Overview

overview

10

Static

static

10

Dropper/Berbew.exe

windows10-2004-x64

10

Dropper/Phorphiex.exe

windows10-2004-x64

10

RAT/31.exe

windows10-2004-x64

10

RAT/XClient.exe

windows10-2004-x64

10

RAT/file.exe

windows10-2004-x64

7

Ransomware...-2.exe

windows10-2004-x64

10

Ransomware...01.exe

windows10-2004-x64

10

Ransomware...lt.exe

windows10-2004-x64

10

Stealers/Azorult.exe

windows10-2004-x64

10

Stealers/B...on.exe

windows10-2004-x64

10

Stealers/Dridex.dll

windows10-2004-x64

10

Stealers/M..._2.exe

windows10-2004-x64

3

Stealers/lumma.exe

windows10-2004-x64

10

Trojan/BetaBot.exe

windows10-2004-x64

10

Trojan/Smo...er.exe

windows10-2004-x64

10

Resubmissions

23/03/2026, 02:00

260323-cffqcsds9n10

05/03/2026, 16:32

260305-t1xm2scx3k10

11/02/2026, 21:18

260211-z5q9qaav8h10

11/05/2025, 03:54

250511-egp2javwat10

03/09/2024, 14:02

240903-rb57sazdqf10

03/09/2024, 13:51

240903-q59avszclf10

02/09/2024, 19:51

240902-yk8gtsxbpd10

02/09/2024, 02:27

240902-cxh7tazflg10

02/09/2024, 02:26

240902-cwxc2sygll10

21/06/2024, 19:37

240621-yca7cszgnd10

Analysis

  • max time kernel
    212s
  • max time network
    212s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260129-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/03/2026, 02:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Ransomware/default.exe
  • Size 211KB
  • Sample260323-cffqcsds9n
  • SHA256 516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionburanzeppelinimpactpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\dotnet\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

  • buran

Ransom Note
  • !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] or [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: A22-138-410 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Buran family
    buran
  • Detects Zeppelin payload 19 IoCs
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Zeppelin family
    zeppelin
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (6062) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ransomware\default.exe
    "C:\Users\Admin\AppData\Local\Temp\Ransomware\default.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:764
    • C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:4904
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -start
    1⤵
    • Executes dropped EXE
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 0
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:1084
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe" -agent 1
      2⤵
      • Executes dropped EXE
      PID:1136
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • System Location Discovery: System Language Discovery
      PID:520
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3784
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2072
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1920
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4624
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
      2⤵
      • System Location Discovery: System Language Discovery
      PID:764
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1952
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3652
    • C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2488
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3404

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        aic_file_icons_retina_thumb.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png
        • Size 64KB
        • SHA256 5bdbb9837b750128c2736fe9f2afa6264afbcb6e420290fc5a4a64139b14966f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aic_file_icons_retina_thumb_highContrast_bow.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png
        • Size 52KB
        • SHA256 ed20cfb32b466e0883d142098a3a79fd21cf46bb3faa3194304d83d50d2832f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aic_file_icons_retina_thumb_highContrast_wob.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png
        • Size 52KB
        • SHA256 825e36b61b028da425361d5b954717c606614c4ec0989830bfe4a42988947cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        aic_file_icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
        • Size 52KB
        • SHA256 bbc91c6ac8542893f2a18e4abb2f30686d92cbad4e0611a3fe7ebe2fe72b4554
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js
        • Size 34KB
        • SHA256 654a50e07436cf9d58c349f8e7d670ad2eb264c46a1e0a6dfd43642542478548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-il\ui-strings.js
        • Size 9KB
        • SHA256 80d2c8cb93c94280f1d90a1ee1d1da4fd07bca5cc009c71167d9930a3155187e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js
        • Size 10KB
        • SHA256 fca5296f4806a9ef6721ba1e7637c0aa3ccf6361ac04f55fbfb91cca5537adb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\ui-strings.js
        • Size 5KB
        • SHA256 df202d447c820eb31b0727861f95333aea0a03694562aa86f9ed5de435b07440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js.A22-138-410
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\ui-strings.js.A22-138-410
        • Size 6KB
        • SHA256 0bee469730a81d301f3d11fb96594dd8955fba4969a54cdf1dd664a6fd050e28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        new_icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons.png
        • Size 9KB
        • SHA256 542190ccffc466ce2823c26edd385aaec8494b7d70b08e71ec7c9faf00dd51d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        convertpdf-rna-selector.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js
        • Size 176KB
        • SHA256 4fef8a698077e78f783a744efac2396321399a4ebc9a61c88e29d631967efbba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        convertpdf-rna-tool-view.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js
        • Size 378KB
        • SHA256 d97364583d622d01cbf5fa980e0b427f3212f954b671e77c77188c93383e3802
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js
        • Size 12KB
        • SHA256 28ab9285a87de8747012e0ae68e95d29c707ba42613127a299994a54b8262d2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icons_ie8.gif
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif
        • Size 9KB
        • SHA256 8bd6a8bae99089a77cfc1d0e8812867dafdbeb7dbc877d008e9b0f34118d757b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icons_retina.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png
        • Size 16KB
        • SHA256 8e6ae84efd91ad89c037f23e5a5886d36059e6d09fc2a2c6714d4a3d1734435a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        new_icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png
        • Size 9KB
        • SHA256 d1774c7721c76f11eb2df2e2ba2c640ac2d27ed55ce6b2bc850d006a8e040001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons.png
        • Size 9KB
        • SHA256 59618f247a60ebd915ac3501da5d7e945b93b88e138b891bb7a965cf244b48c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\ui-strings.js
        • Size 6KB
        • SHA256 818714eb0c6ca05a591b7b403b2e466e2c76a46ec63e054bd0b580ce3bb7b918
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\ui-strings.js
        • Size 7KB
        • SHA256 65834d6d52eea8315aeab55d4c70c1538213010cbbe2347c36bd1bbf3384804e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppStore_icon.svg
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\AppStore_icon.svg
        • Size 15KB
        • SHA256 d1e6a5c0ad2650ca5044c1741dfd054d44c84fee1b89e2fa3274e0e50ef8ebe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MobileAcrobatCard_Light.pdf
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf
        • Size 381KB
        • SHA256 77d4d2fad5f658b8ccc930185504bafbeb27dfee3e3ba8aefc2cd7c6fddebe6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MobileScanCard_Light.pdf
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf
        • Size 56KB
        • SHA256 ac0ad7203453794fd6c38703d60976872c3e895c69e3f1a585d75d7dd269bf27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js
        • Size 14KB
        • SHA256 de1188cdc89ffbc19a84a0374829c4be98ed37b341371f79ed3b1e896d455714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\fr-ma\ui-strings.js
        • Size 17KB
        • SHA256 5f0fb29937c927b66aad33813fa5e1f9e83ca48387116b80d4aa76bdabe78350
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ui-strings.js
        • Size 15KB
        • SHA256 9b7377d0220a8b47cf73f04f0248a5d763a7ed507d6c57980afb3a51164f48b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        faf_icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
        • Size 7KB
        • SHA256 332345c0c9d76c0f0ae0cca905e90b56860f737188ebbfa31582cf10be04e7d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js
        • Size 11KB
        • SHA256 ab2046fdb677a40ca6f0539a5c295656b5db8b56fd945725ad55dc77f74e84cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\ui-strings.js
        • Size 17KB
        • SHA256 820d363880820d873e9011e54406a24f98b6cd471ac243cf103a4c38b38bb855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js
        • Size 18KB
        • SHA256 2d97befda381fed5432446938be96c4ce3b520538b35d8c9cb054edab3c6f3e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js
        • Size 19KB
        • SHA256 c4a0e4b92c5c357101bedc826bc25c20b1f87055da4ad6269dca9bc8bdb8f630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js
        • Size 23KB
        • SHA256 33d88a684bac60e66e0f98b05df16f547a9bb204b3dd4efd1e3bfa138d83ac2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeClickToRun.exe
        • Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        • Size 4.1MB
        • SHA256 c91269a14840229cc6e309fc2a4aca4f396b1e9ad7658d665e4553eeec726284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PREVIEWTEMPLATE2.POTX
        • Path C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX
        • Size 292KB
        • SHA256 3db81dbcf7be9679e53616b587c000d9972bb192afbaa685d2dac90f9e11fe48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISO690.XSL
        • Path C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL
        • Size 265KB
        • SHA256 6e0509167311616708d7b3fbdb8c7f5855f851390243ee311f8508abf73a250a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmia64.msi
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia64.msi
        • Size 3.4MB
        • SHA256 916c93549f8c50a35c25b80f4dbe5cd590a46e22606366610a74c1bd19ff32de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        osmclienticon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
        • Size 62KB
        • SHA256 f9338dd167f4ad7728f3eabd8c4d73c78ebb6f613b7f59ee538dacc476fed102
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
        • Size 1015KB
        • SHA256 bb0317a587f1a1e8c9f3c0d6fd4f3da87e22b88e967843f6b495ef4e252def6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo
        • Size 586KB
        • SHA256 c7d7e0b0bea8e255e98611545140b125956df9f230ce694f373e87e7cf0ae20d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo
        • Size 616KB
        • SHA256 6fde97efca57a1c91554305c9681a8c3d0be58f6b460dc68751abadb795414a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo
        • Size 618KB
        • SHA256 303c68d376c08fb2746f6f441125edff6c3c18dba56fe260d1facdede98b7036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo
        • Size 1.1MB
        • SHA256 31b20b4381be692fe8109042739a99b29f92824432b529e74f5f2bc831c66b1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo
        • Size 606KB
        • SHA256 a50af2669ea06992c5acdf5f281d2625793458a952f6212f1fa16d69dafce17f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo
        • Size 627KB
        • SHA256 ab53a0c19843edd049835d9384831e0484b03933eae85c579f5d0b8af236363d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo
        • Size 780KB
        • SHA256 479bd82c435b03f33a7478f266cb7f643108712e0019a4cde57d537d3df96c78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        !!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
        • Path C:\Program Files\dotnet\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
        • Size 985B
        • SHA256 fd965e49b39150dc7dac5f51504241583acc451058cb26bf28bf467dff4c2fd5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Size 1KB
        • SHA256 70361fc5bd4a7fbfa22050ccd859760c6116cf7d33bde25cb161d909d05030dc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B46811C17859FFB409CF0E904A4AA8F8
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
        • Size 528B
        • SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Size 174B
        • SHA256 91a86d65595196d8833f41299fdc9ad22323902b11d01f9995d9e9e655ab520f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B46811C17859FFB409CF0E904A4AA8F8
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
        • Size 170B
        • SHA256 dd947121a42efa6697a150a559e33c30d8d79a243a666ca73953411c7d5ab200
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        7BCELKWV.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8GTSHR1J\7BCELKWV.htm
        • Size 184B
        • SHA256 57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        9D85CE39.zeppelin
        • Path C:\Users\Admin\AppData\Local\Temp\9D85CE39.zeppelin
        • Size 1B
        • SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
        • MD5 SHA1 SHA512
        Submit Download

        spoolsv.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\spoolsv.exe
        • Size 211KB
        • SHA256 516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AddGroup.txt.A22-138-410
        • Path C:\Users\Admin\Desktop\AddGroup.txt.A22-138-410
        • Size 454KB
        • SHA256 d6ac5de15b49d911ff1a860a02fbf96aeeb80ca0386db2196e5cd78225001e7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AssertDismount.wmf.A22-138-410
        • Path C:\Users\Admin\Desktop\AssertDismount.wmf.A22-138-410
        • Size 710KB
        • SHA256 122c9cdc74a8602b019fc014fa757ec49faaa596951e50d4747e239efe257fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertToSwitch.bmp.A22-138-410
        • Path C:\Users\Admin\Desktop\ConvertToSwitch.bmp.A22-138-410
        • Size 338KB
        • SHA256 c04a754660b709483cbc54dd48bfc3d1ee00617da21b60b67286b88f5bd9d695
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DisableRename.ogg.A22-138-410
        • Path C:\Users\Admin\Desktop\DisableRename.ogg.A22-138-410
        • Size 663KB
        • SHA256 46502b29233a6c0b7bb2e38d400bbd1a43e75fa8889e9133242edd45f3614e77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismountResume.ps1.A22-138-410
        • Path C:\Users\Admin\Desktop\DismountResume.ps1.A22-138-410
        • Size 477KB
        • SHA256 a1725daa0ccc4c3bded2796ea11d626e461b0c9efee54c04a9b0e5e0172de452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EditClear.pptm.A22-138-410
        • Path C:\Users\Admin\Desktop\EditClear.pptm.A22-138-410
        • Size 570KB
        • SHA256 e779be618d7862390315c317c61d39978b85fa51958138c17ee41bcaced8ac85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExportOpen.vbs.A22-138-410
        • Path C:\Users\Admin\Desktop\ExportOpen.vbs.A22-138-410
        • Size 384KB
        • SHA256 66df0ce569b5253b87d7e9d83935ab3a4d12a51c15f1db3996e28dac5c5689ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GroupApprove.ADT.A22-138-410
        • Path C:\Users\Admin\Desktop\GroupApprove.ADT.A22-138-410
        • Size 756KB
        • SHA256 39d09a07cbb53a2faa7064e6a523f88c8b04ac3c613808b69751adb98cb756c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        HideNew.ADT.A22-138-410
        • Path C:\Users\Admin\Desktop\HideNew.ADT.A22-138-410
        • Size 361KB
        • SHA256 d6fdf7806dc6447d4fc9ea1c7eb10741322c9359270c05066fe1664a88bc4292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        JoinCompare.mp4.A22-138-410
        • Path C:\Users\Admin\Desktop\JoinCompare.mp4.A22-138-410
        • Size 640KB
        • SHA256 a16260c21ad6388ad3549138fc3e1141e0d7b6866ee17ee9990f627a264ad433
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        JoinInstall.xhtml.A22-138-410
        • Path C:\Users\Admin\Desktop\JoinInstall.xhtml.A22-138-410
        • Size 315KB
        • SHA256 4b8c1e0deb8093a8ada7ba620e0158d1d8c8b78b504527cdf3f806ef39273115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PushSplit.MOD.A22-138-410
        • Path C:\Users\Admin\Desktop\PushSplit.MOD.A22-138-410
        • Size 268KB
        • SHA256 5cc5eb671266e63c9e89e5dd2d7f43e4e53f5af35eaa9b967735d6f01747d6b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReadStep.pub.A22-138-410
        • Path C:\Users\Admin\Desktop\ReadStep.pub.A22-138-410
        • Size 593KB
        • SHA256 05ba66e642f68d71bdcddffc068af330f737c3b69538abb483666c06fa707e0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReceivePush.jfif.A22-138-410
        • Path C:\Users\Admin\Desktop\ReceivePush.jfif.A22-138-410
        • Size 686KB
        • SHA256 eee404c81e1962bac362b716a7d756886bf8c954a4449fc1df4af5030581c8f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RepairRestart.m1v.A22-138-410
        • Path C:\Users\Admin\Desktop\RepairRestart.m1v.A22-138-410
        • Size 617KB
        • SHA256 c4a31321433145f85c7fe0266e10ba7692e717f32ea4e6a6237f67f318e96d3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RequestMove.3gpp.A22-138-410
        • Path C:\Users\Admin\Desktop\RequestMove.3gpp.A22-138-410
        • Size 1.0MB
        • SHA256 10cd1950c95ac2c4c9518cd113ebf18d8e74fe3cc4e0da8a9b566f24e95810cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ResizeConnect.emf.A22-138-410
        • Path C:\Users\Admin\Desktop\ResizeConnect.emf.A22-138-410
        • Size 292KB
        • SHA256 320ac44f7d4d37e56fc6974fe3d727e84b5193f304ecf129517d5aad6af6c862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SendTest.css.A22-138-410
        • Path C:\Users\Admin\Desktop\SendTest.css.A22-138-410
        • Size 408KB
        • SHA256 0047623a7c5519512ab00437dc883798eb6332d6053255d9c3bfe4b48f243418
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StepCopy.docx.A22-138-410
        • Path C:\Users\Admin\Desktop\StepCopy.docx.A22-138-410
        • Size 20KB
        • SHA256 86de1e2e3447f6a6a6274a4fb00a2589989a404824fd69a0f6292d8b7adcf535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UnlockAssert.mp3.A22-138-410
        • Path C:\Users\Admin\Desktop\UnlockAssert.mp3.A22-138-410
        • Size 547KB
        • SHA256 8d86401529872613c48b96a41252dc745e268506095432b9935f708f7d3c531f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UpdateDeny.eprtx.A22-138-410
        • Path C:\Users\Admin\Desktop\UpdateDeny.eprtx.A22-138-410
        • Size 431KB
        • SHA256 7f7c226f8c8e9e54b6e8e69ed917a6c0004c55d5af499e4deb8f5c8d4b71a221
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WriteShow.potx.A22-138-410
        • Path C:\Users\Admin\Desktop\WriteShow.potx.A22-138-410
        • Size 733KB
        • SHA256 8ed237e5d6aa909e2781c6ed9676eac39bbabf69cdbaa52d64e0e8b603a87eb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/764-32-0x0000000000C20000-0x0000000000C65000-memory.dmp
        Download

        memory/764-31-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-10063-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-4365-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-20997-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-25964-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-25351-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-13938-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-12164-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-14317-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-7404-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-17014-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1084-1867-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1136-38-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1644-174-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1644-2032-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1644-35-0x0000000000E80000-0x0000000000EC5000-memory.dmp
        Download

        memory/1644-34-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/1644-25989-0x0000000000E80000-0x0000000000EC5000-memory.dmp
        Download

        memory/1644-25988-0x00000000009E0000-0x0000000000B20000-memory.dmp
        Download

        memory/2488-25987-0x0000000000750000-0x0000000000751000-memory.dmp
        Download

        memory/3664-29-0x0000000000970000-0x00000000009B5000-memory.dmp
        Download

        memory/3664-0-0x0000000000968000-0x0000000000969000-memory.dmp
        Download

        memory/3664-28-0x0000000000830000-0x0000000000970000-memory.dmp
        Download

        memory/4904-18-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
        Download