d146a1c2

                                                                  SHA512

                                                                  f16d7ef0241415d5ff4e863ab3fcc0d0a1fc3423306aca1657a3f3eba2c8921c62149ffef7d7e330c3e6d2c1308fab5eda46046a31fb445933291695542ccf26

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Foreign.nyyz-e6cef31d573eb1d167a53ca06d6542d4f5257b83931c2ebd3de13f2fda526b3e.exe
                                                                  Filesize

                                                                  350KB

                                                                  MD5

                                                                  7168523b8e0a72e147e6f443ed98b1f9

                                                                  SHA1

                                                                  6a267bc830cf3a75b6e250321119e18a3ef4f92c

                                                                  SHA256

                                                                  e6cef31d573eb1d167a53ca06d6542d4f5257b83931c2ebd3de13f2fda526b3e

                                                                  SHA512

                                                                  997f8cc642a513a04ae00b78f75172c0d50a499882d115eafebd0ba63bbf212bd4e07307811e375d3e376d5f0b789adaba7519ae080d920639dfac27c7f47f3a

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Gen.cgg-30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760.exe
                                                                  Filesize

                                                                  6.8MB

                                                                  MD5

                                                                  b5bae1ed2fde118e256ede9d86affe42

                                                                  SHA1

                                                                  4870df80763feae4870e674a93515a2635637748

                                                                  SHA256

                                                                  30616f6c488fa16ccdcbfd6273e7ac8604c82bc1468fc1a70b2a43661b674760

                                                                  SHA512

                                                                  00c871aaf12b9690d99ec2797758e69a7513da378cf6d7a2f7e0d3c2095267b346aee5fd7585121bdd5c3ff112f832d810367788136c5bb68758675c4eec5bfa

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.aam-07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced.exe
                                                                  Filesize

                                                                  213KB

                                                                  MD5

                                                                  db579e92844d6b5d1281488dee6d85c4

                                                                  SHA1

                                                                  f970da464c7e0afec247dd9d66a5a59c9db58e60

                                                                  SHA256

                                                                  07f399154fcd8861ecfabee5ecf7de637b5a0191b8fdb29ab22302e159001ced

                                                                  SHA512

                                                                  dfc7e0cfe6dc7fa2d1f4de95cee83df652363e24dc60134cf7c3f63031ee8dbcadae74b2cdcc648fe3c67b28f72829a6ae0ededc692f06dc6acf824149aa12b0

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.b-5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8.exe
                                                                  Filesize

                                                                  204KB

                                                                  MD5

                                                                  e1a9b6f7285a85e682ebcad028472d13

                                                                  SHA1

                                                                  1347b810ac90c13154908f7cf45b11913c182e44

                                                                  SHA256

                                                                  5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8

                                                                  SHA512

                                                                  35e6adb72faba256c94a7abe205ff14752f46c830292905e24605a479d15b6aa6b4ccfcc6d4937dfad8698cfa8da4a4cd68b38ded5c14ed24127f605c6fe6874

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.sg-d2954337252fb727b01a7e2a8e4c4b451cb00c9abe6dec34b8b143d845a00111.exe
                                                                  Filesize

                                                                  264KB

                                                                  MD5

                                                                  3c89456ba5ab540e445a632ccfbbb958

                                                                  SHA1

                                                                  c0d239bb3761a9b4e6024f6d970f3a495fe6a04b

                                                                  SHA256

                                                                  d2954337252fb727b01a7e2a8e4c4b451cb00c9abe6dec34b8b143d845a00111

                                                                  SHA512

                                                                  e935ad2d98c915a92ddc0a4f878a8aaf94f6c54f1b58c1499fa07d6558271eb6ff56c79313d691737dd524d31ba0119bbac58129dd7dc51de3d7c024ca7a38f2

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.xfj-b56ad0d8b823c049dc99ae0897a90ee0c1bfe6e2e8496026a1be1c075524c489.exe
                                                                  Filesize

                                                                  364KB

                                                                  MD5

                                                                  a38cd976b7f15d2460c8f70bc8c490aa

                                                                  SHA1

                                                                  f360212f78618c9b346a8a39fc266d1a16fd9051

                                                                  SHA256

                                                                  b56ad0d8b823c049dc99ae0897a90ee0c1bfe6e2e8496026a1be1c075524c489

                                                                  SHA512

                                                                  60f6b6852788d086dac1005027ae5323d2c27a30ab2de823fe1c757f0c55ea718d93e6500e05fcf4ea64889c24f591d18d8db15a2bc7408174801081d8201802

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.xlf-60e67e18aecf1be2974966e38f4b179c2643953a27be20da69032fb38f529e29.exe
                                                                  Filesize

                                                                  368KB

                                                                  MD5

                                                                  6dd36d14d55910872f3397c9cacd7a9b

                                                                  SHA1

                                                                  05d160838a5b483f7d7dc486806ac9de9f9c3a82

                                                                  SHA256

                                                                  60e67e18aecf1be2974966e38f4b179c2643953a27be20da69032fb38f529e29

                                                                  SHA512

                                                                  80fbee206898f724441bec122fcbbba16d4a8bfc71e6668538ce4932937355e618d61aa46a3ee266d79e869c51ec73e064baeab8720180d8c9a46a63538e6dea

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Locky.xpc-f76b705326288636963dd42819ce4705615cbb5a34ce6e9fca3a5419d66ba1f8.exe
                                                                  Filesize

                                                                  431KB

                                                                  MD5

                                                                  f133d6277367fba390651559b8953cd4

                                                                  SHA1

                                                                  46d03119cb031dda1491fcde3fa8f37995d99c9c

                                                                  SHA256

                                                                  f76b705326288636963dd42819ce4705615cbb5a34ce6e9fca3a5419d66ba1f8

                                                                  SHA512

                                                                  1191522b852d1f4e46f01cb8461ee7dd33620f555719665441f82e5590176e7c95846da9e7347230e6392bd889e0ee1aa42f2dfb8e675ca206a384cc718b7b70

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Shade.ljz-8afb1aea361d8097f47f263b6c777155fda1d485943e7fa0d7de24bfb7db8490.exe
                                                                  Filesize

                                                                  914KB

                                                                  MD5

                                                                  5c619b94a2b4ad02fb777c6453d20ceb

                                                                  SHA1

                                                                  8f7e88ee168af1e25dff8d36976796b24a427bb8

                                                                  SHA256

                                                                  8afb1aea361d8097f47f263b6c777155fda1d485943e7fa0d7de24bfb7db8490

                                                                  SHA512

                                                                  ea85575959ec0afeda9f3f6add74ab2981e08eb7990112ebb6dc764588062e02740ff5f71e296d602268df9cb2945fbd94ad083c7883c0b75eca4afd57012b53

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Shade.low-9d9ea2fc9705bc38323cc006742d98f97b6f1093dc1042bcd69daa06be7445ac.exe
                                                                  Filesize

                                                                  916KB

                                                                  MD5

                                                                  b01c53a635e7b760f539a7ff6065f683

                                                                  SHA1

                                                                  0b23b9fc48f7797fca3d50fdb1c273b8cf6db6be

                                                                  SHA256

                                                                  9d9ea2fc9705bc38323cc006742d98f97b6f1093dc1042bcd69daa06be7445ac

                                                                  SHA512

                                                                  2d6e1b14822d40b3727d297cce7a79fdbefc32c8a1730a702b20d161e35372071f7fcfbe786925acc1321d7664480cde9e3d1fb8d165f1cc131d7439f6a506ac

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Snocry.cvs-e1c59c0eb434fb93001c0d766b6cb3191f6143c693b11bde5151d495a1834fb5.exe
                                                                  Filesize

                                                                  520KB

                                                                  MD5

                                                                  f48627a8c7e00d587076a55ae48b2c4f

                                                                  SHA1

                                                                  1677c116fafd6817ea8291643aca078bf38196ae

                                                                  SHA256

                                                                  e1c59c0eb434fb93001c0d766b6cb3191f6143c693b11bde5151d495a1834fb5

                                                                  SHA512

                                                                  7d05e88eccc323d25b719bb377b7341457453e15c067e1982e151f7e6209a50f1b9f2dd86a0902a0d9a19c290d22d248b95286ad3caf619e602d4fc93f5d96eb

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.dass-fd4a9100bf1ee71981dc4538cccb5fd5f68db8c1b51d3d12412bb6c392e59c89.exe
                                                                  Filesize

                                                                  239KB

                                                                  MD5

                                                                  bb36503c806b72e51bbaa4b320ea4703

                                                                  SHA1

                                                                  381d1f3108eaf39884f6ea3a101e99fdf84c81bd

                                                                  SHA256

                                                                  fd4a9100bf1ee71981dc4538cccb5fd5f68db8c1b51d3d12412bb6c392e59c89

                                                                  SHA512

                                                                  655391b75c9b615162873c07ca8487b232b42107ba28b17124926bfa5d54698e7b65474f65c7dbc80885eb92c35e6e3df9e84dc290e1298a25649482354a9d80

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.fbbx-f33ce56c4ae43ce0f52ad3530fc6b8394e47d28d5c6981f1722b419673771415.exe
                                                                  Filesize

                                                                  318KB

                                                                  MD5

                                                                  ed962e1325c3b9e3765949fda7a6b5ad

                                                                  SHA1

                                                                  4a46bc5f1721d293077d611e0583d827081b6445

                                                                  SHA256

                                                                  f33ce56c4ae43ce0f52ad3530fc6b8394e47d28d5c6981f1722b419673771415

                                                                  SHA512

                                                                  8a02daf5c3d484cc55c8f0961b9994cf5e397ce4e89095124cdbe414f0cc30ebec3ccdb71701ca38874e7c21e095f07a2e2a6c3bcddffe437c54645f5e78efb0

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.fxnh-f0e7364a7569254b85a977c07c65ba668e7e188bab5af80250daeb5e29610762.exe
                                                                  Filesize

                                                                  248KB

                                                                  MD5

                                                                  0fde16ced64b74b7fde8d3ed67c22f7e

                                                                  SHA1

                                                                  ea02fa337265bc904fccda2d66813ec9b2227a58

                                                                  SHA256

                                                                  f0e7364a7569254b85a977c07c65ba668e7e188bab5af80250daeb5e29610762

                                                                  SHA512

                                                                  495e01738afdd010494413fdcd24e749e07323200d045733739e90242975edfdab961274fe7c5b85a7dd0d2d7b0e0a935e2188033d1b4c45dacfb3a74339e49d

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.gdwr-07da34d4b85beffa8f28af3116ee5dd7c9fe430c0792b1f5d3ef146a855eb2c5.exe
                                                                  Filesize

                                                                  180KB

                                                                  MD5

                                                                  d6ccad707bcdc93f762f650495baf984

                                                                  SHA1

                                                                  a0a42addb66f6fc8b329d7644df067565a6cf207

                                                                  SHA256

                                                                  07da34d4b85beffa8f28af3116ee5dd7c9fe430c0792b1f5d3ef146a855eb2c5

                                                                  SHA512

                                                                  c697a7e357ede162f48e6ad54eb0841591f53393fc6f57ec2e96948a47d2cbf80b210d6551cf09b0f9468accef37de226a31930b31f400ab6ec62d3e91d3bc70

                                                                  Download Submit

                                                                • C:\Users\Admin\Desktop\00284\Trojan-Ransom.Win32.Zerber.qkw-b980472da4a223c4c07d406b1f86b0d9705a01bacab56930c6ffcb27e3c85288.exe
                                                                  Filesize

                                                                  264KB

                                                                  MD5

                                                                  7a4b785cc67a8d94e8f64b2897fce7e1

                                                                  SHA1

                                                                  71c2516426c4640da4ae39233fec2a0c2d43670c

                                                                  SHA256

                                                                  b980472da4a223c4c07d406b1f86b0d9705a01bacab56930c6ffcb27e3c85288

                                                                  SHA512

                                                                  cf38168d124bf6da0a93f48d29c25625c021a6a178628fb44b701b26fc3ecf656a146ff9adfc52b43d5a00405d3a78fa9545f4a99723661a86b91d9ef782ed61

                                                                  Download Submit

                                                                • \Users\Admin\AppData\Local\Temp\clavicytherium.dll
                                                                  Filesize

                                                                  64KB

                                                                  MD5

                                                                  66f1bb40619895bffa812c7b6f79464b

                                                                  SHA1

                                                                  66f7a731c62014a5a622072c90b75e80298cabe6

                                                                  SHA256

                                                                  36e626f9949d4b75f2bc07f3e321ece3b29973ce96ab255f025744d1fadf5002

                                                                  SHA512

                                                                  946475b74afed276459e7b0326c3ef004ac9403ba10351b7254f5c4b0fcfef102073410d18ae64fefc442e304527d1ab790064129670c4d215c7b1412e59742b

                                                                  Download Submit

                                                                • \Users\Admin\AppData\Local\Temp\nsj6884.tmp\System.dll
                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  a4dd044bcd94e9b3370ccf095b31f896

                                                                  SHA1

                                                                  17c78201323ab2095bc53184aa8267c9187d5173

                                                                  SHA256

                                                                  2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

                                                                  SHA512

                                                                  87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

                                                                  Download Submit

                                                                • \Users\Admin\AppData\Local\Temp\nso6AC6.tmp\System.dll
                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  4d3b19a81bd51f8ce44b93643a4e3a99

                                                                  SHA1

                                                                  35f8b00e85577b014080df98bd2c378351d9b3e9

                                                                  SHA256

                                                                  fda0018ab182ac6025d2fc9a2efcce3745d1da21ce5141859f8286cf319a52ce

                                                                  SHA512

                                                                  b2ba9c961c0e1617f802990587a9000979ab5cc493ae2f8ca852eb43eeaf24916b0b29057dbff7d41a1797dfb2dce3db41990e8639b8f205771dbec3fd80f622

                                                                  Download Submit

                                                                • \Users\Admin\AppData\Local\Temp\nst678A.tmp\System.dll
                                                                  Filesize

                                                                  11KB

                                                                  MD5

                                                                  a436db0c473a087eb61ff5c53c34ba27

                                                                  SHA1

                                                                  65ea67e424e75f5065132b539c8b2eda88aa0506

                                                                  SHA256

                                                                  75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

                                                                  SHA512

                                                                  908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

                                                                  Download Submit

                                                                • \Users\Admin\AppData\Local\Temp\reclining.dll
                                                                  Filesize

                                                                  44KB

                                                                  MD5

                                                                  5198e9f75dc3d5431cf063a4e9b21983

                                                                  SHA1

                                                                  e53a625109801a9a44d3663d496860ddcca8e483

                                                                  SHA256

                                                                  dcf1ebca9072074a34766077ed677bfc950d01bbe3307e0befd1165514aa8c6f

                                                                  SHA512

                                                                  ca91012a49a410fbc2c47ccb795c0cdd8098f34bc1d93eabbe5c125887d09717a989c2ff6eece4fcb817555c5354b6e6627eb20feb6277883cdc767f9c322265

                                                                  Download Submit

                                                                • \Users\Admin\AppData\Roaming\Orzia\anetu.exe
                                                                  Filesize

                                                                  67KB

                                                                  MD5

                                                                  0101165c186a281b471f7198a342759e

                                                                  SHA1

                                                                  e36b03bb943067b57e66df692ee9ee1228fce37f

                                                                  SHA256

                                                                  e394ca66d3fd35e7bbbaba4a729391fdb01579c16d5c76a18aa90dd5c0a5e9bf

                                                                  SHA512

                                                                  e69ca2491af71116ddf5630997b7e43eab7e4fc8a63f9be971dfee825c1776ec1a315cf5c11c13ad79c9032520ff334cbde556c2c0f80ee120eb2c49387e257f

                                                                  Download Submit

                                                                • memory/992-200-0x0000000000420000-0x00000000004E9000-memory.dmp

                                                                  Filesize

                                                                  804KB

                                                                  Download

                                                                • memory/992-198-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/992-208-0x0000000001FC0000-0x0000000001FD7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/992-206-0x0000000002190000-0x0000000002299000-memory.dmp

                                                                  Filesize

                                                                  1.0MB

                                                                  Download

                                                                • memory/992-205-0x0000000000400000-0x0000000000417000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/992-204-0x00000000007A0000-0x0000000000811000-memory.dmp

                                                                  Filesize

                                                                  452KB

                                                                  Download

                                                                • memory/992-203-0x0000000000670000-0x000000000079D000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/992-202-0x00000000001D0000-0x00000000001EF000-memory.dmp

                                                                  Filesize

                                                                  124KB

                                                                  Download

                                                                • memory/992-201-0x00000000004F0000-0x000000000058F000-memory.dmp

                                                                  Filesize

                                                                  636KB

                                                                  Download

                                                                • memory/1020-87-0x0000000000340000-0x000000000037A000-memory.dmp

                                                                  Filesize

                                                                  232KB

                                                                  Download

                                                                • memory/1056-74-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/1056-101-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/1056-76-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                  Filesize

                                                                  72KB

                                                                  Download

                                                                • memory/1112-209-0x0000000001F10000-0x0000000001F27000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1112-211-0x0000000001F10000-0x0000000001F27000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1112-213-0x0000000001F10000-0x0000000001F27000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1112-215-0x0000000001F10000-0x0000000001F27000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1160-218-0x0000000001EB0000-0x0000000001EC7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1160-220-0x0000000001EB0000-0x0000000001EC7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1160-222-0x0000000001EB0000-0x0000000001EC7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1200-229-0x0000000002C40000-0x0000000002C57000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1200-225-0x0000000002C40000-0x0000000002C57000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1200-227-0x0000000002C40000-0x0000000002C57000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1264-556-0x0000000000400000-0x00000000005DE000-memory.dmp

                                                                  Filesize

                                                                  1.9MB

                                                                  Download

                                                                • memory/1264-361-0x0000000000400000-0x00000000005DE000-memory.dmp

                                                                  Filesize

                                                                  1.9MB

                                                                  Download

                                                                • memory/1288-69640-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-1-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-239-0x0000000002050000-0x0000000002067000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1288-241-0x0000000002050000-0x0000000002067000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1288-243-0x0000000002050000-0x0000000002067000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1288-26987-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-69824-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-27010-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-11101-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-69641-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-11491-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-0-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-50-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-69865-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-69826-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1288-61612-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                  Filesize

                                                                  5.9MB

                                                                  Download

                                                                • memory/1440-232-0x0000000001FB0000-0x0000000001FC7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1440-234-0x0000000001FB0000-0x0000000001FC7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1440-236-0x0000000001FB0000-0x0000000001FC7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1668-547-0x0000000000400000-0x00000000005DE000-memory.dmp

                                                                  Filesize

                                                                  1.9MB

                                                                  Download

                                                                • memory/1668-562-0x0000000000400000-0x00000000005DE000-memory.dmp

                                                                  Filesize

                                                                  1.9MB

                                                                  Download

                                                                • memory/1668-350-0x0000000000400000-0x00000000005DE000-memory.dmp

                                                                  Filesize

                                                                  1.9MB

                                                                  Download

                                                                • memory/1776-7307-0x00000000011F0000-0x0000000001320000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/1776-3244-0x00000000011F0000-0x0000000001320000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/1816-351-0x00000000003C0000-0x00000000003C6000-memory.dmp

                                                                  Filesize

                                                                  24KB

                                                                  Download

                                                                • memory/1816-528-0x000000000BC90000-0x000000000C37A000-memory.dmp

                                                                  Filesize

                                                                  6.9MB

                                                                  Download

                                                                • memory/1816-632-0x0000000000810000-0x0000000000816000-memory.dmp

                                                                  Filesize

                                                                  24KB

                                                                  Download

                                                                • memory/1816-100-0x0000000000B80000-0x0000000001256000-memory.dmp

                                                                  Filesize

                                                                  6.8MB

                                                                  Download

                                                                • memory/1864-248-0x0000000000110000-0x0000000000127000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1864-246-0x0000000000110000-0x0000000000127000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1936-173-0x00000000008C0000-0x00000000008D7000-memory.dmp

                                                                  Filesize

                                                                  92KB

                                                                  Download

                                                                • memory/1936-152-0x0000000000660000-0x000000000078D000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/1936-149-0x0000000000410000-0x00000000004D9000-memory.dmp

                                                                  Filesize

                                                                  804KB

                                                                  Download

                                                                • memory/1936-150-0x00000000004E0000-0x000000000057F000-memory.dmp

                                                                  Filesize

                                                                  636KB

                                                                  Download

                                                                • memory/1936-151-0x00000000002B0000-0x00000000002CF000-memory.dmp

                                                                  Filesize

                                                                  124KB

                                                                  Download

                                                                • memory/1936-158-0x0000000000A80000-0x0000000000B89000-memory.dmp

                                                                  Filesize

                                                                  1.0MB

                                                                  Download

                                                                • memory/2016-119-0x00000000007E0000-0x00000000007F1000-memory.dmp

                                                                  Filesize

                                                                  68KB

                                                                  Download

                                                                • memory/2064-169-0x0000000000480000-0x000000000048B000-memory.dmp

                                                                  Filesize

                                                                  44KB

                                                                  Download

                                                                • memory/2112-171-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                  Filesize

                                                                  248KB

                                                                  Download

                                                                • memory/2112-172-0x0000000000400000-0x000000000043E000-memory.dmp

                                                                  Filesize

                                                                  248KB

                                                                  Download

                                                                • memory/2360-2830-0x0000000000C00000-0x0000000000D30000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/2360-2825-0x0000000003D20000-0x0000000003E50000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/2360-591-0x0000000000C00000-0x0000000000D30000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/2432-196-0x0000000000C00000-0x0000000000D30000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/2432-2863-0x0000000000C00000-0x0000000000D30000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/2432-389-0x0000000000C00000-0x0000000000D30000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/3048-69778-0x0000000000400000-0x0000000000505000-memory.dmp

                                                                  Filesize

                                                                  1.0MB

                                                                  Download

                                                                • memory/3048-404-0x0000000000400000-0x0000000000505000-memory.dmp

                                                                  Filesize

                                                                  1.0MB

                                                                  Download

                                                                • memory/6788-2827-0x00000000011F0000-0x0000000001320000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/6788-7584-0x00000000011F0000-0x0000000001320000-memory.dmp

                                                                  Filesize

                                                                  1.2MB

                                                                  Download

                                                                • memory/11112-69774-0x000000000CF00000-0x000000000D264000-memory.dmp

                                                                  Filesize

                                                                  3.4MB

                                                                  Download

                                                                • memory/11112-69772-0x000000000CA00000-0x000000000CEFE000-memory.dmp

                                                                  Filesize

                                                                  5.0MB

                                                                  Download

                                                                • memory/11112-69771-0x000000000C050000-0x000000000C0EC000-memory.dmp

                                                                  Filesize

                                                                  624KB

                                                                  Download

                                                                • memory/11112-69766-0x0000000004CE0000-0x0000000005242000-memory.dmp

                                                                  Filesize

                                                                  5.4MB

                                                                  Download

                                                                • memory/18880-69585-0x0000000004E70000-0x00000000053D2000-memory.dmp

                                                                  Filesize

                                                                  5.4MB

                                                                  Download