Overview

overview

10

Static

static

3

ComputerRaper.exe

windows7-x64

10

ComputerRaper.exe

windows10-2004-x64

Analysis

  • max time kernel
    16s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2024 00:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ComputerRaper.exe

  • Size

    85.4MB

  • MD5

    bdb24ed9f869fcd462b316148514fc5b

  • SHA1

    83935122b626378a3149e9036cd751514add4b52

  • SHA256

    83875ea85b183c609c5ddcd92afe62265745192a417b80524f12741fc028aca0

  • SHA512

    12fdb77a75debeacbc4b98cac45d09a7bcc378bd9bd51bbc035838b99c1d595660d5c0961a2d041b2e8359f3b5b096f589d39453ada9874436411b94b8b0d611

  • SSDEEP

    1572864:NUkskQ1oOZrCqix58TkbajhXBFEQT9VotzcJ97:N/NQbCbmXXEUvoM97

Score
10/10
cerberchimeracryptolockergandcrabtroldeshbackdoorbootkitdefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojanupx

Malware Config

Extracted

Path

C:\Users\QWYXODCYVL-MANUAL.txt

Family

gandcrab

Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .QWYXODCYVL The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/42eb3d0753fcf297 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAFlxSG5/a36/xItHAOR8f96+ZtYJIkU8xQ+Dutd2y9EHF4gUOKzXGbFX1nO1rS9ic55TUqRFYHXjOcAAb8DpKX9Uj0NE1KA9OTyyuQH2Za9G1g29qiXDRdu6RcT9+nFzLovkyvUqzB+RrByDAwcj+bMUFDNN6u8F4dEHykAq1y5pl0daBcrggyvI0rcKvGIkP27nA4608QuMsKCiTGFv6i08TBjt/afSGAAN9V6EVmeNKL9O9EuNi2ksfWYVaf3/UcyySDoOYM3cAzps2wnpqSDs0rEYbwdsCIlwNBSDyVJB2VulSSt26pTGzD12UD5TgC1i3JriqRCLce4igcsq8C2SYFSxgzTJIpbFKGGhh10z5RpdZD40ygifml8Nvy/4Oa82QMyBjMyoRp2RugaIMJ2PzoH/6HJRKnNc8WnA4ZPj7UHIgYeZwHF66w0GNkvELOXqspUTODdEPp+vGDZzO6B0KxhhmbxJMwCd+6ntNQeZ50Xbs/BdEVzhAMJq1Ll8E51AlZengau6rb4/4xL2MXf18Dgld4KRT9eo2gmhBkuQ0wIOw7pqHOgSJs9BPWdUxL2UYruC60KVKu7IGtxirBkN1GDn6Df0KznxyS5+bdDiBqkYZv1fdrAJ36rI1XyNAxkaMx4FuiJIzGtHUODM10IXt7sb6PmidObOyUcHFcd9Fx67upGWWZcVvNv+um/76DHU/p+eRYTFA3LVsM+xw31sFF0+EmePJMg8lfOHKB+vq3pe6tsfnkyVfjuSWIochx6OYr6XM03M1bFSKHCwS/piq2Lg+Zw7BKnS3Akj8nKLCt59s2L46ZaIkdlizHG3wmnlX6Hy9dvkm0hL8yoNk2YfMAENylm/hOXnkqmmA2tvcn0dwFyR2vEMBwuQ0RR8ApgfNd6rBx17o6uXr62Xc5NqdvmAOJTddXdZE7qqVjfgjmcno+/j+x5cHl26hGerweS0Wos4SAJK+z4kiEkLV30KmJifYtflnxqFT+EoyO+2Jxj5SSbwsBmfVj+3JqFN09v2Iw1AKdTy5KBEwhY/vUjrl8Fvi0Vh9/u4bV4oUhkONHigQlKtSoqLUUf2y5HgLc4/xjDZevnFulKm5QGTCo12e/aI1h7S18HB5EVNUJjP/K8In7yPHH45ytMV+foHhLMpMEr2D3HCggQXJgtW5V+X2xjoohaQqXxM14o3crIg1RHYErXu3/fW2WdAFwIXGI+o+z0cmNswu+DDYc8nB1iiSizjMdaNiylwn7DRydduz6bBmnhD4nk+QnJJKwNyXNFmKXb/x/Cp6yckEErclFabUbOEkdbAjdSPFaWY8FAH814o0fd+Zv0Ok3t5ft1WnSezly944VsYSOnGc7x4yB+IAozYGXHy1CnK239XFLd8EN0ZIgan/6mm2/UE33kLOF6ysXdAKboz2iv5sNoe37LhCv8A4gNUNIs2qWUH1c4Lp7cFXAELAPn4fsbELEoxSg6cRF8TitnpMwSQzv7IGa1lyrRlTLX/kW+QeIZz73iq5dCMzWKbjHb5AEtPVA0rHRx+6tPogHHjqdxuzLEa3+mbe+ed3q32LT/tddxN++LCA+I16l0cW5Qh6qNOk1XQNGM6FuMZMH0Xbgg9IGak8kjSAneE/St7CmTdS7qYs7zGIIXTcm8CwN/H4+xIJOTery4xdLmSNVmBJqDi34FeWOlqtnMfmzSMpxsyEkxnV9PffjeJMNJrRNNXYbn7M9roeR2Ox2EaxYKDjtWwdM4XgdMd14NEg0dBI+nzSfmhEgrccz/GGwCVT1JzwpY36RRiN6ICHINcvtsPbn8K09zgJkBOzt6heRm3jFHv9dXXvV40v2vROrNjEpAgPk/AflU2ASqiju3rVBKJZkltVeBQ9KFXpVGbxq6vaZj2bcMtqf3sq1sU8960jiXSVrcEIM25jpzxv0fxoVjVk5ZKaSjZBJFyzMmMVXOEFRTF9mIuQWU6PpdM24qcvVzhASfUyQ6A3fJ+cE97BUSgwbdHuLsGeR6jc7GFAtyTry1ANyejzXbRMa0ykhF49Fc5RuLB1/FThm5u3JwKLkDcqt0R2UxGUGtTt61YwWCcdeOfUHj4aLRoI7MtT4s8Z5EESory2TQfI37azvYsJbAIKrqsaj6bRhIp8WgKnOT9mVO5T7/3as5brb24gviN8Z1XISXQQxJVL7uI7ptjVkhEVT2q+0J7GfjIXbBrZNoE9DScXcjhf7aZLYm4xryTs30YraHslZbw/KOmBEo= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDr9MzJMpDfAueVs+DJRX7IKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2mU0R7+dxfWLoypoW25ypHEnKnMMuBl1Cmehqo5VrrnNSZu19KSVzOtTAymPz79ICyGBkpCKj0RQwVePfN00RSAiDHtO+JL9AOBnBqrsY5R+W3MrGamYeR2keCP9Dy+/NzLOzjDaO2rwVWxuZ2TzbJpvbdL0N0zPfgSzCzhqApoTPFpp2CPDOx6ihEudzoNVoM6j2VyOmqqBlvZbwErtIypC8P1fKlWTmW7q14GuxOgTOwQUyhb/ofzNwkLQejqrjTwFji9zPbKPSghI2dWKf+5gkQvDGihIFfEv5EsSM5AN7hzdQVIFj1CUHPyeWMbZ0K1g0/7uRQeyoEinT3CrvrP9dFPEuVIcosLqYb4AnecHqVubCDEZSsSLSNnIyaZEI9b5008FGYczrSlaIGDBHFzoGoqA9wiUaNxMzG ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/42eb3d0753fcf297

Extracted

Path

C:\Users\Public\Pictures\_R_E_A_D___T_H_I_S___NHTGWHH3_.txt

Family

cerber

Ransom Note
Hi, I'am CRBR ENCRYPTOR ;) ----- ALL YOUR DOCUMENTS, PH0T0S, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only one way to decrypt your files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_R_E_A_D___T_H_I_S_*) with complete instructions how to decrypt your files. If you cannot find any (*_R_E_A_D___T_H_I_S_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://xpcx6erilkjced3j.onion/CF01-DC0A-6411-0098-BE31 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://xpcx6erilkjced3j.1n5mod.top/CF01-DC0A-6411-0098-BE31 2. http://xpcx6erilkjced3j.19kdeh.top/CF01-DC0A-6411-0098-BE31 3. http://xpcx6erilkjced3j.1mpsnr.top/CF01-DC0A-6411-0098-BE31 4. http://xpcx6erilkjced3j.18ey8e.top/CF01-DC0A-6411-0098-BE31 5. http://xpcx6erilkjced3j.17gcun.top/CF01-DC0A-6411-0098-BE31 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs

http://xpcx6erilkjced3j.onion/CF01-DC0A-6411-0098-BE31

http://xpcx6erilkjced3j.1n5mod.top/CF01-DC0A-6411-0098-BE31

http://xpcx6erilkjced3j.19kdeh.top/CF01-DC0A-6411-0098-BE31

http://xpcx6erilkjced3j.1mpsnr.top/CF01-DC0A-6411-0098-BE31

http://xpcx6erilkjced3j.18ey8e.top/CF01-DC0A-6411-0098-BE31

http://xpcx6erilkjced3j.17gcun.top/CF01-DC0A-6411-0098-BE31

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber
  • Cerber family
    cerber
  • Chimera

    Ransomware which infects local and network files, often distributed via Dropbox links.

    ransomwarechimera
  • Chimera Ransomware Loader DLL 1 IoCs

    Drops/unpacks executable file which resembles Chimera's Loader.dll.

    ransomware
  • Chimera family
    chimera
  • CryptoLocker

    Ransomware family with multiple variants.

    ransomwarecryptolocker
  • Cryptolocker family
    cryptolocker
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Troldesh family
    troldesh
  • Troldesh, Shade, Encoder.858

    Troldesh is a ransomware spread by malspam.

    ransomwaretrojantroldesh
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 42 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
    defense_evasion
  • Loads dropped DLL 21 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 13 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 30 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Control Panel 6 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 37 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ComputerRaper.exe
    "C:\Users\Admin\AppData\Local\Temp\ComputerRaper.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Roaming\AgentTesla.exe
      "C:\Users\Admin\AppData\Roaming\AgentTesla.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:2652
    • C:\Users\Admin\AppData\Roaming\HawkEye.exe
      "C:\Users\Admin\AppData\Roaming\HawkEye.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1928
    • C:\Users\Admin\AppData\Roaming\butterflyondesktop.exe
      "C:\Users\Admin\AppData\Roaming\butterflyondesktop.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Users\Admin\AppData\Local\Temp\is-3KHC0.tmp\butterflyondesktop.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-3KHC0.tmp\butterflyondesktop.tmp" /SL5="$301A8,2719719,54272,C:\Users\Admin\AppData\Roaming\butterflyondesktop.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2780
    • C:\Users\Admin\AppData\Roaming\$uckyLocker.exe
      "C:\Users\Admin\AppData\Roaming\$uckyLocker.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2692
    • C:\Users\Admin\AppData\Roaming\7ev3n.exe
      "C:\Users\Admin\AppData\Roaming\7ev3n.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2804
      • C:\Users\Admin\AppData\Local\system.exe
        "C:\Users\Admin\AppData\Local\system.exe"
        3⤵
          PID:3448
      • C:\Users\Admin\AppData\Roaming\Annabelle.exe
        "C:\Users\Admin\AppData\Roaming\Annabelle.exe"
        2⤵
        • Executes dropped EXE
        PID:2680
      • C:\Users\Admin\AppData\Roaming\BadRabbit.exe
        "C:\Users\Admin\AppData\Roaming\BadRabbit.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\SysWOW64\rundll32.exe
          C:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 15
          3⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2068
          • C:\Windows\SysWOW64\cmd.exe
            /c schtasks /Delete /F /TN rhaegal
            4⤵
              PID:980
            • C:\Windows\SysWOW64\cmd.exe
              /c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 2818321691 && exit"
              4⤵
                PID:3964
              • C:\Windows\SysWOW64\cmd.exe
                /c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 00:43:00
                4⤵
                  PID:3280
                • C:\Windows\DC2C.tmp
                  "C:\Windows\DC2C.tmp" \\.\pipe\{ED5B6E11-D0B5-4D22-879E-6D7B49AC2AA0}
                  4⤵
                    PID:3508
              • C:\Users\Admin\AppData\Roaming\Birele.exe
                "C:\Users\Admin\AppData\Roaming\Birele.exe"
                2⤵
                • Modifies WinLogon for persistence
                • Executes dropped EXE
                • Impair Defenses: Safe Mode Boot
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2188
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM explorer.exe
                  3⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2620
              • C:\Users\Admin\AppData\Roaming\Cerber5.exe
                "C:\Users\Admin\AppData\Roaming\Cerber5.exe"
                2⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • System Location Discovery: System Language Discovery
                • Suspicious use of UnmapMainImage
                PID:1660
                • C:\Windows\SysWOW64\netsh.exe
                  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
                  3⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2424
                • C:\Windows\SysWOW64\netsh.exe
                  C:\Windows\system32\netsh.exe advfirewall reset
                  3⤵
                  • Modifies Windows Firewall
                  PID:2560
              • C:\Users\Admin\AppData\Roaming\CoronaVirus.exe
                "C:\Users\Admin\AppData\Roaming\CoronaVirus.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1268
              • C:\Users\Admin\AppData\Roaming\CryptoLocker.exe
                "C:\Users\Admin\AppData\Roaming\CryptoLocker.exe"
                2⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:1952
                • C:\Users\Admin\AppData\Roaming\CryptoLocker.exe
                  "C:\Users\Admin\AppData\Roaming\CryptoLocker.exe" /w000000C8
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:328
              • C:\Users\Admin\AppData\Roaming\CryptoWall.exe
                "C:\Users\Admin\AppData\Roaming\CryptoWall.exe"
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: MapViewOfSection
                PID:2748
                • C:\Windows\syswow64\explorer.exe
                  "C:\Windows\syswow64\explorer.exe"
                  3⤵
                  • Drops startup file
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: MapViewOfSection
                  PID:1820
                  • C:\Windows\syswow64\svchost.exe
                    -k netsvcs
                    4⤵
                    • System Location Discovery: System Language Discovery
                    PID:2360
                  • C:\Windows\syswow64\vssadmin.exe
                    vssadmin.exe Delete Shadows /All /Quiet
                    4⤵
                    • System Location Discovery: System Language Discovery
                    • Interacts with shadow copies
                    PID:2104
              • C:\Users\Admin\AppData\Roaming\DeriaLock.exe
                "C:\Users\Admin\AppData\Roaming\DeriaLock.exe"
                2⤵
                • Drops startup file
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1744
              • C:\Users\Admin\AppData\Roaming\Dharma.exe
                "C:\Users\Admin\AppData\Roaming\Dharma.exe"
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:2204
                • C:\Users\Admin\AppData\Local\Temp\ac\nc123.exe
                  "C:\Users\Admin\AppData\Local\Temp\ac\nc123.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1664
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c cls
                    4⤵
                      PID:2148
                  • C:\Users\Admin\AppData\Local\Temp\ac\mssql.exe
                    "C:\Users\Admin\AppData\Local\Temp\ac\mssql.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:1136
                  • C:\Users\Admin\AppData\Local\Temp\ac\mssql2.exe
                    "C:\Users\Admin\AppData\Local\Temp\ac\mssql2.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:1532
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\ac\Shadow.bat" "
                    3⤵
                      PID:1968
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\ac\systembackup.bat" "
                      3⤵
                        PID:2808
                    • C:\Users\Admin\AppData\Roaming\Fantom.exe
                      "C:\Users\Admin\AppData\Roaming\Fantom.exe"
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1288
                    • C:\Users\Admin\AppData\Roaming\GandCrab.exe
                      "C:\Users\Admin\AppData\Roaming\GandCrab.exe"
                      2⤵
                      • Executes dropped EXE
                      • Enumerates connected drives
                      • Drops file in Program Files directory
                      • System Location Discovery: System Language Discovery
                      • Checks processor information in registry
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1704
                    • C:\Users\Admin\AppData\Roaming\InfinityCrypt.exe
                      "C:\Users\Admin\AppData\Roaming\InfinityCrypt.exe"
                      2⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Checks processor information in registry
                      PID:1072
                    • C:\Users\Admin\AppData\Roaming\Krotten.exe
                      "C:\Users\Admin\AppData\Roaming\Krotten.exe"
                      2⤵
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Modifies WinLogon
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Modifies Control Panel
                      • Modifies Internet Explorer settings
                      • Modifies Internet Explorer start page
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • System policy modification
                      PID:1396
                    • C:\Users\Admin\AppData\Roaming\NoMoreRansom.exe
                      "C:\Users\Admin\AppData\Roaming\NoMoreRansom.exe"
                      2⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of UnmapMainImage
                      PID:1508
                    • C:\Users\Admin\AppData\Roaming\NotPetya.exe
                      "C:\Users\Admin\AppData\Roaming\NotPetya.exe"
                      2⤵
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      PID:1572
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Windows\perfc.dat #1
                        3⤵
                        • Writes to the Master Boot Record (MBR)
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1984
                        • C:\Windows\SysWOW64\cmd.exe
                          /c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 01:28
                          4⤵
                            PID:1784
                          • C:\Users\Admin\AppData\Local\Temp\D9DB.tmp
                            "C:\Users\Admin\AppData\Local\Temp\D9DB.tmp" \\.\pipe\{EBB75BE4-5DE7-48EF-98D6-B9E484897EA7}
                            4⤵
                              PID:2708
                        • C:\Users\Admin\AppData\Roaming\Petya.A.exe
                          "C:\Users\Admin\AppData\Roaming\Petya.A.exe"
                          2⤵
                          • Executes dropped EXE
                          • Writes to the Master Boot Record (MBR)
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2232
                        • C:\Users\Admin\AppData\Roaming\PolyRansom.exe
                          "C:\Users\Admin\AppData\Roaming\PolyRansom.exe"
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1384
                          • C:\Users\Admin\YmEYAIYQ\mScIAEMI.exe
                            "C:\Users\Admin\YmEYAIYQ\mScIAEMI.exe"
                            3⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            PID:2220
                          • C:\ProgramData\NOgAgsAI\gAcQAQwg.exe
                            "C:\ProgramData\NOgAgsAI\gAcQAQwg.exe"
                            3⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • System Location Discovery: System Language Discovery
                            PID:2612
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c "C:\Users\Admin\AppData\Roaming\PolyRansom"
                            3⤵
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:1780
                            • C:\Users\Admin\AppData\Roaming\PolyRansom.exe
                              C:\Users\Admin\AppData\Roaming\PolyRansom
                              4⤵
                                PID:2668
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c "C:\Users\Admin\AppData\Roaming\PolyRansom"
                                  5⤵
                                    PID:3720
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                    5⤵
                                    • Modifies registry key
                                    PID:3424
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                    5⤵
                                    • Modifies registry key
                                    PID:3460
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                    5⤵
                                    • Modifies registry key
                                    PID:3604
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /c ""C:\Users\Admin\AppData\Local\Temp\EgoEQMUk.bat" "C:\Users\Admin\AppData\Roaming\PolyRansom.exe""
                                    5⤵
                                      PID:3772
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                  3⤵
                                  • Modifies registry key
                                  PID:1924
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                  3⤵
                                  • Modifies registry key
                                  PID:3288
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                  3⤵
                                  • Modifies registry key
                                  PID:3432
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\cQgEEYUU.bat" "C:\Users\Admin\AppData\Roaming\PolyRansom.exe""
                                  3⤵
                                    PID:2984
                                • C:\Users\Admin\AppData\Roaming\PowerPoint.exe
                                  "C:\Users\Admin\AppData\Roaming\PowerPoint.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Writes to the Master Boot Record (MBR)
                                  • System Location Discovery: System Language Discovery
                                  PID:2208
                                  • C:\Users\Admin\AppData\Roaming\PowerPoint.exe
                                    "C:\Users\Admin\AppData\Roaming\PowerPoint.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Writes to the Master Boot Record (MBR)
                                    • System Location Discovery: System Language Discovery
                                    PID:308
                                    • C:\Users\Admin\AppData\Roaming\PowerPoint.exe
                                      "C:\Users\Admin\AppData\Roaming\PowerPoint.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      PID:2796
                                    • C:\Users\Admin\AppData\Roaming\PowerPoint.exe
                                      "C:\Users\Admin\AppData\Roaming\PowerPoint.exe"
                                      4⤵
                                        PID:952
                                      • C:\Users\Admin\AppData\Roaming\PowerPoint.exe
                                        "C:\Users\Admin\AppData\Roaming\PowerPoint.exe"
                                        4⤵
                                          PID:1804
                                      • C:\Users\Admin\AppData\Roaming\PowerPoint.exe
                                        "C:\Users\Admin\AppData\Roaming\PowerPoint.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        PID:1596
                                      • C:\Users\Admin\AppData\Roaming\PowerPoint.exe
                                        "C:\Users\Admin\AppData\Roaming\PowerPoint.exe"
                                        3⤵
                                          PID:2024
                                        • C:\Users\Admin\AppData\Roaming\PowerPoint.exe
                                          "C:\Users\Admin\AppData\Roaming\PowerPoint.exe"
                                          3⤵
                                            PID:2156
                                        • C:\Users\Admin\AppData\Roaming\RedBoot.exe
                                          "C:\Users\Admin\AppData\Roaming\RedBoot.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:1608
                                          • C:\Users\Admin\94902035\protect.exe
                                            "C:\Users\Admin\94902035\protect.exe"
                                            3⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1720
                                          • C:\Users\Admin\94902035\assembler.exe
                                            "C:\Users\Admin\94902035\assembler.exe" -f bin "C:\Users\Admin\94902035\boot.asm" -o "C:\Users\Admin\94902035\boot.bin"
                                            3⤵
                                            • Executes dropped EXE
                                            PID:2576
                                        • C:\Users\Admin\AppData\Roaming\RedEye.exe
                                          "C:\Users\Admin\AppData\Roaming\RedEye.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          PID:2660
                                        • C:\Users\Admin\AppData\Roaming\Rensenware.exe
                                          "C:\Users\Admin\AppData\Roaming\Rensenware.exe"
                                          2⤵
                                          • Executes dropped EXE
                                          PID:2844
                                          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
                                            dw20.exe -x -s 384
                                            3⤵
                                              PID:3916
                                          • C:\Users\Admin\AppData\Roaming\Rokku.exe
                                            "C:\Users\Admin\AppData\Roaming\Rokku.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:1504
                                          • C:\Users\Admin\AppData\Roaming\Satana.exe
                                            "C:\Users\Admin\AppData\Roaming\Satana.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            PID:2480
                                            • C:\Users\Admin\AppData\Roaming\Satana.exe
                                              "C:\Users\Admin\AppData\Roaming\Satana.exe"
                                              3⤵
                                                PID:3792
                                            • C:\Users\Admin\AppData\Roaming\Seftad.exe
                                              "C:\Users\Admin\AppData\Roaming\Seftad.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              PID:3056
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3056 -s 224
                                                3⤵
                                                • Program crash
                                                PID:4032
                                            • C:\Users\Admin\AppData\Roaming\SporaRansomware.exe
                                              "C:\Users\Admin\AppData\Roaming\SporaRansomware.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              PID:1756
                                            • C:\Users\Admin\AppData\Roaming\ViraLock.exe
                                              "C:\Users\Admin\AppData\Roaming\ViraLock.exe"
                                              2⤵
                                                PID:2512
                                                • C:\Users\Admin\tIIkEEwU\KWwoEgIM.exe
                                                  "C:\Users\Admin\tIIkEEwU\KWwoEgIM.exe"
                                                  3⤵
                                                    PID:2532
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 2532 -s 36
                                                      4⤵
                                                      • Program crash
                                                      PID:616
                                                  • C:\ProgramData\DuAEsgUs\fmEIoUAk.exe
                                                    "C:\ProgramData\DuAEsgUs\fmEIoUAk.exe"
                                                    3⤵
                                                      PID:1548
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 36
                                                        4⤵
                                                        • Program crash
                                                        PID:4044
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd /c "C:\Users\Admin\AppData\Roaming\ViraLock"
                                                      3⤵
                                                        PID:3620
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
                                                        3⤵
                                                        • Modifies registry key
                                                        PID:3316
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
                                                        3⤵
                                                        • Modifies registry key
                                                        PID:3364
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
                                                        3⤵
                                                        • Modifies registry key
                                                        PID:3444
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\WwsAIwMk.bat" "C:\Users\Admin\AppData\Roaming\ViraLock.exe""
                                                        3⤵
                                                          PID:3496
                                                      • C:\Users\Admin\AppData\Roaming\WannaCry.exe
                                                        "C:\Users\Admin\AppData\Roaming\WannaCry.exe"
                                                        2⤵
                                                          PID:2984
                                                        • C:\Users\Admin\AppData\Roaming\WannaCrypt0r.exe
                                                          "C:\Users\Admin\AppData\Roaming\WannaCrypt0r.exe"
                                                          2⤵
                                                            PID:2664
                                                            • C:\Windows\SysWOW64\attrib.exe
                                                              attrib +h .
                                                              3⤵
                                                              • Views/modifies file attributes
                                                              PID:3864
                                                            • C:\Windows\SysWOW64\icacls.exe
                                                              icacls . /grant Everyone:F /T /C /Q
                                                              3⤵
                                                              • Modifies file permissions
                                                              PID:3872

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Reconnaissance

                                                        Resource Development

                                                        Initial Access

                                                        Execution

                                                        Windows Management Instrumentation

                                                        1
                                                        T1047

                                                        Persistence

                                                        Boot or Logon Autostart Execution

                                                        3
                                                        T1547

                                                        Registry Run Keys / Startup Folder

                                                        1
                                                        T1547.001

                                                        Winlogon Helper DLL

                                                        2
                                                        T1547.004

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Event Triggered Execution

                                                        1
                                                        T1546

                                                        Netsh Helper DLL

                                                        1
                                                        T1546.007

                                                        Pre-OS Boot

                                                        1
                                                        T1542

                                                        Bootkit

                                                        1
                                                        T1542.003

                                                        Privilege Escalation

                                                        Boot or Logon Autostart Execution

                                                        3
                                                        T1547

                                                        Registry Run Keys / Startup Folder

                                                        1
                                                        T1547.001

                                                        Winlogon Helper DLL

                                                        2
                                                        T1547.004

                                                        Create or Modify System Process

                                                        1
                                                        T1543

                                                        Windows Service

                                                        1
                                                        T1543.003

                                                        Event Triggered Execution

                                                        1
                                                        T1546

                                                        Netsh Helper DLL

                                                        1
                                                        T1546.007

                                                        Defense Evasion

                                                        Direct Volume Access

                                                        1
                                                        T1006

                                                        File and Directory Permissions Modification

                                                        2
                                                        T1222

                                                        Windows File and Directory Permissions Modification

                                                        1
                                                        T1222.001

                                                        Hide Artifacts

                                                        1
                                                        T1564

                                                        Hidden Files and Directories

                                                        1
                                                        T1564.001

                                                        Impair Defenses

                                                        2
                                                        T1562

                                                        Disable or Modify System Firewall

                                                        1
                                                        T1562.004

                                                        Safe Mode Boot

                                                        1
                                                        T1562.009

                                                        Indicator Removal

                                                        2
                                                        T1070

                                                        File Deletion

                                                        2
                                                        T1070.004

                                                        Modify Registry

                                                        7
                                                        T1112

                                                        Pre-OS Boot

                                                        1
                                                        T1542

                                                        Bootkit

                                                        1
                                                        T1542.003

                                                        Credential Access

                                                        Discovery

                                                        Peripheral Device Discovery

                                                        1
                                                        T1120

                                                        Query Registry

                                                        2
                                                        T1012

                                                        System Information Discovery

                                                        3
                                                        T1082

                                                        System Location Discovery

                                                        1
                                                        T1614

                                                        System Language Discovery

                                                        1
                                                        T1614.001

                                                        Lateral Movement

                                                        Collection

                                                        Command and Control

                                                        Exfiltration

                                                        Impact

                                                        Inhibit System Recovery

                                                        2
                                                        T1490

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\OKZDdMvPhQTgQT5\_R_E_A_D___T_H_I_S___SLPGSN_.hta
                                                          Filesize

                                                          76KB

                                                          MD5

                                                          efd8cb58e0430d4d4d4fd84cf13d239f

                                                          SHA1

                                                          2fbc96ac52333813443a79dcc9492f122ec782cd

                                                          SHA256

                                                          c0855e38aa228e8a82148fb6c53eb71564ae3903c8697769ea08a83e85316f10

                                                          SHA512

                                                          eb4942a6fe37c002a34ee3f1ce26c0c6b4164f8a2c1b15613ed11f856ac77235d08148db1425c1360a57260dd13a324a5682974ff25edb7c5ec1556078a90522

                                                          Download Submit

                                                        • C:\ProgramData\NOgAgsAI\gAcQAQwg.exe
                                                          Filesize

                                                          199KB

                                                          MD5

                                                          3b05ced94cff6162486cfd64f3abf1f7

                                                          SHA1

                                                          e05b346c60658bec73fc25991f435be904fbc11b

                                                          SHA256

                                                          100a36054a8c20dcbe212dd3ba64cd0bf302f73cfd52feb519a3a1e6ce088144

                                                          SHA512

                                                          3d93fe59282a2d7a5923c389f855da955418e157fcc89434b39034501f26a45d1226345d21fa080b934b8c5b4c45c6c596df89e233d31ffd6fdf013ea63cbc50

                                                          Download Submit

                                                        • C:\Users\Admin\94902035\assembler.exe
                                                          Filesize

                                                          589KB

                                                          MD5

                                                          7e3cea1f686207563c8369f64ea28e5b

                                                          SHA1

                                                          a1736fd61555841396b0406d5c9ca55c4b6cdf41

                                                          SHA256

                                                          2a5305369edb9c2d7354b2f210e91129e4b8c546b0adf883951ea7bf7ee0f2b2

                                                          SHA512

                                                          4629bc32094bdb030e6c9be247068e7295599203284cb95921c98fcbe3ac60286670be7e5ee9f0374a4017286c7af9db211bd831e3ea871d31a509d7bbc1d6a3

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\MaoQAgQE.bat
                                                          Filesize

                                                          4B

                                                          MD5

                                                          03f02239e3407a5fff7fead3e67d4f62

                                                          SHA1

                                                          eba6b2007633c970eaffcf65794b91888793891e

                                                          SHA256

                                                          b03480b167f675a2d786514241b6bdb954cc74780b378f169d2507cd6007bb25

                                                          SHA512

                                                          4c5ee88d31eca7d77c250d4fb389fd0a1e788190286c393e7888d983556622aee0dd63e85d9669350c4bb642dc57fc82944ae42a4d23dede88e2303ea237fa84

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\ac\EVER\1saas\LogDelete.exe
                                                          Filesize

                                                          1.3MB

                                                          MD5

                                                          6ca170ece252721ed6cc3cfa3302d6f0

                                                          SHA1

                                                          cf475d6e172b54633479b3587e90dd82824ff051

                                                          SHA256

                                                          f3a23e5e9a7caefcc81cfe4ed8df93ff84d5d32c6c63cdbb09f41d84f56a4126

                                                          SHA512

                                                          65b6ceee14b6b5bd7baee12c808d02aeb3af5f5e832d33dcdb32df44c1bfbc1896678dcc517cf90377020ba64af2ccad1790d58f67531196bbd5222f07694c1d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\ac\Shadow.bat
                                                          Filesize

                                                          28B

                                                          MD5

                                                          df8394082a4e5b362bdcb17390f6676d

                                                          SHA1

                                                          5750248ff490ceec03d17ee9811ac70176f46614

                                                          SHA256

                                                          da3f155cfb98ce0add29a31162d23da7596da44ba2391389517fe1a2790da878

                                                          SHA512

                                                          8ce519dc5c2dd0bbb9f7f48bedf01362c56467800ac0029c8011ee5d9d19e3b3f2eff322e7306acf693e2edb9cf75caaf7b85eb8b2b6c3101ff7e1644950303d

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\ac\mssql.exe
                                                          Filesize

                                                          10.2MB

                                                          MD5

                                                          f6a3d38aa0ae08c3294d6ed26266693f

                                                          SHA1

                                                          9ced15d08ffddb01db3912d8af14fb6cc91773f2

                                                          SHA256

                                                          c522e0b5332cac67cde8fc84080db3b8f2e0fe85f178d788e38b35bbe4d464ad

                                                          SHA512

                                                          814b1130a078dcb6ec59dbfe657724e36aa3db64ed9b2f93d8559b6a50e512365c8596240174141d6977b5ddcf7f281add7886c456dc7463c97f432507e73515

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\ac\mssql2.exe
                                                          Filesize

                                                          6.7MB

                                                          MD5

                                                          f7d94750703f0c1ddd1edd36f6d0371d

                                                          SHA1

                                                          cc9b95e5952e1c870f7be55d3c77020e56c34b57

                                                          SHA256

                                                          659e441cadd42399fc286b92bbc456ff2e9ecb24984c0586acf83d73c772b45d

                                                          SHA512

                                                          af0ced00dc6eeaf6fb3336d9b3abcc199fb42561b8ce24ff2e6199966ad539bc2387ba83a4838301594e50e36844796e96c30a9aa9ad5f03cf06860f3f44e0fa

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\ac\nc123.exe
                                                          Filesize

                                                          125KB

                                                          MD5

                                                          597de376b1f80c06d501415dd973dcec

                                                          SHA1

                                                          629c9649ced38fd815124221b80c9d9c59a85e74

                                                          SHA256

                                                          f47e3555461472f23ab4766e4d5b6f6fd260e335a6abc31b860e569a720a5446

                                                          SHA512

                                                          072565912208e97cc691e1a102e32fd6c243b5a3f8047a159e97aabbe302bddc36f3c52cecde3b506151bc89e0f3b5acf6552a82d83dac6e0180c873d36d3f6b

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\ac\pczzjaqrzqfnry.sys
                                                          Filesize

                                                          674KB

                                                          MD5

                                                          b2233d1efb0b7a897ea477a66cd08227

                                                          SHA1

                                                          835a198a11c9d106fc6aabe26b9b3e59f6ec68fd

                                                          SHA256

                                                          5fd17e3b8827b5bb515343bc4066be0814f6466fb4294501becac284a378c0da

                                                          SHA512

                                                          6ca61854db877d767ce587ac3d7526cda8254d937a159fd985e0475d062d07ae83e7ff4f9f42c7e1e1cad5e1f408f6849866aa4e9e48b29d80510e5c695cee37

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\ac\systembackup.bat
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          b4b2f1a6c7a905781be7d877487fc665

                                                          SHA1

                                                          7ee27672d89940e96bcb7616560a4bef8d8af76c

                                                          SHA256

                                                          6246b0045ca11da483e38317421317dc22462a8d81e500dee909a5269c086b5f

                                                          SHA512

                                                          f883cea56a9ac5dcb838802753770494ce7b1de9d7da6a49b878d534810f9c87170f04e0b8b516ae19b9492f40635a72b3e8a4533d39312383c520abe00c5ae6

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\cQgEEYUU.bat
                                                          Filesize

                                                          112B

                                                          MD5

                                                          bae1095f340720d965898063fede1273

                                                          SHA1

                                                          455d8a81818a7e82b1490c949b32fa7ff98d5210

                                                          SHA256

                                                          ee5e0a414167c2aca961a616274767c4295659517a814d1428248bd53c6e829a

                                                          SHA512

                                                          4e73a24161114844d0e42c44c73205c4a57fa4169bd16c95fb7e9d6d5fcdf8bd01741541c77570556ac1f5ee260da67a9041f40381b6c6e0601c9de385bdc024

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\is-3KHC0.tmp\butterflyondesktop.tmp
                                                          Filesize

                                                          688KB

                                                          MD5

                                                          c765336f0dcf4efdcc2101eed67cd30c

                                                          SHA1

                                                          fa0279f59738c5aa3b6b20106e109ccd77f895a7

                                                          SHA256

                                                          c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28

                                                          SHA512

                                                          06a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Temp\oikwcQAM.bat
                                                          Filesize

                                                          4B

                                                          MD5

                                                          be7400077d5e89412ba779ce01f5ac9d

                                                          SHA1

                                                          5e5b649bacd56b344cb08bee4c81c89ce6625ff2

                                                          SHA256

                                                          ca2336c56b7f20e9f0226d11d02fa18257ee834c299fb96e7c72e42510891d72

                                                          SHA512

                                                          09e0aa8205fd25155b3e63cf1f9c1f744ebb3870a12d3521f62cc956fa77500c3280237c00dc9533d5c9e2ad1f32ca322e653036c49f4b8de0526f3e784e6a90

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\$uckyLocker.exe
                                                          Filesize

                                                          414KB

                                                          MD5

                                                          c850f942ccf6e45230169cc4bd9eb5c8

                                                          SHA1

                                                          51c647e2b150e781bd1910cac4061a2cee1daf89

                                                          SHA256

                                                          86e0eac8c5ce70c4b839ef18af5231b5f92e292b81e440193cdbdc7ed108049f

                                                          SHA512

                                                          2b3890241b8c8690aab0aed347daa778aba20f29f76e8b79b02953b6252324317520b91ea60d3ef73e42ad403f7a6e0e3f2a057799f21ed447dae7096b2f47d9

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\7ev3n.exe
                                                          Filesize

                                                          315KB

                                                          MD5

                                                          9f8bc96c96d43ecb69f883388d228754

                                                          SHA1

                                                          61ed25a706afa2f6684bb4d64f69c5fb29d20953

                                                          SHA256

                                                          7d373ccb96d1dbb1856ef31afa87c2112a0c1795a796ab01cb154700288afec5

                                                          SHA512

                                                          550a891c1059f58aa983138caf65a7ea9c326cb1b94c15f3e7594128f6e9f1295b9c2dbc0925637dba7c94e938083fffc6a63dc7c2e5b1e247679931cce505c6

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\AgentTesla.exe
                                                          Filesize

                                                          2.8MB

                                                          MD5

                                                          cce284cab135d9c0a2a64a7caec09107

                                                          SHA1

                                                          e4b8f4b6cab18b9748f83e9fffd275ef5276199e

                                                          SHA256

                                                          18aab0e981eee9e4ef8e15d4b003b14b3a1b0bfb7233fade8ee4b6a22a5abbb9

                                                          SHA512

                                                          c45d021295871447ce60250ff9cbeba2b2a16a23371530da077d6235cfe5005f10fa228071542df3621462d913ad2f58236dc0c0cb390779eef86a10bba8429f

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\BadRabbit.exe
                                                          Filesize

                                                          431KB

                                                          MD5

                                                          fbbdc39af1139aebba4da004475e8839

                                                          SHA1

                                                          de5c8d858e6e41da715dca1c019df0bfb92d32c0

                                                          SHA256

                                                          630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da

                                                          SHA512

                                                          74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Birele.exe
                                                          Filesize

                                                          116KB

                                                          MD5

                                                          41789c704a0eecfdd0048b4b4193e752

                                                          SHA1

                                                          fb1e8385691fa3293b7cbfb9b2656cf09f20e722

                                                          SHA256

                                                          b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23

                                                          SHA512

                                                          76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Cerber5.exe
                                                          Filesize

                                                          313KB

                                                          MD5

                                                          fe1bc60a95b2c2d77cd5d232296a7fa4

                                                          SHA1

                                                          c07dfdea8da2da5bad036e7c2f5d37582e1cf684

                                                          SHA256

                                                          b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d

                                                          SHA512

                                                          266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\CoronaVirus.exe
                                                          Filesize

                                                          1.0MB

                                                          MD5

                                                          055d1462f66a350d9886542d4d79bc2b

                                                          SHA1

                                                          f1086d2f667d807dbb1aa362a7a809ea119f2565

                                                          SHA256

                                                          dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

                                                          SHA512

                                                          2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\CryptoLocker.exe
                                                          Filesize

                                                          338KB

                                                          MD5

                                                          04fb36199787f2e3e2135611a38321eb

                                                          SHA1

                                                          65559245709fe98052eb284577f1fd61c01ad20d

                                                          SHA256

                                                          d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9

                                                          SHA512

                                                          533d6603f6e2a77bd1b2c6591a135c4717753d53317c1be06e43774e896d9543bcd0ea6904a0688aa84b2d8424641d68994b1e7dc4aa46d66c36feecb6145444

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\CryptoWall.exe
                                                          Filesize

                                                          132KB

                                                          MD5

                                                          919034c8efb9678f96b47a20fa6199f2

                                                          SHA1

                                                          747070c74d0400cffeb28fbea17b64297f14cfbd

                                                          SHA256

                                                          e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

                                                          SHA512

                                                          745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\DeriaLock.exe
                                                          Filesize

                                                          484KB

                                                          MD5

                                                          0a7b70efba0aa93d4bc0857b87ac2fcb

                                                          SHA1

                                                          01a6c963b2f5f36ff21a1043587dcf921ae5f5cd

                                                          SHA256

                                                          4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309

                                                          SHA512

                                                          2033f9637b8d023242c93f54c140dd561592a3380a15a9fdc8ebfa33385ff4fc569d66c846a01b4ac005f0521b3c219e87f4b1ed2a83557f9d95fa066ad25e14

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Dharma.exe
                                                          Filesize

                                                          11.5MB

                                                          MD5

                                                          928e37519022745490d1af1ce6f336f7

                                                          SHA1

                                                          b7840242393013f2c4c136ac7407e332be075702

                                                          SHA256

                                                          6fb303dd8ba36381948127d44bd8541e4a1ab8af07b46526ace08458f2498850

                                                          SHA512

                                                          8040195ab2b2e15c9d5ffa13a47a61c709738d1cf5e2108e848fedf3408e5bad5f2fc5f523f170f6a80cb33a4f5612d3d60dd343d028e55cfc08cd2f6ed2947c

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Fantom.exe
                                                          Filesize

                                                          261KB

                                                          MD5

                                                          7d80230df68ccba871815d68f016c282

                                                          SHA1

                                                          e10874c6108a26ceedfc84f50881824462b5b6b6

                                                          SHA256

                                                          f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b

                                                          SHA512

                                                          64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\GandCrab.exe
                                                          Filesize

                                                          291KB

                                                          MD5

                                                          e6b43b1028b6000009253344632e69c4

                                                          SHA1

                                                          e536b70e3ffe309f7ae59918da471d7bf4cadd1c

                                                          SHA256

                                                          bfb9db791b8250ffa8ebc48295c5dbbca757a5ed3bbb01de12a871b5cd9afd5a

                                                          SHA512

                                                          07da214314673407a7d3978ee6e1d20bf1e02f135bf557e86b50489ecc146014f2534515c1b613dba96e65489d8c82caaa8ed2e647684d61e5e86bd3e8251adf

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\HawkEye.exe
                                                          Filesize

                                                          232KB

                                                          MD5

                                                          60fabd1a2509b59831876d5e2aa71a6b

                                                          SHA1

                                                          8b91f3c4f721cb04cc4974fc91056f397ae78faa

                                                          SHA256

                                                          1dacdc296fd6ef6ba817b184cce9901901c47c01d849adfa4222bfabfed61838

                                                          SHA512

                                                          3e842a7d47b32942adb936cae13293eddf1a6b860abcfe7422d0fb73098264cc95656b5c6d9980fad1bf8b5c277cd846c26acaba1bef441582caf34eb1e5295a

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\InfinityCrypt.exe
                                                          Filesize

                                                          211KB

                                                          MD5

                                                          b805db8f6a84475ef76b795b0d1ed6ae

                                                          SHA1

                                                          7711cb4873e58b7adcf2a2b047b090e78d10c75b

                                                          SHA256

                                                          f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf

                                                          SHA512

                                                          62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Krotten.exe
                                                          Filesize

                                                          53KB

                                                          MD5

                                                          87ccd6f4ec0e6b706d65550f90b0e3c7

                                                          SHA1

                                                          213e6624bff6064c016b9cdc15d5365823c01f5f

                                                          SHA256

                                                          e79f164ccc75a5d5c032b4c5a96d6ad7604faffb28afe77bc29b9173fa3543e4

                                                          SHA512

                                                          a72403d462e2e2e181dbdabfcc02889f001387943571391befed491aaecba830b0869bdd4d82bca137bd4061bbbfb692871b1b4622c4a7d9f16792c60999c990

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\NoMoreRansom.exe
                                                          Filesize

                                                          1.4MB

                                                          MD5

                                                          63210f8f1dde6c40a7f3643ccf0ff313

                                                          SHA1

                                                          57edd72391d710d71bead504d44389d0462ccec9

                                                          SHA256

                                                          2aab13d49b60001de3aa47fb8f7251a973faa7f3c53a3840cdf5fd0b26e9a09f

                                                          SHA512

                                                          87a89e8ab85be150a783a9f8d41797cfa12f86fdccb48f2180c0498bfd2b1040b730dee4665fe2c83b98d436453680226051b7f1532e1c0e0cda0cf702e80a11

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\NotPetya.exe
                                                          Filesize

                                                          390KB

                                                          MD5

                                                          5b7e6e352bacc93f7b80bc968b6ea493

                                                          SHA1

                                                          e686139d5ed8528117ba6ca68fe415e4fb02f2be

                                                          SHA256

                                                          63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a

                                                          SHA512

                                                          9d24af0cb00fb8a5e61e9d19cd603b5541a22ae6229c2acf498447e0e7d4145fee25c8ab9d5d5f18f554e6cbf8ca56b7ca3144e726d7dfd64076a42a25b3dfb6

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Petya.A.exe
                                                          Filesize

                                                          225KB

                                                          MD5

                                                          af2379cc4d607a45ac44d62135fb7015

                                                          SHA1

                                                          39b6d40906c7f7f080e6befa93324dddadcbd9fa

                                                          SHA256

                                                          26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739

                                                          SHA512

                                                          69899c47d0b15f92980f79517384e83373242e045ca696c6e8f930ff6454219bf609e0d84c2f91d25dfd5ef3c28c9e099c4a3a918206e957be806a1c2e0d3e99

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\PolyRansom.exe
                                                          Filesize

                                                          220KB

                                                          MD5

                                                          3ed3fb296a477156bc51aba43d825fc0

                                                          SHA1

                                                          9caa5c658b1a88fee149893d3a00b34a8bb8a1a6

                                                          SHA256

                                                          1898f2cae1e3824cb0f7fd5368171a33aba179e63501e480b4da9ea05ebf0423

                                                          SHA512

                                                          dc3d6e409cee4d54f48d1a25912243d07e2f800578c8e0e348ce515a047ecf5fa3089b46284e0956bbced345957a000eecdc082e6f3060971759d70a14c1c97e

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\PowerPoint.exe
                                                          Filesize

                                                          136KB

                                                          MD5

                                                          70108103a53123201ceb2e921fcfe83c

                                                          SHA1

                                                          c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

                                                          SHA256

                                                          9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

                                                          SHA512

                                                          996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\RedBoot.exe
                                                          Filesize

                                                          1.2MB

                                                          MD5

                                                          e0340f456f76993fc047bc715dfdae6a

                                                          SHA1

                                                          d47f6f7e553c4bc44a2fe88c2054de901390b2d7

                                                          SHA256

                                                          1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887

                                                          SHA512

                                                          cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\RedEye.exe
                                                          Filesize

                                                          10.6MB

                                                          MD5

                                                          e9e5596b42f209cc058b55edc2737a80

                                                          SHA1

                                                          f30232697b3f54e58af08421da697262c99ec48b

                                                          SHA256

                                                          9ac9f207060c28972ede6284137698ce0769e3695c7ad98ab320605d23362305

                                                          SHA512

                                                          e542319beb6f81b493ad80985b5f9c759752887dc3940b77520a3569cd5827de2fcae4c2357b7f9794b382192d4c0b125746df5cf08f206d07b2b473b238d0c7

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Rensenware.exe
                                                          Filesize

                                                          96KB

                                                          MD5

                                                          60335edf459643a87168da8ed74c2b60

                                                          SHA1

                                                          61f3e01174a6557f9c0bfc89ae682d37a7e91e2e

                                                          SHA256

                                                          7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a

                                                          SHA512

                                                          b4e5e4d4f0b4a52243d6756c66b4fe6f4b39e64df7790072046e8a3dadad3a1be30b8689a1bab8257cc35cb4df652888ddf62b4e1fccb33e1bbf1f5416d73efb

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Rokku.exe
                                                          Filesize

                                                          666KB

                                                          MD5

                                                          97512f4617019c907cd0f88193039e7c

                                                          SHA1

                                                          24cfa261ee30f697e7d1e2215eee1c21eebf4579

                                                          SHA256

                                                          438888ef36bad1079af79daf152db443b4472c5715a7b3da0ba24cc757c53499

                                                          SHA512

                                                          cfbb8dd91434f917d507cb919aa7e6b16b7b2056d56185f6ad5b6149e05629325cdb3df907f58bb3f634b17a9989bf5b6d6b81f5396a3a556431742ed742ac4a

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\Satana.exe
                                                          Filesize

                                                          49KB

                                                          MD5

                                                          46bfd4f1d581d7c0121d2b19a005d3df

                                                          SHA1

                                                          5b063298bbd1670b4d39e1baef67f854b8dcba9d

                                                          SHA256

                                                          683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96

                                                          SHA512

                                                          b52aa090f689765d099689700be7e18922137e7a860a00113e3f72aa6553e94a870bbb741e52de9617506a236a2a59198fb224fcd128576d76642eec9d715df5

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\US258-03XXT-ZTXTX-HTOET-XYYYY.KEY
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          370a789f1879f35ba741ec57c61f8b02

                                                          SHA1

                                                          9ecf12d01cb7449f795163f5f755755ad659db81

                                                          SHA256

                                                          a0a51d57f44af91a35b7ddbc32a9618ed324b693efa01d9e8b0ef9db66675896

                                                          SHA512

                                                          749cd9018117a2e25f22931595de8627c5193194e3ac4d4a7b400766e4bf189cc9cd2fbac2997cec9184f4a5baa414d146b9f4a690ffd5e0a300457738172740

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\ViraLock.exe
                                                          Filesize

                                                          194KB

                                                          MD5

                                                          8803d517ac24b157431d8a462302b400

                                                          SHA1

                                                          b56afcad22e8cda4d0e2a98808b8e8c5a1059d4e

                                                          SHA256

                                                          418395efd269bc6534e02c92cb2c568631ada6e54bc55ade4e4a5986605ff786

                                                          SHA512

                                                          38fdfe0bc873e546b05a8680335526eec61ccc8cf3f37c60eee0bc83ec54570077f1dc1da26142488930eabcc21cb7a33c1b545a194cbfb4c87e430c4b2bfb50

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\butterflyondesktop.exe
                                                          Filesize

                                                          2.8MB

                                                          MD5

                                                          1535aa21451192109b86be9bcc7c4345

                                                          SHA1

                                                          1af211c686c4d4bf0239ed6620358a19691cf88c

                                                          SHA256

                                                          4641af6a0071e11e13ad3b1cd950e01300542c2b9efb6ae92ffecedde974a4a6

                                                          SHA512

                                                          1762b29f7b26911a7e6d244454eac7268235e2e0c27cd2ca639b8acdde2528c9ddf202ed59ca3155ee1d6ad3deba559a6eaf4ed74624c68688761e3e404e54da

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Roaming\msg\m_finnish.wnry
                                                          Filesize

                                                          37KB

                                                          MD5

                                                          35c2f97eea8819b1caebd23fee732d8f

                                                          SHA1

                                                          e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                          SHA256

                                                          1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                          SHA512

                                                          908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                          Download Submit

                                                        • C:\Users\Admin\YmEYAIYQ\mScIAEMI.exe
                                                          Filesize

                                                          192KB

                                                          MD5

                                                          60334f56ae92025f90456e9aa2d6c53a

                                                          SHA1

                                                          8ecdf71605695973dc76a37d7ebbf40d034b7a77

                                                          SHA256

                                                          1fdb6c40dd46174c58018589e3f1bc5f0e3ede792cf757a001dd74321be45001

                                                          SHA512

                                                          272fbe2f864377dd81c07a02127fd5167767191720a8bef4e523ab82fcb9a846c29444363b3c4d62850b6bc5d6d1846692eab64df9910139f1e0e6513bd12ead

                                                          Download Submit

                                                        • C:\Users\Public\Pictures\_R_E_A_D___T_H_I_S___NHTGWHH3_.txt
                                                          Filesize

                                                          1KB

                                                          MD5

                                                          fa39b219ba5cebfd99059756a35d3990

                                                          SHA1

                                                          7327d9c4dab1da544019c8862619e52e63ba7834

                                                          SHA256

                                                          d6e1164f220eb1c9aed5bdfd168bf1866714d0c5fe5a8153ab20caee8f1850a1

                                                          SHA512

                                                          dbf373f2f3b46136105b5a82f8adeb1c44d4ba430598a1f2dfc07997f2e8076282487755239292098c1a811d3aa6d006cd6ddd23270b783724db79bcf25c16a9

                                                          Download Submit

                                                        • C:\Users\QWYXODCYVL-MANUAL.txt
                                                          Filesize

                                                          8KB

                                                          MD5

                                                          18daa2fe7841ef59e438a9c423453d56

                                                          SHA1

                                                          fed84dadceafefe26139a030b483c5f19f63eae6

                                                          SHA256

                                                          f14034446bf8c881d94c997d5256f19c905dbe9ba1721bed708a35f329ee9c2e

                                                          SHA512

                                                          9c1adc96f2af689ee95ad31e58e0b93cfe2a6fac4916005946ed85c18a9ee7da22d15f29918f7af95fcc4a46a8e6d953d4c5a2f62f27d864ade4ddabb2d622d9

                                                          Download Submit

                                                        • C:\Windows\DC2C.tmp
                                                          Filesize

                                                          60KB

                                                          MD5

                                                          c7ca77d847f1802502ef3b9228d388e4

                                                          SHA1

                                                          80ab09116d877b924dfec5b6e8eb6d3dde35869e

                                                          SHA256

                                                          fdef2f6da8c5e8002fa5822e8e4fea278fba66c22df9e13b61c8a95c2f9d585f

                                                          SHA512

                                                          b5c23209597ecddbcde6cd8e72392721c3c2848385ad3f4c644024979f777fd11f2dd19e763f443c4759bb339b047034997fb06566ce7d4574cf3e4b75f51b7d

                                                          Download Submit

                                                        • C:\Windows\infpub.dat
                                                          Filesize

                                                          401KB

                                                          MD5

                                                          1d724f95c61f1055f0d02c2154bbccd3

                                                          SHA1

                                                          79116fe99f2b421c52ef64097f0f39b815b20907

                                                          SHA256

                                                          579fd8a0385482fb4c789561a30b09f25671e86422f40ef5cca2036b28f99648

                                                          SHA512

                                                          f2d7b018d1516df1c97cfff5507957c75c6d9bf8e2ce52ae0052706f4ec62f13eba6d7be17e6ad2b693fdd58e1fd091c37f17bd2b948cdcd9b95b4ad428c0113

                                                          Download Submit

                                                        • C:\Windows\perfc.dat
                                                          Filesize

                                                          353KB

                                                          MD5

                                                          71b6a493388e7d0b40c83ce903bc6b04

                                                          SHA1

                                                          34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d

                                                          SHA256

                                                          027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745

                                                          SHA512

                                                          072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f

                                                          Download Submit

                                                        • \Users\Admin\AppData\Local\Temp\is-SU1QC.tmp\_isetup\_shfoldr.dll
                                                          Filesize

                                                          22KB

                                                          MD5

                                                          92dc6ef532fbb4a5c3201469a5b5eb63

                                                          SHA1

                                                          3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                          SHA256

                                                          9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                          SHA512

                                                          9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                          Download Submit

                                                        • \Users\Admin\AppData\Roaming\Annabelle.exe
                                                          Filesize

                                                          15.9MB

                                                          MD5

                                                          0f743287c9911b4b1c726c7c7edcaf7d

                                                          SHA1

                                                          9760579e73095455fcbaddfe1e7e98a2bb28bfe0

                                                          SHA256

                                                          716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac

                                                          SHA512

                                                          2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677

                                                          Download Submit

                                                        • memory/308-481-0x000000002AA00000-0x000000002AA24000-memory.dmp

                                                          Filesize

                                                          144KB

                                                          Download

                                                        • memory/1072-179-0x0000000001210000-0x000000000124C000-memory.dmp

                                                          Filesize

                                                          240KB

                                                          Download

                                                        • memory/1268-101-0x0000000000400000-0x000000000056F000-memory.dmp

                                                          Filesize

                                                          1.4MB

                                                          Download

                                                        • memory/1288-270-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-266-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-264-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-262-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-260-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-258-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-256-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-254-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-252-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-250-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-248-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-246-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-244-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-242-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-240-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-238-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-237-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-268-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-272-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-274-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-276-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-278-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-280-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-282-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-284-0x0000000002170000-0x000000000219B000-memory.dmp

                                                          Filesize

                                                          172KB

                                                          Download

                                                        • memory/1288-160-0x0000000001F70000-0x0000000001FA2000-memory.dmp

                                                          Filesize

                                                          200KB

                                                          Download

                                                        • memory/1288-163-0x0000000002170000-0x00000000021A2000-memory.dmp

                                                          Filesize

                                                          200KB

                                                          Download

                                                        • memory/1384-472-0x0000000000460000-0x0000000000491000-memory.dmp

                                                          Filesize

                                                          196KB

                                                          Download

                                                        • memory/1384-534-0x0000000000460000-0x0000000000493000-memory.dmp

                                                          Filesize

                                                          204KB

                                                          Download

                                                        • memory/1384-1063-0x0000000000400000-0x0000000000439000-memory.dmp

                                                          Filesize

                                                          228KB

                                                          Download

                                                        • memory/1384-535-0x0000000000460000-0x0000000000493000-memory.dmp

                                                          Filesize

                                                          204KB

                                                          Download

                                                        • memory/1384-473-0x0000000000460000-0x0000000000491000-memory.dmp

                                                          Filesize

                                                          196KB

                                                          Download

                                                        • memory/1384-407-0x0000000000400000-0x0000000000439000-memory.dmp

                                                          Filesize

                                                          228KB

                                                          Download

                                                        • memory/1504-940-0x0000000000400000-0x000000000058D000-memory.dmp

                                                          Filesize

                                                          1.6MB

                                                          Download

                                                        • memory/1504-501-0x0000000000400000-0x000000000058D000-memory.dmp

                                                          Filesize

                                                          1.6MB

                                                          Download

                                                        • memory/1532-1153-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/1532-698-0x0000000000400000-0x0000000000B02000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/1548-721-0x0000000000400000-0x0000000000432000-memory.dmp

                                                          Filesize

                                                          200KB

                                                          Download

                                                        • memory/1596-671-0x000000002AA00000-0x000000002AA24000-memory.dmp

                                                          Filesize

                                                          144KB

                                                          Download

                                                        • memory/1608-725-0x00000000013C0000-0x000000000164E000-memory.dmp

                                                          Filesize

                                                          2.6MB

                                                          Download

                                                        • memory/1608-420-0x00000000013C0000-0x000000000164E000-memory.dmp

                                                          Filesize

                                                          2.6MB

                                                          Download

                                                        • memory/1744-114-0x0000000001370000-0x00000000013F2000-memory.dmp

                                                          Filesize

                                                          520KB

                                                          Download

                                                        • memory/1756-670-0x0000000000400000-0x0000000000407200-memory.dmp

                                                          Filesize

                                                          28KB

                                                          Download

                                                        • memory/1780-701-0x0000000000420000-0x0000000000459000-memory.dmp

                                                          Filesize

                                                          228KB

                                                          Download

                                                        • memory/1820-112-0x0000000000080000-0x00000000000A5000-memory.dmp

                                                          Filesize

                                                          148KB

                                                          Download

                                                        • memory/1928-55-0x0000000010000000-0x0000000010010000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/1928-38-0x0000000000330000-0x0000000000370000-memory.dmp

                                                          Filesize

                                                          256KB

                                                          Download

                                                        • memory/2188-78-0x0000000000400000-0x0000000000438000-memory.dmp

                                                          Filesize

                                                          224KB

                                                          Download

                                                        • memory/2188-81-0x0000000000400000-0x0000000000438000-memory.dmp

                                                          Filesize

                                                          224KB

                                                          Download

                                                        • memory/2188-480-0x0000000000400000-0x0000000000438000-memory.dmp

                                                          Filesize

                                                          224KB

                                                          Download

                                                        • memory/2204-669-0x0000000003C10000-0x0000000004312000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/2204-660-0x0000000003C10000-0x0000000004312000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/2204-1147-0x0000000003C10000-0x0000000004312000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/2204-661-0x0000000003C10000-0x0000000004312000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/2204-1148-0x0000000003C10000-0x0000000004312000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/2204-1149-0x0000000003C10000-0x0000000004312000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/2204-1151-0x0000000003C10000-0x0000000004312000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/2204-659-0x0000000003C10000-0x0000000004312000-memory.dmp

                                                          Filesize

                                                          7.0MB

                                                          Download

                                                        • memory/2208-406-0x000000002AA00000-0x000000002AA24000-memory.dmp

                                                          Filesize

                                                          144KB

                                                          Download

                                                        • memory/2220-474-0x0000000000400000-0x0000000000431000-memory.dmp

                                                          Filesize

                                                          196KB

                                                          Download

                                                        • memory/2360-193-0x0000000000080000-0x00000000000A5000-memory.dmp

                                                          Filesize

                                                          148KB

                                                          Download

                                                        • memory/2512-720-0x0000000000470000-0x00000000004A2000-memory.dmp

                                                          Filesize

                                                          200KB

                                                          Download

                                                        • memory/2512-718-0x0000000000470000-0x000000000049E000-memory.dmp

                                                          Filesize

                                                          184KB

                                                          Download

                                                        • memory/2512-1119-0x0000000000400000-0x0000000000432000-memory.dmp

                                                          Filesize

                                                          200KB

                                                          Download

                                                        • memory/2512-717-0x0000000000470000-0x000000000049E000-memory.dmp

                                                          Filesize

                                                          184KB

                                                          Download

                                                        • memory/2512-719-0x0000000000470000-0x00000000004A2000-memory.dmp

                                                          Filesize

                                                          200KB

                                                          Download

                                                        • memory/2512-703-0x0000000000400000-0x0000000000432000-memory.dmp

                                                          Filesize

                                                          200KB

                                                          Download

                                                        • memory/2532-726-0x0000000000400000-0x000000000042E000-memory.dmp

                                                          Filesize

                                                          184KB

                                                          Download

                                                        • memory/2612-536-0x0000000000400000-0x0000000000433000-memory.dmp

                                                          Filesize

                                                          204KB

                                                          Download

                                                        • memory/2652-69-0x0000000002950000-0x000000000296A000-memory.dmp

                                                          Filesize

                                                          104KB

                                                          Download

                                                        • memory/2652-67-0x00000000026B0000-0x00000000026C6000-memory.dmp

                                                          Filesize

                                                          88KB

                                                          Download

                                                        • memory/2652-64-0x0000000000890000-0x0000000000891000-memory.dmp

                                                          Filesize

                                                          4KB

                                                          Download

                                                        • memory/2652-65-0x00000000026B0000-0x00000000026C6000-memory.dmp

                                                          Filesize

                                                          88KB

                                                          Download

                                                        • memory/2660-943-0x000000001BD70000-0x000000001CD86000-memory.dmp

                                                          Filesize

                                                          16.1MB

                                                          Download

                                                        • memory/2660-526-0x00000000001C0000-0x0000000000C5C000-memory.dmp

                                                          Filesize

                                                          10.6MB

                                                          Download

                                                        • memory/2668-1068-0x0000000000400000-0x0000000000439000-memory.dmp

                                                          Filesize

                                                          228KB

                                                          Download

                                                        • memory/2668-704-0x0000000000400000-0x0000000000439000-memory.dmp

                                                          Filesize

                                                          228KB

                                                          Download

                                                        • memory/2680-727-0x000000001BEB0000-0x000000001D43E000-memory.dmp

                                                          Filesize

                                                          21.6MB

                                                          Download

                                                        • memory/2680-68-0x000000013FB30000-0x0000000140B24000-memory.dmp

                                                          Filesize

                                                          16.0MB

                                                          Download

                                                        • memory/2692-42-0x00000000003E0000-0x000000000044E000-memory.dmp

                                                          Filesize

                                                          440KB

                                                          Download

                                                        • memory/2788-33-0x0000000000400000-0x0000000000414000-memory.dmp

                                                          Filesize

                                                          80KB

                                                          Download

                                                        • memory/3036-0-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

                                                          Filesize

                                                          4KB

                                                          Download

                                                        • memory/3036-1-0x0000000001160000-0x00000000066D6000-memory.dmp

                                                          Filesize

                                                          85.5MB

                                                          Download

                                                        • memory/3036-408-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

                                                          Filesize

                                                          4KB

                                                          Download