eda693ff...bfc2

C:\Users\FD1HVy\Desktop\DP_Main.exe

Sample File

Binary

Malicious

»

Mime Type	application/vnd.microsoft.portable-executable
File Size	36.00 KB
MD5	88bfd110a4175d61644123323efdc62e
SHA1	3a58d6703655400133014a39f9fccffc4cec5a2b
SHA256	eda693ff536adc3bd31b300a57283c8757bc7c95924b3e836cc76e514d0dbfc2
SSDeep	768:IULJqPatbU66T9wcP/cCmiO5XJAsti++OQ:Ua9ST95KF+OQ
ImpHash	f34d5f2d4577ed6d9ceec516c1f5a744

File Reputation Information

»

Severity	Blacklisted
First Seen	2018-01-18 03:07 (UTC+1)
Last Seen	2020-01-17 21:28 (UTC+1)
Names	ByteCode-MSIL.Trojan.Cryptid
Families	Cryptid
Classification	Trojan

PE Information

»

Image Base	0x400000
Entry Point	0x4075be
Size Of Code	0x6000
Size Of Initialized Data	0x2000
File Type	FileType.executable
Subsystem	Subsystem.windows_cui
Machine Type	MachineType.i386
Compile Timestamp	2018-01-13 13:10:31+00:00

Version Information (7)

»

Assembly Version	0.0.0.0
FileDescription
FileVersion	0.0.0.0
InternalName	DP_Main.exe
LegalCopyright
OriginalFilename	DP_Main.exe
ProductVersion	0.0.0.0

Sections (3)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x402000	0x55c4	0x6000	0x1000	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	4.71
.rsrc	0x408000	0x4d8	0x1000	0x7000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	1.71
.reloc	0x40a000	0xc	0x1000	0x8000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	0.01

Imports (1)

»

mscoree.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
_CorExeMain	0x0	0x402000	0x7590	0x6590	0x0

Memory Dumps (2)

»

Name	Process ID	Start VA	End VA	Dump Reason	PE Rebuild	Bitness	Entry Point	AV	YARA	Actions
dp_main.exe	1	0x00BD0000	0x00BDBFFF	Relevant Image		64-bit	-			... Memory Dump Actions Go to Process Download Dump
dp_main.exe	1	0x00BD0000	0x00BDBFFF	Final Dump		64-bit	-			... Memory Dump Actions Go to Process Download Dump

Local AV Matches (1)

»

Threat Name	Severity
Generic.Ransom.Paradise.8A352C3B	Malicious

C:\Users\FD1HVy\AppData\Roaming\DP\RunAsAdmin.dp

Dropped File

Stream

Whitelisted

»

Mime Type	application/octet-stream
File Size	1 Bytes
MD5	cfcd208495d565ef66e7dff9f98764da
SHA1	b6589fc6ab0dc82cf12099d1c2d40ab994e8410c
SHA256	5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
SSDeep	3:V:V
ImpHash	None

File Reputation Information

»

Severity	Whitelisted
First Seen	2011-06-09 14:59 (UTC+2)
Last Seen	2019-10-27 02:48 (UTC+2)

C:\Users\FD1HVy\Desktop\9kqgbPRnCB3J.wav

Modified File

Audio

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\9kqgbPRnCB3J.wav[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	audio/x-wav
File Size	35.59 KB
MD5	522cee9e1ee7b631d60a91ce88e9dae6
SHA1	55915545006663e79736d191899ae2b034347107
SHA256	ba78cf370dfd4e8296ec5f848e344f3504d85eea5b48590cc673d95aa949f959
SSDeep	768:a0UXu7kC7w9pfNAz5/6QYa+uFr1GgsK+L+ilpcC+xAtvr0mUf:aFXu7FMfNAz5/6fLDgnXilpcjxGQme
ImpHash	None

C:\Users\FD1HVy\Desktop\aJjJomlXtRW.swf

Modified File

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\aJjJomlXtRW.swf[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/x-shockwave-flash
File Size	62.74 KB
MD5	559015e1c134daabd03aaa597253721a
SHA1	09e4fad9ccaafe4999246c892850dfdaf7fce9d6
SHA256	2454b823316dc2a509ed1fa656fb9ede20cbdb0af8e08c02fa794ca62b8eb838
SSDeep	1536:14nQXKHoRjdC7zFcpFpP80lUFO6UHMrVFZuNUVCn:14CKHLFIFV80lU5LJ/2UCn
ImpHash	None

C:\Users\FD1HVy\Desktop\AN6-Pxxi.odt[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Zip

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\AN6-Pxxi.odt (Modified File)
Mime Type	application/zip
File Size	11.10 KB
MD5	247296d8de156347699dc31a9d73520f
SHA1	9a7e14a218ab23bce43150d5dfd6c62d427ff211
SHA256	c2bbe11bd67c356a228d519d39f151b7c6c7814cb25da04e92a508ba93226308
SSDeep	192:3i39r+dm4QqsL7kJlgoSiphEgLrAQOMs2daIqYDjIdBiu7OKjwKNbJ2CFDZxEA+:wp+dmYsL7kX0irEKKj27DjIbiuiKjDNe
ImpHash	None

C:\Users\FD1HVy\Desktop\AOHiWgJ_sDNW 3pSUMTE.gif

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\AOHiWgJ_sDNW 3pSUMTE.gif[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/gif
File Size	117.63 KB
MD5	738bfabc28e6d31cec17a71c3371d8ec
SHA1	9707ede5cc39fdea6aa777da483b998b27292e68
SHA256	6d7adb6318d8bed2bcc729f04195f11bf8018a92f96fdc32c5434bba458b73ae
SSDeep	3072:tMIZB+4TvnJ6gP0B+vyKr8sbyhHmmN4OUMm0WnPCimP8GwJ:tMI+4jJzrdpmnUMm0WnPCW
ImpHash	None

C:\Users\FD1HVy\Desktop\aWNU.m4a[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Audio

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\aWNU.m4a (Modified File)
Mime Type	audio/x-m4a
File Size	109.52 KB
MD5	97c38f93c99c6b0bb4483d874e751ebd
SHA1	c3a1b1f976513f61d896ea789ca6ec03308f8085
SHA256	cd4353df055de29d9c2728eeac8600bb15bb346b1bc281f97c0bf9d6887b6d30
SSDeep	3072:RNOTvt+H7ImuufIoBihZOhK1RbCEBvJw+vXR9wO7:/nIuf/nK14EBbh9wO7
ImpHash	None

C:\Users\FD1HVy\Desktop\d8U.mp3[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\d8U.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	24.43 KB
MD5	5be923b63b64da47e4fb74d95593f50b
SHA1	7763f3a17452750b0d9954881aeb8633acf370a6
SHA256	bc88997be84b59e9938cb0e34dad18f00adfa97fcab0466498aac2fbcaa3470f
SSDeep	768:1IfRBydYW+2rRG4eqhWDVlQntonCcTDU4ECuXffA:1IZI3+2dGkWDVlQntORnU4RuXA
ImpHash	None

C:\Users\FD1HVy\Desktop\desktop.ini

Modified File

Text

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\desktop.ini[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	text/plain
File Size	411 Bytes
MD5	b7cc23698addf1c1b6b9f68eb8ce47f3
SHA1	a6cc106b741dfcfe7a3d26ab58d704f23dc382c9
SHA256	87f130920aede34b3261b3c75c8b6bd43209749bfc1c03015d4c73b51f297955
SSDeep	6:QyqRTNHyK4Mkst83xip2qvE8s0qpphWInbEp8GESR5xV45w9QDUvpjTH2vs9IuNO:QZTNSKLH83QTds0EhWXb53QIvNiv4IXn
ImpHash	None

C:\Users\FD1HVy\Desktop\FHxozOc_QKE.png

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\FHxozOc_QKE.png[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/png
File Size	40.89 KB
MD5	e43612181f1930c2ac9c23b146db7213
SHA1	debd14bf735e4ce302832be435996c70324cbfa7
SHA256	90bdd09440152913aadf236b5d9996599c283ddbc341b9c13c3cc15cb36be7bc
SSDeep	768:bOc4g1qMsw2GYnuD6pIeEvEtQjggzf6iQ8Wfk3nst16ua1Ne8m6GbN:rV1qZHGZcIPyQ/T8a1bY6qN
ImpHash	None

C:\Users\FD1HVy\Desktop\HAMwLsfXQw AUyW.bmp

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\HAMwLsfXQw AUyW.bmp[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/x-ms-bmp
File Size	50.92 KB
MD5	bc8af383619284d2a5c6f24a88b5d4b5
SHA1	2aa2fa6611bd883942d813c176d8cdb944f7aabd
SHA256	e26d71bb9cc26e92b56ace053e7b72323085f642d3718f03f71e80106fa8acf5
SSDeep	768:qeS0Vm+phZDO5mKjaAJLZ7tEOIfgK+IYDBwU5wXawQuUr7qOKo2sWPLyWpvZlBYa:H/dD/KmAxzNDNwUGXLQug7x2fPhpxvYa
ImpHash	None

C:\Users\FD1HVy\Desktop\hIB45OhCIGM_rvc7.wav[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Audio

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\hIB45OhCIGM_rvc7.wav (Modified File)
Mime Type	audio/x-wav
File Size	114.20 KB
MD5	8a6feb557e537b61688366e8183a1959
SHA1	28354c9c76d6cb910c4dc5e819b21347dce0a8b0
SHA256	a99c604d09b85e041a51fcafa04996837abab283d62e243cad511627bd8427b1
SSDeep	3072:QAuvRAoJdkHlnFCUD5w9G5e2vZW1LEAGe2OyAv37sHs95o/wn:HcR3dQK59d2BW1IAGe2OyAv3gs9qS
ImpHash	None

C:\Users\FD1HVy\Desktop\J6aDIHYLiICtbUWWpQ-a.pps[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\J6aDIHYLiICtbUWWpQ-a.pps (Modified File)
Mime Type	application/CDFV2
File Size	53.42 KB
MD5	c68a45a0aa3cfb259a1a910c4a6a56a4
SHA1	45e189f295790b4cd4632e54de2eaa124c54fa35
SHA256	2b964e11c3fa5172202fe505dca2183b72938ab95c0c162185205d1f12e9bb5e
SSDeep	1536:ToHLMyPirhZD4cXtCnWP/4sCfZKy21jYJv6Jhs1+vn4QTX9:Ti1Pi4etCnWP/4sCom6fzvn4QTX9
ImpHash	None

C:\Users\FD1HVy\Desktop\j86dCykR.csv[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\j86dCykR.csv (Modified File)
Mime Type	application/octet-stream
File Size	95.09 KB
MD5	0caee749f6a35110eb9973de82ceb04e
SHA1	3671534f4d9c5cee5f81a5a8313a04ce6a9a2893
SHA256	e7038670fd1fbc42b19be88e17f931a50525c6f91e2b00a58520d60e3ea3f295
SSDeep	1536:NP6Sk7Y4hNZ9qDDNU4AAcZhLh0MD6X7CMP3dXH315gseBuvYjO7e3R5PQKGlrTgh:NP6504hNZ94ULh0MD6X7pVn1VUuv4Oa7
ImpHash	None

C:\Users\FD1HVy\Desktop\JPGBwvW6.mp4

Modified File

Video

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\JPGBwvW6.mp4[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	video/mp4
File Size	121.88 KB
MD5	03113333c2a4a6cb97e71f97726d17bf
SHA1	fe3cba8cd12f11240cd56b0c280b2f1a807b0a15
SHA256	f9c60861ee0f150175e4cd26b0ccfff8c5f2480f9a6d98a621b459123641ded3
SSDeep	3072:c7G6kuFd8aZh42CAXkPKPduvil74VzbV4zSIE:c7P7Zh421XkPKqe7G2O
ImpHash	None

C:\Users\FD1HVy\Desktop\jsitEZYllFX-rJ5-5Bo.jpg

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\jsitEZYllFX-rJ5-5Bo.jpg[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/jpeg
File Size	98.48 KB
MD5	2ecb33a0ff01b1134cc5035880cde42b
SHA1	367dff3ad3f973fd79ea836f6a2b9c17e6293502
SHA256	489c8631350bbeb8d7315d96490350dbd3225ab1e5bab8728e8f125115de3dbd
SSDeep	1536:ebRjuKp009AXdmbnWhYs5kFcr3+Hmdtygkqne4hVQdafkya2aOUssoqfZsbHpwlr:ewODgcWhF0o4mRnSdafa2sbbxcuU6
ImpHash	None

C:\Users\FD1HVy\Desktop\LYjoidXOr1cO RartGH6.doc[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\LYjoidXOr1cO RartGH6.doc (Modified File)
Mime Type	application/octet-stream
File Size	40.38 KB
MD5	699ba7ab90de22de1a381bd7120d5755
SHA1	97af28f81c9997ce992ecd99cbc079ad2f49b9a5
SHA256	70516d1603e3e3b7375cb09fab818a168607fe93f9f1b55a3d10fa335da4a397
SSDeep	768:AMn5B25iQMexbKOZmxygsUuMwcI8neggkTW2UTW7OpyQX6fF5fLCkugbE9xe:AU5azDxDZaiMwEeghTL+QQqfrTmg0xe
ImpHash	None

C:\Users\FD1HVy\Desktop\mfI3M 25waSS25or.mkv

Modified File

Video

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\mfI3M 25waSS25or.mkv[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	video/x-matroska
File Size	115.78 KB
MD5	737ab355316ba9f947a394f6f43f25b3
SHA1	25a8ca2b4fe0035c53adcd9f5e2ab5c4bd9dcb14
SHA256	095518628fed2b479cae1071c7749f04068bc929151121414e5f9e85b410d26a
SSDeep	3072:iWftqMPFHqcT1/jE2ES6ih8wgL2ahQ1JQW:3tN59E23AwPIoQW
ImpHash	None

C:\Users\FD1HVy\Desktop\mUWrftnYC.wav

Modified File

Audio

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\mUWrftnYC.wav[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	audio/x-wav
File Size	119.06 KB
MD5	75a3277195232fe3b42f8f60fd216cda
SHA1	d887c6ade7b63f057ef0c99aab42d8129325849f
SHA256	f65291ff35b5fefc2f1d6c101d69a51b72404d44dc7883d9ae21512bad60cfc9
SSDeep	3072:YD4vXnDnRagCz/G2WRWGP9KmgR6/BkftAiLMQNrLC3v51chAE:jXnTsHDeWGZgRLM3hK
ImpHash	None

C:\Users\FD1HVy\Desktop\NOXbRAUzS2JOG.mkv

Modified File

Video

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\NOXbRAUzS2JOG.mkv[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	video/x-matroska
File Size	96.79 KB
MD5	e8f02388caa67a35b5043f2f0fac25b5
SHA1	7a166e903d84d86ece03e48c1b41f9625f0394aa
SHA256	d4e230a3f6f2382b68bbc389fb38e5ac67e6d6ce36fccc0ced90714454c8eb5e
SSDeep	1536:XnztIYk/Ol0UTPS54yCtNITT+t/3GJP9CnDKm+m/+4i1dUk1gW66GQns:XnzYGxPtyCr7t+unD5P/bi1dd1gl61ns
ImpHash	None

C:\Users\FD1HVy\Desktop\OX8GrNcx.odt

Modified File

Zip

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\OX8GrNcx.odt[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/zip
File Size	11.62 KB
MD5	afb2b5c2fac3f429cc6af8fb3ca8cb63
SHA1	f64a8ae0c9e752513fcfa6b997c865f6dd749597
SHA256	8fa6109729b5b19c2c07775e3a797dae5522ff9baae0b9727474024f9aa3d8bc
SSDeep	192:xn/oHGXlbBD5PTR3z1LHXJ19iqoVc7NNWMWFaZh2Ag1X3aV3GaqrRil1:5/oHGxbtDJHX//okWMWFaZhDg1aVGaq+
ImpHash	None

C:\Users\FD1HVy\Desktop\P1QsDkkSO.gif

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\P1QsDkkSO.gif[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/gif
File Size	68.04 KB
MD5	77a365a089e673d444131838d71d2096
SHA1	793c67c98f750b0b628c1ea6f2ce98f42c03d6f4
SHA256	9c3fabfe291561330942c2faa9e9b33e41c97a7e4a76ce4b42dd39022361c53c
SSDeep	1536:LaKDhLo0t8YCEPWkxMKaguMVNObot/1iJQw1U5sbAbCRkSe+OE:ea60cMMKklst1BlbEe+OE
ImpHash	None

C:\Users\FD1HVy\Desktop\PKWu5Wtief7lpBuOI5Rq.bmp[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\PKWu5Wtief7lpBuOI5Rq.bmp (Modified File)
Mime Type	image/x-ms-bmp
File Size	113.93 KB
MD5	9dee7864d4eabf1785868eb6a27e9d24
SHA1	18dcf7e6c7f9c5288d345826a6cd496bb83b229c
SHA256	f412a5d2f7ba89d9829cc0f3d5d83482f084ead1b2ccc5a1c265d18bfce4c303
SSDeep	3072:NPiCmktQdUYnf+i7ATgvJNRok0DpO4Vjvci94GvDH4IPKGzRH:j/tQ2Ni0TgvJNh095T/Y2bH
ImpHash	None

C:\Users\FD1HVy\Desktop\S0JM6N_kv2iT0Y.mp3[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\S0JM6N_kv2iT0Y.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	58.94 KB
MD5	dcee57394d7fdaa6eda9b2b1c95e5c8a
SHA1	5628f9892db3972da63f86dd011e0f6fae5beb0b
SHA256	53cb1378ff88880fc66e4ecfd3367fb10a292f4037e232d12af5f7648f485eba
SSDeep	1536:1jFPJH6ZXn/l8RVC35QNTPCedWzxI7InjFfAE5e2pdy:1ZRH6dCRVMe4yuuIjZe2pc
ImpHash	None

C:\Users\FD1HVy\Desktop\VfW_67RL 5rflPX.gif

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\VfW_67RL 5rflPX.gif[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/gif
File Size	103.67 KB
MD5	34f2e2b0f29c3d64746611f38eede11e
SHA1	c7045219ed4a1460574861fddede999c70b687fa
SHA256	748419658e1c3a03a6ff71445c08b6d9a011b18844deaa9d116ffc28e070bac2
SSDeep	1536:Xx8HPX2wpptfYCrU87X5hWVOaQjAcTegmwH0rB1l6TcOlXcVnbrNgx6kN7HU:qvmc7zhAcTegfcnBq6870
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\3BhghfGOrqhAC_eQQ6Od.mp3[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\3BhghfGOrqhAC_eQQ6Od.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	65.08 KB
MD5	b7a092db94b6cfc37f64fd945dc417e3
SHA1	a95b1d63e6da8bd33c86c2895a5d2bf990d0f3fe
SHA256	e12020a12a8aa3d8260f20821df85067c042b833728dd82f4bb4f87bab2819b8
SSDeep	1536:1d6+acnfZXBibVMHkjwMUezB1S5KYh7YDf+8r9zYo:1d6/UZXBVHkDUWCeDG8r1Yo
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\3ia1.avi

Modified File

Video

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\3ia1.avi[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	video/x-msvideo
File Size	39.88 KB
MD5	b98ce1496f7d7c727b539904c5f12535
SHA1	34f89e8bc729894f1da8782e28ccb3a0c6d4cb11
SHA256	d6fcbae0a1902ed8fc3c58c5d44b5449e3c748b120ba0eb43316c9a4f46ce341
SSDeep	768:+nHazLoeycGDmi2jv1C2BHp1WMGxIfA7AnpFK1w4beLzBr:+nHc7GDmBJC2BHp1dGxSOApr4beLzl
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\h_aPp4Z1 qH.pptx[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Zip

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\h_aPp4Z1 qH.pptx (Modified File)
Mime Type	application/zip
File Size	68.20 KB
MD5	f20a0e9dd65249d3f3a4ab618b61a4f4
SHA1	e1434748ec34dcb5ee257770735c347db5573042
SHA256	2abe1a4d5b3d1aa6809f57a1c6f76258d359bb9aea3324dd16a9fc94783650d7
SSDeep	1536:ch5LTi03b9apnxzNqEWprOoQb7v458AOBkaqtpF1NQwqzF/iskjcuM:MZjrA9nGp78v4Tw7qnGpXrN
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\LRc4IZ.pps[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\LRc4IZ.pps (Modified File)
Mime Type	application/CDFV2
File Size	71.57 KB
MD5	0b558fb152bb03e877463f6165c1e21e
SHA1	d9ed7796ceac286ceeab09a31f03413c89f032b7
SHA256	94d806499aa09f4c8321ff9226589db8fc12995dfc5b2d0820b637a68f5e6173
SSDeep	1536:FsMdO6R6XIoaOIm92axzjEvHJryDeDUdeIpPLDNK6XoUGizD6wAI8q/2sGPm/L:FsAR8X9aOx2wzcpDU8ifNZXD9fG+D
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\Pfsago0l0hoTkQMLUo.wav[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Audio

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\Pfsago0l0hoTkQMLUo.wav (Modified File)
Mime Type	audio/x-wav
File Size	91.73 KB
MD5	f7d7621480fd91de55927b3200d107ce
SHA1	3011ef3cca9fbfb9985e0bd54f9ca9b09f93e6e9
SHA256	3424fdfa9d6440bbd5eba8deeb85ad9c736305366a427009e340644a38b1266a
SSDeep	1536:rXL2XGQUgmlKbyUMBkxgYlkuSgpVZcTdbv7oAhEptEE5+US8pYOenwl3:P2XGGuKbSePlapdb/21YUZjeI3
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\RC P.bmp[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\RC P.bmp (Modified File)
Mime Type	image/x-ms-bmp
File Size	94.07 KB
MD5	1441029fcbb42b622373a594bb2a1669
SHA1	94b2dae343d5f1301f8a7ee43bdcf0c39d6134f0
SHA256	32072b27029e993356109f97d3656f436e8a21cff703d59e06934b559974a081
SSDeep	1536:McL5OwOFKjIjA1X6vt/w3ThP7OTP95DouKUemk4SvytAkLqSUoEdiDrpesm+2U:JlOAb6Rw17OzzHA4aTsqSUhk5mNU
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\s52eN1rLpoTGl.bmp

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\s52eN1rLpoTGl.bmp[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/x-ms-bmp
File Size	48.11 KB
MD5	7cbef710dd34f2e1c8d01d6237c35040
SHA1	d427b222a4264db4483c46d9019a3e44ba4afe6c
SHA256	e0136eab6fe62c782338772f7b504424b4e6169e6c030be40fc0d7b4ec6959f0
SSDeep	1536:xn0UCQydllm6tSVlWzq9NcA1hwRY9+UB+V:GUc7ptu0oNc//UB2
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\YkNd73RaLNAI.swf[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\YkNd73RaLNAI.swf (Modified File)
Mime Type	application/x-shockwave-flash
File Size	121.74 KB
MD5	90107c2f3050a5abcab02ca5f2fffbbc
SHA1	16f6e9c7ec1409fb7c9c372021b260e533b0123b
SHA256	f34b1892c78189deffab5bb07fb155ef59111579e430a11de9ecbbc7c23445f2
SSDeep	3072:ZT1O6kc/dMLlHFf2L7y7UFqm/HwgdLf+HOPEIxCe+m:ZM6R/WLFt2C7UtwgdL6OMIt+m
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\DDTioX.swf

Modified File

Text

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\DDTioX.swf[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	text/plain
File Size	90.36 KB
MD5	a443479b14c6dfed2d11ec7a4695f5ce
SHA1	9a0ff2fc1f0dfa089e6eadda7ce087e23a9bb1f9
SHA256	12e60de493aa0fdad0eced43be21f957c8c7c185c592c86e7cee6764c9a372de
SSDeep	1536:YyUpb0ESSVkxDxYr+zSUm6aUO7xIcI85tX+MDAF0jOMC1qL1twPb2tn81+Ae:aRiSVkx1Y6zShxP+0j00ZtwPbc81m
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\EEa-lpYoEt2.swf

Modified File

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\EEa-lpYoEt2.swf[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/x-shockwave-flash
File Size	69.54 KB
MD5	a3a75e1a6279537f1c4526221168e365
SHA1	11d52d757feec1e34f38ba605871a6fb755957b2
SHA256	d81d502973978caba3b7824f59cebb5f169cbb4d6aa9349892779f5577bfd301
SSDeep	1536:ALpIwBGTpOqAdubQryJhALeizB9juDcYb3czHEFyrtjbnh5qP/H:weA+nm9juo8crEFypjbnCP/H
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\FmyEhH1MSJfnC7hBl.avi

Modified File

Video

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\FmyEhH1MSJfnC7hBl.avi[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	video/x-msvideo
File Size	127.76 KB
MD5	384d53e06509866d85689d5c3e43efec
SHA1	fbfef9f9046b3366ffb02446dc625ec2eb44a535
SHA256	c60e38cecdb6d2d8668403330385ed43376e2f19768df88e8aec812f7e8cd5ce
SSDeep	3072:otbIHgOmu/c/UI5MrtaqARwMrOAZcJR+G8/CJZAcL3f:IcHgDucCaFRwMr7c+GWmZvP
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\FpGsji mckJ_Ib.csv[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Text

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\FpGsji mckJ_Ib.csv (Modified File)
Mime Type	text/plain
File Size	56.74 KB
MD5	7c49a29f0e85206d4c3399bd62ce61ba
SHA1	f965513a23ebb5fee417782a21ae4a2c66e57843
SHA256	7bfa0d021276160c9d2b81c95b0035f87e97ba2c025b7bc35b140d7a8ce55a39
SSDeep	768:N2PRZJQwxgUOnhyvRdLFBmWewhrS0eyz/OfQRbjRl+mAXWox8uJ9f153bmWUW/I6:NYSTk/aKeyzcQNjhox8ESvW/nvBGy
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\rtLz_6.flv[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Video

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\rtLz_6.flv (Modified File)
Mime Type	video/x-flv
File Size	94.40 KB
MD5	0f3fb61f6c11f23ea9670f82965e6c00
SHA1	88a52aea614c055e91ba4361e7ef4045d5bd27ff
SHA256	736cd3b0c1f363c2a1c620a0dce53880b52d6db86d50cefa83ad381bec4d4e3b
SSDeep	1536:d1S6TFr3muWvWeFcsM96Y+VVX/qv41QPaHvTu1llVknDJD/qNLlm5oH3+e/vxd7:d1n2JvRFpM96nVlq4kaygJD/qVlgoXf/
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\VUIgmg-6k-bN DJNU.gif

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\VUIgmg-6k-bN DJNU.gif[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/gif
File Size	87.92 KB
MD5	0ec485f9e0b7c84c4850ccf9441eb386
SHA1	9118dae70ae6e6005386403894a37b2c1970486c
SHA256	c179719d7ca32f909e40b9d0fe03465c949ea55995442367f80ff8050fa4a5a6
SSDeep	1536:hJMrJHjmoD7XJd6Z0pe/qyulX0+ECcOYXKJwidAKLJZXx698vaUwYYn5pbkPMvx3:hYKoD75d6Z04qyEKhe3JZeHUwYq5pbss
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\xRSxrtnv8iByIbSF.mp3[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Stream

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\xRSxrtnv8iByIbSF.mp3 (Modified File)
Mime Type	application/octet-stream
File Size	2.77 KB
MD5	452e98f48ad3f653e74f12fcaf4f80f1
SHA1	457cd9e2af7bf781cb68a638da5444f2c2de3f83
SHA256	bee3d09d78ad83fddb207ce294171e1c818edbce4b1f99d5c4bdfb136fd93050
SSDeep	48:1B5N3sezVOKxP/ohdpB2ha721fycIlboqT9J5ynz+orQFIsBgZe2am8:1B5dsY3xohdpAha72HeHT9JQ6G8t+PaF
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\tint\5cMybALc71TfcLGH.bmp

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\tint\5cMybALc71TfcLGH.bmp[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/x-ms-bmp
File Size	111.57 KB
MD5	1f39edc6ebf6e23ccf04d372f118038e
SHA1	8fc866acb8bd3651b7aeed84811a9ebda7aff6e6
SHA256	45e4b0b869c988b9bce2674cbd637fc71621631444deb627cd5222e69dd583cd
SSDeep	3072:bQFfeBOueFlGPU0GvR60184w+90ZIefwqnsDXCa:bQiOjF8Jqz/w+tq+Sa
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\tint\ktyDE7S1liK5.m4a

Modified File

Audio

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\tint\ktyDE7S1liK5.m4a[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	audio/x-m4a
File Size	101.09 KB
MD5	f3d5036d840c5ccf4b75d40f3d796fd7
SHA1	912b4c0de181f47f123c2c2e8fb9170653887bdf
SHA256	b74f88a23f3518c41bf046ef8eca08f0ceee0fc21d23cb7d929d28a24209a4bc
SSDeep	1536:JIVgsEEPvphnCwXHFaZ87UH1iZ0J0XqdenCpfkgPa3Cg7umDepr7ycpOfBSlF+D5:JmgsbvfCwVavwhaeYfOCgHDM+xklF+l
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\tint\x t0SM5ueqs.xls

Modified File

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\tint\x t0SM5ueqs.xls[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/CDFV2
File Size	120.01 KB
MD5	2106318ae323c7070f552317caa45d3d
SHA1	2e8a34009b20ff8f3a5edb90281c1edb25a7d1e2
SHA256	b66d09e2ae093b51d2acbe4d1a99c98209726b0a860c842bd655dd502166cdc5
SSDeep	3072:f08WJVTKGNuLxUviY0AeYGUs4+Oi/Vzs8q:f0AGNlviY0AeYRsr/q8q
ImpHash	None

C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\tint\yxO7usXABrLDPO30.jpg

Modified File

Image

Unknown

»

Also Known As	C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\tint\yxO7usXABrLDPO30.jpg[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/jpeg
File Size	25.70 KB
MD5	9bf19e26490eb6fb227282bb47e39619
SHA1	1a5373fe799fef7dcc3e7fcfa129031e1468031d
SHA256	b7c6b6bd28faf5e18a277e49939a703ded2b33bcf47208f1975c69e9a7c8edbf
SSDeep	768:7WG6SYssFKxEaLLQqntVNRnvTogJhsxPacMjkno:7WG6hYwuNp71mxPacO
ImpHash	None

C:\$WINRE_BACKUP_PARTITION.MARKER

Modified File

Text

Unknown

»

Also Known As	C:\$WINRE_BACKUP_PARTITION.MARKER[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	text/plain
File Size	191 Bytes
MD5	ce0dd9fbbd1865eddddaf413f0942d03
SHA1	ea6742353699819a94aee1374e1c7b6ccd2dfcb5
SHA256	dbf7914413931f1d876b035317c9f049b9d70c35943167ecd35da6a299621cbe
SSDeep	3:FxgNLvJffuphjUgSVGKMgAXQEarzAssGe6LawLmBQgKq7t9UNjYCfAL3939ADK3X:UNLvJffupRnSsngAN3+EQgF7t91z3XAY
ImpHash	None

C:\BOOTNXT[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Text

Unknown

»

Also Known As	C:\BOOTNXT (Modified File)
Mime Type	text/plain
File Size	191 Bytes
MD5	d5b679c6da6b21f28db269013a160cc1
SHA1	2d29e2f47673cef4d0737151e2bbf6dc081123c5
SHA256	48c3d56e274b5d40c9347a4b2910f1dcbe2836872baab096752c6277974b9a9c
SSDeep	3:FxgNPTMlOGsNhg2KMa3NrCGpcXI89RVKFxjX/dgdTdPbmGxRh/Y1NZwsukMmZKaN:UNPAsg3NRcXIsRVKDhYxLgalgNn
ImpHash	None

C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Text

Unknown

»

Also Known As	C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log (Modified File)
Mime Type	text/plain
File Size	60.77 KB
MD5	377f33286d160dae15a38ce1eeb97fb4
SHA1	34c94e626865050ebc4421658d6e9085e9daa405
SHA256	17caba67ef69ee3a564e6d5a9eddd243e518e3e3ab008dc86f2045010cbf2f3e
SSDeep	1536:u4XZyKVRS7QJoJdVYiyLH2KUUx+RB6UYcL:u4Xsa4VYNxUG+5YcL
ImpHash	None

C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log

Modified File

Text

Unknown

»

Also Known As	C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	text/plain
File Size	8.55 KB
MD5	f52e64bd5ce9a0286c1b05d6ca61254d
SHA1	e738fa92a8b881cc220cc893106274f198e0750a
SHA256	48c47957ec29aedf6e3ed9e2f402db3ed599fb0c854271bc1b8d9a6095bd23b2
SSDeep	192:RDwt9nFS64PFVxkhzo0OlDx6PvE33sKtoz7pVZOpnL1QVNFT:pQFjuORWDOM3+X811QVrT
ImpHash	None

C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Text

Unknown

»

Also Known As	C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log (Modified File)
Mime Type	text/plain
File Size	191 Bytes
MD5	5c6610eb8d6352d277c5623e9238e21e
SHA1	a4b51b0896ce0eb223ef812449ad82d93f759f2a
SHA256	26c54c886134cad005a13619fccd06fe30ff1e4645c2dcac51f0ddbda6de6c4a
SSDeep	3:FxgNSROJNrJkfUA+L/yDmvs1Gk5v4/AX9fX49009XVgSR9Rr4G7AT+cJR9DQT5hF:UNSRQNqkjzsMk5voAxX490EXVhRzrd7h
ImpHash	None

C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll

Modified File

Binary

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\GetCurrentOOBE.dll[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	169.38 KB
MD5	49bf61e54da1d4bec1690372903fd4fa
SHA1	37fc6b5bf8e717013388dbebae803a196cfd75fe
SHA256	151e301802e2b84438ff701ef48ac7d3f4c32cfd8a2a8a9ab0a3339cf6116d39
SSDeep	3072:euWjpPR52dCJOnMjilG61JNE4qcBQkvJlFUA/9dHG43BZxuq7b:CSEj4NE4qcB7XdH5Uqv
ImpHash	None
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x10000000
Entry Point	0x1001912a
Size Of Code	0x1b200
Size Of Initialized Data	0x4800
File Type	FileType.dll
Subsystem	Subsystem.windows_cui
Machine Type	MachineType.i386
Compile Timestamp	2017-07-14 16:53:24+00:00

Sections (5)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x1b0e7	0x1b200	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.43
.data	0x1001d000	0xd90	0x400	0x1b600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.96
.idata	0x1001e000	0x10fe	0x1200	0x1ba00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.99
.rsrc	0x10020000	0x410	0x600	0x1cc00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.96
.reloc	0x10021000	0x20f0	0x2200	0x1d200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.0

C:\$GetCurrent\SafeOS\GetCurrentRollback.ini[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Text

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\GetCurrentRollback.ini (Modified File)
Mime Type	text/plain
File Size	230 Bytes
MD5	24b43b7d6b5c3c1f9d94e262fd75c19c
SHA1	9b4181d8b793b77560f0ad56c23d2e2ce7c012db
SHA256	85db9d8659c4808e6dc893ee4d4539299c9ec6b4265fb9fd8da1a861ae88b88c
SSDeep	6:UiTIakmNMpnMNFWrwzsBY2Lbbsg93SvJ2iSoW4gEoSQvFDQVK38kNn:UibtNDFlXWSxVhPsFDAKMGn
ImpHash	None

C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Batch

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd (Modified File)
Mime Type	application/x-bat
File Size	812 Bytes
MD5	0df7a1a0bb5908ac1cf1d2db8ae3f522
SHA1	87a7fbdf542fd363b83475fa33c01c6f78926729
SHA256	10e4d2d4a5d3e6df94399aee5ed958c0fed3cb0b20dc94a0753f9c423f528f3c
SSDeep	24:wq3xAnrO7bhCmLFWNo98KAl0TOyYAAyzOGAusSS/9FnFru+To:T3xsG02o0FYAA39n/h1To
ImpHash	None

C:\$GetCurrent\SafeOS\preoobe.cmd

Modified File

Batch

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\preoobe.cmd[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/x-bat
File Size	191 Bytes
MD5	3de28320af6e08124c9303c59802f3f6
SHA1	1a4772556f5be9c75b8be41d006472a8d0d8d61f
SHA256	f7aa544e78336853e2d5485656cc3dc22a689a3918036d6962487a28c94db7d9
SSDeep	3:FxgNX5NRR/H7dcoaIuQcQ/ckEKoUR7MmtonRCjAL94ja6Q+PZVzGie89fns6kXSC:UNndLl0Q0kIUR7RtonkbaGZcB89fnaNn
ImpHash	None

C:\$GetCurrent\SafeOS\SetupComplete.cmd[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Batch

Unknown

»

Also Known As	C:\$GetCurrent\SafeOS\SetupComplete.cmd (Modified File)
Mime Type	application/x-bat
File Size	436 Bytes
MD5	6a5da83898a373e160e9ab879d522554
SHA1	2f64a075f6162ee4d4463c8d47ef25d87eca2c2a
SHA256	c810360093432f8152d2783268e49410d41522f24e78d270ed06834379fa8151
SSDeep	12:wxkuuNqG82NOUbKiRhUhBgpAMlQGv6ZEv0l6nvlEhjTjBuPn:wiuq982txjIGyfgyV16
ImpHash	None

C:\$Recycle.Bin\S-1-5-18\desktop.ini

Modified File

Text

Unknown

»

Also Known As	C:\$Recycle.Bin\S-1-5-18\desktop.ini[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	text/plain
File Size	203 Bytes
MD5	290fce4bf6710085baf18fe4e8af97e4
SHA1	ee61c6819ec2002e370d5b6a8d9abbd44aeabde2
SHA256	745455c08699af8bc95ab9462c9cef97c4e49241b148fe4d632c9ca5c6f853fe
SSDeep	6:0NhLmNIUUuzLr2tIQGiP6ZvHWzdMQXhafNn:0NsNptzLr2iQJ6h8haVn
ImpHash	None

C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Text

Unknown

»

Also Known As	C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\desktop.ini (Modified File)
Mime Type	text/plain
File Size	203 Bytes
MD5	9b02629e080835edbbb657061674c04d
SHA1	20712c1cdf1a7f88267c1767b34a91f59596c635
SHA256	61c870fffa2828fec498e3b2945967a250d8ac836e1db3dd5bba09fc2e1fc418
SSDeep	6:0NhLmNEuW8BAR7c0GIH4gRBkjCQrkPmlXpkNn:0NsNEuWsAR7eIXRBmrPGn
ImpHash	None

C:\588bce7c90097ed212\DHtmlHeader.html

Modified File

Text

Unknown

»

Also Known As	C:\588bce7c90097ed212\DHtmlHeader.html[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	text/html
File Size	22.94 KB
MD5	102915fea28cd6fe5f1e2e331863e89b
SHA1	78b876e58e855c34819ca4ff1e34240683d8f492
SHA256	d31774f10b76f2aae730643cc1917aa7efebb918006bcbefb4dd756c32b0ea9a
SSDeep	384:I7uSXnydKK5qKOoaPEZFQ/WvuE7sOFb8V/Ezxp93nEDEMuNFkGOsTuS436DOE9A8:0XydFeosxW2ubic9p9XEDEM5CTN4MHq8
ImpHash	None
Parser Error Remark	Static engine was unable to completely parse the analyzed file

C:\588bce7c90097ed212\DisplayIcon.ico

Modified File

Image

Unknown

»

Also Known As	C:\588bce7c90097ed212\DisplayIcon.ico[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	image/x-icon
File Size	115.15 KB
MD5	7fceaa7dad9186e0a6b047d4c33767af
SHA1	3974bfa15f0bddcebd4516159554ffc5f06aa444
SHA256	bb8a8a32a84b9c26809d9ee893ed287e644e543bf3240e9799be78da75224108
SSDeep	3072:e/Jj8NUcTsPJgWMnhyoHG7Hpsa8b+oIRS:e/RVebqpsn/IQ
ImpHash	None

C:\588bce7c90097ed212\header.bmp[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Text

Unknown

»

Also Known As	C:\588bce7c90097ed212\header.bmp (Modified File)
Mime Type	text/plain
File Size	5.19 KB
MD5	e6a38d123ec4a9683841fe6d1952e4f7
SHA1	24494b840888f9a7b288362ac92d86109cd2262f
SHA256	acbfc27b4ef0a338c3f4390c33f6f527c2d03f9bc753f2e234d90ec7863d47a3
SSDeep	96:UaKf1pg5aN2kroD7+cKaOkyMu8jBxaOVcUAU3HQzn4ksfOFzNk+d8IxIDrmg:4Np4p+cKPkyF81cWAUHmFIrJ
ImpHash	None

C:\588bce7c90097ed212\netfx_Core.mzz

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Core.mzz[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/vnd.ms-cab-compressed
File Size	173.10 MB
MD5	e1662609a047427e438427841c86975f
SHA1	f4867c4b9ce3d6a61e27a413a7d130539d82b888
SHA256	7337790f41d70663ecddd9502359cb53eb8e86e2f8900fd53992e9716d526308
SSDeep	196608:+V04YyKSBXZ35w+KBK2KJKDcloT46ooP8ZNoz+hK12RP1O7lT:r4Y7qZ3CwFISoT46ooP8Zyz+hm6Mp
ImpHash	None
Error Remark	Could not parse sample file: Could not open archive

C:\588bce7c90097ed212\netfx_Core_x64.msi

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Core_x64.msi[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/x-msi
File Size	1.84 MB
MD5	71026c1c3a87154e4a8357546fb852a5
SHA1	0529cf6736e8c4d13cce604d8b1e4217aa84ddad
SHA256	49c9e5cc89472b62e4e4f2b223e84f5bc56930cc2a4e54899a08b998469f405a
SSDeep	24576:f/zZ6tsNrQpc+BQbPyxbs4rONSnfiPBC6xahsovoMfjhOGxZWxwMc7Zs:V6tuQpcxisfQf2M6FGoMLeD
ImpHash	None

C:\588bce7c90097ed212\netfx_Core_x86.msi

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Core_x86.msi[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/x-msi
File Size	1.14 MB
MD5	19b8d50379a0ecb4191d2fe6c293a8b8
SHA1	7f9245ff93adabb8177a9183ff0365c0163acd0c
SHA256	cb67f35ec50936cb85e182052ededed4d619d230f34b8c7aa51f1e6a3892e18e
SSDeep	24576:Df6szx1u6dsNbQXcUwabPx9bswH/fd6pxQL:DfhzxI6d+QXcWDsK1hL
ImpHash	None

C:\588bce7c90097ed212\netfx_Extended.mzz

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended.mzz[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/vnd.ms-cab-compressed
File Size	41.16 MB
MD5	4f892641325829a6e6ca30f69d16a065
SHA1	6b612b0db563b728bb8fcd20a9b4e40ed057961c
SHA256	19c7eab7b6703d311cb5fc0cfae6aaa3e5f23a5484f2aaecbfce30d090ef3fe0
SSDeep	49152:nqkOFSX7xpSdqU6tLnvVqSK5G22mDgBOOmeGGiU9Erqkbnt7QTr5+Oc2EI+8dd0o:HtZKH2mALErq2nt7rvfI+vZpfQ
ImpHash	None
Error Remark	Could not parse sample file: Could not open archive

C:\588bce7c90097ed212\netfx_Extended_x64.msi

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended_x64.msi[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/CDFV2
File Size	880.69 KB
MD5	ee515f9a130796968e02c9ecc875cf34
SHA1	ec14cae3bd32e2c748d8ee288f5fe25ed69b72ed
SHA256	5d9b60fbaac54a2132846b6f9088a304107557fc08bf408b7f938560bb0121fb
SSDeep	24576:E/J96doNrQlcqGRpOQSpKiPBD6txBkkkkk5SDMF1/8N+:W6dKQlc4Fc216XmSEGN+
ImpHash	None

C:\588bce7c90097ed212\netfx_Extended_x86.msi

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\netfx_Extended_x86.msi[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/x-msi
File Size	512.69 KB
MD5	eed5ed0e36ce42db050cae34639d71e8
SHA1	8b5dc39b74990242129a501c3d78e03c1b266996
SHA256	1e46100c5f2fe5c72f801d053e6ef6297288b2185b18704c9071cd618c3a8f4d
SSDeep	12288:dHfepsrx1GX6sEsNz7QXcFxZ+VhjgVRELw5a1:dfYsrx1G6dsNnQXcwxgVGLR
ImpHash	None

C:\588bce7c90097ed212\ParameterInfo.xml

Modified File

Text

Unknown

»

Also Known As	C:\588bce7c90097ed212\ParameterInfo.xml[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	text/xml
File Size	294.36 KB
MD5	6b5c4335c263e9b52ad7a366e9d9392c
SHA1	66e9ff6a4150824119784070514eb538c2ca3a15
SHA256	5ed80e97287106c6b7d00a036bbdb3370685a4648b72f2d374d865e43b944bda
SSDeep	3072:EFRJoDdhaZhLAqm301FUiNxPO2sK+cphpOQn:ndhaZhkqm3KF7OWhpz
ImpHash	None

C:\588bce7c90097ed212\RGB9RAST_x64.msi[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Unknown

»

Also Known As	C:\588bce7c90097ed212\RGB9RAST_x64.msi (Modified File)
Mime Type	application/x-msi
File Size	209.19 KB
MD5	2de2806b0e392a18d9011fa9035161e4
SHA1	e0b39246675feb0d9b23e84f8159eef71d2a04a9
SHA256	fc2d31c61902c89bb4fe3d325f6dc23af8357e7b3a7474ee371f3fa3d003f4db
SSDeep	6144:SMddgq38l1A7Km3Hg5CzizuElHiG6/9nDXy/G:SigM8l1A/+vJX6/5XoG
ImpHash	None

C:\588bce7c90097ed212\RGB9Rast_x86.msi

Modified File

Unknown

»

Also Known As	C:\588bce7c90097ed212\RGB9Rast_x86.msi[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/x-msi
File Size	121.19 KB
MD5	1e3de6e8ce6d5dba557a33fd0f55715b
SHA1	0fbe7aa00182e2fac99bd31647caff5a9b149789
SHA256	ae62bb7a5c0055191c6dddc620537fd41cef4fa9da35273e360521ed774b6605
SSDeep	3072:ugZbdgCdZCEXiDQRuU80id2+9G8kr/OPeUBBvn:ugddgGZCOiiuU8H79W/foP
ImpHash	None

C:\588bce7c90097ed212\Setup.exe

Modified File

Binary

Unknown

»

Also Known As	C:\588bce7c90097ed212\Setup.exe[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	105.01 KB
MD5	5d2d99a59c68f23511e4086ddfc04f09
SHA1	aa4c87965e3bbdc4417a48908e9a3285957cdb5e
SHA256	578666fb05b675a89c256e3dd1ed6effc680738bca65b5cf6a95ec8b84b13b69
SSDeep	3072:sYNABsozbffTDnNQPTa/SMIeTjAAwMr17VIYpkbZBV6:VAGoXXnN3y4rBVktS
ImpHash	None
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x400000
Entry Point	0x402b96
Size Of Code	0x6600
Size Of Initialized Data	0xbe00
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2010-03-18 11:22:26+00:00

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x65e8	0x6600	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.51
.data	0x408000	0x19e0	0xc00	0x6a00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.98
.rsrc	0x40a000	0x9aa8	0x9c00	0x7600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	6.0
.reloc	0x414000	0x7d8	0x800	0x11200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	5.98

C:\588bce7c90097ed212\SetupEngine.dll

Modified File

Binary

Unknown

»

Also Known As	C:\588bce7c90097ed212\SetupEngine.dll[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	817.02 KB
MD5	c9d8a67973a778ce4dbec9bfdca17f07
SHA1	7f873d70b584f89ee3ff6b250fe66aa9310a497b
SHA256	5a6171f8407e7d7743af61850fd5bdc7e9ffe5d1d17946de7980bf37c78899a8
SSDeep	24576:GS62nlYAqK/AitUgiuVQk/oifPNJIkjbSTzR8rsM:GS62nlYAltBjPNJIkHST18J
ImpHash	13f7aa20ca0e93f9419eab9cce8fdb3d
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x10000000
Entry Point	0x1007b059
Size Of Code	0xaca00
Size Of Initialized Data	0x18c00
File Type	FileType.dll
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2010-03-18 11:22:41+00:00

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0xac8a0	0xaca00	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.23
.data	0x100ae000	0xb638	0x9800	0xace00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.19
.rsrc	0x100ba000	0x8a8	0xa00	0xb6600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.98
.reloc	0x100bb000	0xc900	0xca00	0xb7000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.0

Imports (17)

»

ADVAPI32.dll (48)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
RegOpenKeyExW	0x0	0x10001000	0xaba14	0xaae14	0x261
RegCreateKeyExW	0x0	0x10001004	0xaba18	0xaae18	0x239
RegSetValueExW	0x0	0x10001008	0xaba1c	0xaae1c	0x27e
RegCloseKey	0x0	0x1000100c	0xaba20	0xaae20	0x230
RegQueryValueExW	0x0	0x10001010	0xaba24	0xaae24	0x26e
AllocateAndInitializeSid	0x0	0x10001014	0xaba28	0xaae28	0x20
CheckTokenMembership	0x0	0x10001018	0xaba2c	0xaae2c	0x51
FreeSid	0x0	0x1000101c	0xaba30	0xaae30	0x120
OpenProcessToken	0x0	0x10001020	0xaba34	0xaae34	0x1f7
LookupAccountSidW	0x0	0x10001024	0xaba38	0xaae38	0x191
GetTokenInformation	0x0	0x10001028	0xaba3c	0xaae3c	0x15a
GetServiceDisplayNameW	0x0	0x1000102c	0xaba40	0xaae40	0x152
QueryServiceStatus	0x0	0x10001030	0xaba44	0xaae44	0x228
OpenServiceW	0x0	0x10001034	0xaba48	0xaae48	0x1fb
CloseServiceHandle	0x0	0x10001038	0xaba4c	0xaae4c	0x57
OpenSCManagerW	0x0	0x1000103c	0xaba50	0xaae50	0x1f9
ChangeServiceConfigW	0x0	0x10001040	0xaba54	0xaae54	0x50
QueryServiceConfigW	0x0	0x10001044	0xaba58	0xaae58	0x224
ControlService	0x0	0x10001048	0xaba5c	0xaae5c	0x5c
StartServiceW	0x0	0x1000104c	0xaba60	0xaae60	0x2c9
ControlTraceW	0x0	0x10001050	0xaba64	0xaae64	0x60
StartTraceW	0x0	0x10001054	0xaba68	0xaae68	0x2cb
EnumerateTraceGuids	0x0	0x10001058	0xaba6c	0xaae6c	0x103
EnableTrace	0x0	0x1000105c	0xaba70	0xaae70	0xf5
GetSidLengthRequired	0x0	0x10001060	0xaba74	0xaae74	0x156
InitializeSid	0x0	0x10001064	0xaba78	0xaae78	0x178
GetSidSubAuthority	0x0	0x10001068	0xaba7c	0xaae7c	0x157
CopySid	0x0	0x1000106c	0xaba80	0xaae80	0x76
GetLengthSid	0x0	0x10001070	0xaba84	0xaae84	0x136
IsValidSid	0x0	0x10001074	0xaba88	0xaae88	0x186
InitializeAcl	0x0	0x10001078	0xaba8c	0xaae8c	0x176
AddAce	0x0	0x1000107c	0xaba90	0xaae90	0x16
GetAclInformation	0x0	0x10001080	0xaba94	0xaae94	0x124
GetSecurityDescriptorOwner	0x0	0x10001084	0xaba98	0xaae98	0x14b
GetSecurityDescriptorGroup	0x0	0x10001088	0xaba9c	0xaae9c	0x149
GetSecurityDescriptorDacl	0x0	0x1000108c	0xabaa0	0xaaea0	0x148
SetSecurityDescriptorDacl	0x0	0x10001090	0xabaa4	0xaaea4	0x2b6
GetSecurityDescriptorSacl	0x0	0x10001094	0xabaa8	0xaaea8	0x14d
MakeSelfRelativeSD	0x0	0x10001098	0xabaac	0xaaeac	0x1e2
GetSecurityDescriptorLength	0x0	0x1000109c	0xabab0	0xaaeb0	0x14a
GetSecurityDescriptorControl	0x0	0x100010a0	0xabab4	0xaaeb4	0x147
MakeAbsoluteSD	0x0	0x100010a4	0xabab8	0xaaeb8	0x1e0
InitializeSecurityDescriptor	0x0	0x100010a8	0xababc	0xaaebc	0x177
LookupPrivilegeValueW	0x0	0x100010ac	0xabac0	0xaaec0	0x197
AdjustTokenPrivileges	0x0	0x100010b0	0xabac4	0xaaec4	0x1f
OpenThreadToken	0x0	0x100010b4	0xabac8	0xaaec8	0x1fc
InitiateSystemShutdownW	0x0	0x100010b8	0xabacc	0xaaecc	0x17e
InitiateSystemShutdownExW	0x0	0x100010bc	0xabad0	0xaaed0	0x17d

KERNEL32.dll (150)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CloseHandle	0x0	0x100010f4	0xabb08	0xaaf08	0x52
CreateFileW	0x0	0x100010f8	0xabb0c	0xaaf0c	0x8f
GetLastError	0x0	0x100010fc	0xabb10	0xaaf10	0x202
ReadFile	0x0	0x10001100	0xabb14	0xaaf14	0x3c0
WriteFile	0x0	0x10001104	0xabb18	0xaaf18	0x525
GetOverlappedResult	0x0	0x10001108	0xabb1c	0xaaf1c	0x238
SetFilePointer	0x0	0x1000110c	0xabb20	0xaaf20	0x466
FlushFileBuffers	0x0	0x10001110	0xabb24	0xaaf24	0x157
SetEndOfFile	0x0	0x10001114	0xabb28	0xaaf28	0x453
GetFileSize	0x0	0x10001118	0xabb2c	0xaaf2c	0x1f0
GetTempPathW	0x0	0x1000111c	0xabb30	0xaaf30	0x285
GetTempFileNameW	0x0	0x10001120	0xabb34	0xaaf34	0x283
DeleteFileW	0x0	0x10001124	0xabb38	0xaaf38	0xd6
MoveFileW	0x0	0x10001128	0xabb3c	0xaaf3c	0x363
CreateFileMappingW	0x0	0x1000112c	0xabb40	0xaaf40	0x8c
OpenFileMappingW	0x0	0x10001130	0xabb44	0xaaf44	0x379
UnmapViewOfFile	0x0	0x10001134	0xabb48	0xaaf48	0x4d6
DuplicateHandle	0x0	0x10001138	0xabb4c	0xaaf4c	0xe8
GetCurrentProcess	0x0	0x1000113c	0xabb50	0xaaf50	0x1c0
GetThreadLocale	0x0	0x10001140	0xabb54	0xaaf54	0x28c
MultiByteToWideChar	0x0	0x10001144	0xabb58	0xaaf58	0x367
WideCharToMultiByte	0x0	0x10001148	0xabb5c	0xaaf5c	0x511
FindFirstFileW	0x0	0x1000114c	0xabb60	0xaaf60	0x139
GetFullPathNameW	0x0	0x10001150	0xabb64	0xaaf64	0x1fb
SetLastError	0x0	0x10001154	0xabb68	0xaaf68	0x473
FindNextFileW	0x0	0x10001158	0xabb6c	0xaaf6c	0x145
FindClose	0x0	0x1000115c	0xabb70	0xaaf70	0x12e
GetUserDefaultUILanguage	0x0	0x10001160	0xabb74	0xaaf74	0x29e
GetSystemDirectoryW	0x0	0x10001164	0xabb78	0xaaf78	0x270
FreeLibrary	0x0	0x10001168	0xabb7c	0xaaf7c	0x162
LoadLibraryW	0x0	0x1000116c	0xabb80	0xaaf80	0x33f
Process32NextW	0x0	0x10001170	0xabb84	0xaaf84	0x398
Process32FirstW	0x0	0x10001174	0xabb88	0xaaf88	0x396
CreateToolhelp32Snapshot	0x0	0x10001178	0xabb8c	0xaaf8c	0xbe
OpenProcess	0x0	0x1000117c	0xabb90	0xaaf90	0x380
GetCurrentProcessId	0x0	0x10001180	0xabb94	0xaaf94	0x1c1
GetDiskFreeSpaceExW	0x0	0x10001184	0xabb98	0xaaf98	0x1ce
GetTickCount	0x0	0x10001188	0xabb9c	0xaaf9c	0x293
CreateEventW	0x0	0x1000118c	0xabba0	0xaafa0	0x85
WaitForSingleObject	0x0	0x10001190	0xabba4	0xaafa4	0x4f9
ResetEvent	0x0	0x10001194	0xabba8	0xaafa8	0x40f
WaitForMultipleObjects	0x0	0x10001198	0xabbac	0xaafac	0x4f7
SetEvent	0x0	0x1000119c	0xabbb0	0xaafb0	0x459
CreateThread	0x0	0x100011a0	0xabbb4	0xaafb4	0xb5
MapViewOfFile	0x0	0x100011a4	0xabbb8	0xaafb8	0x357
OpenEventW	0x0	0x100011a8	0xabbbc	0xaafbc	0x375
GetFileSizeEx	0x0	0x100011ac	0xabbc0	0xaafc0	0x1f1
GetFileAttributesW	0x0	0x100011b0	0xabbc4	0xaafc4	0x1ea
GetSystemTime	0x0	0x100011b4	0xabbc8	0xaafc8	0x277
SystemTimeToFileTime	0x0	0x100011b8	0xabbcc	0xaafcc	0x4bd
GetExitCodeProcess	0x0	0x100011bc	0xabbd0	0xaafd0	0x1df
CompareFileTime	0x0	0x100011c0	0xabbd4	0xaafd4	0x60
CreateProcessW	0x0	0x100011c4	0xabbd8	0xaafd8	0xa8
Sleep	0x0	0x100011c8	0xabbdc	0xaafdc	0x4b2
CancelIo	0x0	0x100011cc	0xabbe0	0xaafe0	0x42
DisconnectNamedPipe	0x0	0x100011d0	0xabbe4	0xaafe4	0xe1
CreateNamedPipeW	0x0	0x100011d4	0xabbe8	0xaafe8	0xa0
ConnectNamedPipe	0x0	0x100011d8	0xabbec	0xaafec	0x65
WaitNamedPipeW	0x0	0x100011dc	0xabbf0	0xaaff0	0x500
LocalAlloc	0x0	0x100011e0	0xabbf4	0xaaff4	0x344
CopyFileW	0x0	0x100011e4	0xabbf8	0xaaff8	0x75
SetFileAttributesW	0x0	0x100011e8	0xabbfc	0xaaffc	0x461
GetCurrentThreadId	0x0	0x100011ec	0xabc00	0xab000	0x1c5
GetCurrentThread	0x0	0x100011f0	0xabc04	0xab004	0x1c4
InitializeCriticalSection	0x0	0x100011f4	0xabc08	0xab008	0x2e2
DeleteCriticalSection	0x0	0x100011f8	0xabc0c	0xab00c	0xd1
EnterCriticalSection	0x0	0x100011fc	0xabc10	0xab010	0xee
LeaveCriticalSection	0x0	0x10001200	0xabc14	0xab014	0x339
OpenMutexW	0x0	0x10001204	0xabc18	0xab018	0x37d
CreateMutexW	0x0	0x10001208	0xabc1c	0xab01c	0x9e
GetLocalTime	0x0	0x1000120c	0xabc20	0xab020	0x203
GetTimeZoneInformation	0x0	0x10001210	0xabc24	0xab024	0x298
SizeofResource	0x0	0x10001214	0xabc28	0xab028	0x4b1
LockResource	0x0	0x10001218	0xabc2c	0xab02c	0x354
LoadResource	0x0	0x1000121c	0xabc30	0xab030	0x341
FindResourceW	0x0	0x10001220	0xabc34	0xab034	0x14e
RaiseException	0x0	0x10001224	0xabc38	0xab038	0x3b1
GlobalMemoryStatus	0x0	0x10001228	0xabc3c	0xab03c	0x2bf
GetSystemDefaultLangID	0x0	0x1000122c	0xabc40	0xab040	0x26c
GetEnvironmentVariableW	0x0	0x10001230	0xabc44	0xab044	0x1dc
DebugBreak	0x0	0x10001234	0xabc48	0xab048	0xc7
FindResourceExW	0x0	0x10001238	0xabc4c	0xab04c	0x14d
GlobalMemoryStatusEx	0x0	0x1000123c	0xabc50	0xab050	0x2c0
SetUnhandledExceptionFilter	0x0	0x10001240	0xabc54	0xab054	0x4a5
ExitProcess	0x0	0x10001244	0xabc58	0xab058	0x119
lstrcmpA	0x0	0x10001248	0xabc5c	0xab05c	0x541
ReleaseMutex	0x0	0x1000124c	0xabc60	0xab060	0x3fa
lstrlenW	0x0	0x10001250	0xabc64	0xab064	0x54e
CreateDirectoryW	0x0	0x10001254	0xabc68	0xab068	0x81
MoveFileExW	0x0	0x10001258	0xabc6c	0xab06c	0x360
InterlockedIncrement	0x0	0x1000125c	0xabc70	0xab070	0x2ef
InterlockedDecrement	0x0	0x10001260	0xabc74	0xab074	0x2eb
GlobalFree	0x0	0x10001264	0xabc78	0xab078	0x2ba
GetCurrentDirectoryW	0x0	0x10001268	0xabc7c	0xab07c	0x1bf
InterlockedCompareExchange	0x0	0x1000126c	0xabc80	0xab080	0x2e9
GetModuleFileNameW	0x0	0x10001270	0xabc84	0xab084	0x214
FileTimeToLocalFileTime	0x0	0x10001274	0xabc88	0xab088	0x124
WriteConsoleW	0x0	0x10001278	0xabc8c	0xab08c	0x524
SetStdHandle	0x0	0x1000127c	0xabc90	0xab090	0x487
GetConsoleMode	0x0	0x10001280	0xabc94	0xab094	0x1ac
GetConsoleCP	0x0	0x10001284	0xabc98	0xab098	0x19a
IsProcessorFeaturePresent	0x0	0x10001288	0xabc9c	0xab09c	0x304
RtlUnwind	0x0	0x1000128c	0xabca0	0xab0a0	0x418
LCMapStringW	0x0	0x10001290	0xabca4	0xab0a4	0x32d
IsValidCodePage	0x0	0x10001294	0xabca8	0xab0a8	0x30a
GetOEMCP	0x0	0x10001298	0xabcac	0xab0ac	0x237
GetACP	0x0	0x1000129c	0xabcb0	0xab0b0	0x168
GetCPInfo	0x0	0x100012a0	0xabcb4	0xab0b4	0x172
HeapReAlloc	0x0	0x100012a4	0xabcb8	0xab0b8	0x2d2
GetStringTypeW	0x0	0x100012a8	0xabcbc	0xab0bc	0x269
HeapSize	0x0	0x100012ac	0xabcc0	0xab0c0	0x2d4
IsDebuggerPresent	0x0	0x100012b0	0xabcc4	0xab0c4	0x300
UnhandledExceptionFilter	0x0	0x100012b4	0xabcc8	0xab0c8	0x4d3
TerminateProcess	0x0	0x100012b8	0xabccc	0xab0cc	0x4c0
QueryPerformanceCounter	0x0	0x100012bc	0xabcd0	0xab0d0	0x3a7
GetProcessHeap	0x0	0x100012c0	0xabcd4	0xab0d4	0x24a
HeapDestroy	0x0	0x100012c4	0xabcd8	0xab0d8	0x2ce
HeapCreate	0x0	0x100012c8	0xabcdc	0xab0dc	0x2cd
GetEnvironmentStringsW	0x0	0x100012cc	0xabce0	0xab0e0	0x1da
FreeEnvironmentStringsW	0x0	0x100012d0	0xabce4	0xab0e4	0x161
GetModuleFileNameA	0x0	0x100012d4	0xabce8	0xab0e8	0x213
GetStartupInfoW	0x0	0x100012d8	0xabcec	0xab0ec	0x263
GetFileType	0x0	0x100012dc	0xabcf0	0xab0f0	0x1f3
InitializeCriticalSectionAndSpinCount	0x0	0x100012e0	0xabcf4	0xab0f4	0x2e3
GetStdHandle	0x0	0x100012e4	0xabcf8	0xab0f8	0x264
SetHandleCount	0x0	0x100012e8	0xabcfc	0xab0fc	0x46f
TlsFree	0x0	0x100012ec	0xabd00	0xab100	0x4c6
TlsSetValue	0x0	0x100012f0	0xabd04	0xab104	0x4c8
TlsGetValue	0x0	0x100012f4	0xabd08	0xab108	0x4c7
TlsAlloc	0x0	0x100012f8	0xabd0c	0xab10c	0x4c5
VirtualQuery	0x0	0x100012fc	0xabd10	0xab110	0x4f1
VirtualAlloc	0x0	0x10001300	0xabd14	0xab114	0x4e9
VirtualProtect	0x0	0x10001304	0xabd18	0xab118	0x4ef
InterlockedExchange	0x0	0x10001308	0xabd1c	0xab11c	0x2ec
HeapAlloc	0x0	0x1000130c	0xabd20	0xab120	0x2cb
HeapFree	0x0	0x10001310	0xabd24	0xab124	0x2cf
GetSystemTimeAsFileTime	0x0	0x10001314	0xabd28	0xab128	0x279
GetCommandLineA	0x0	0x10001318	0xabd2c	0xab12c	0x186
GetCommandLineW	0x0	0x1000131c	0xabd30	0xab130	0x187
VerifyVersionInfoW	0x0	0x10001320	0xabd34	0xab134	0x4e8
VerSetConditionMask	0x0	0x10001324	0xabd38	0xab138	0x4e4
GetSystemInfo	0x0	0x10001328	0xabd3c	0xab13c	0x273
ExpandEnvironmentStringsW	0x0	0x1000132c	0xabd40	0xab140	0x11d
LocalFree	0x0	0x10001330	0xabd44	0xab144	0x348
FormatMessageW	0x0	0x10001334	0xabd48	0xab148	0x15e
OutputDebugStringW	0x0	0x10001338	0xabd4c	0xab14c	0x38a
GetModuleHandleW	0x0	0x1000133c	0xabd50	0xab150	0x218
GetProcAddress	0x0	0x10001340	0xabd54	0xab154	0x245
GetVersionExW	0x0	0x10001344	0xabd58	0xab158	0x2a4
GetFileAttributesExW	0x0	0x10001348	0xabd5c	0xab15c	0x1e7

USER32.dll (30)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PostThreadMessageW	0x0	0x100013e0	0xabdf4	0xab1f4	0x239
SendMessageW	0x0	0x100013e4	0xabdf8	0xab1f8	0x27c
ExitWindowsEx	0x0	0x100013e8	0xabdfc	0xab1fc	0xf5
MessageBoxW	0x0	0x100013ec	0xabe00	0xab200	0x215
PostMessageW	0x0	0x100013f0	0xabe04	0xab204	0x236
GetDesktopWindow	0x0	0x100013f4	0xabe08	0xab208	0x123
LoadImageW	0x0	0x100013f8	0xabe0c	0xab20c	0x1ef
SetWindowLongW	0x0	0x100013fc	0xabe10	0xab210	0x2c4
GetWindow	0x0	0x10001400	0xabe14	0xab214	0x18e
GetWindowLongW	0x0	0x10001404	0xabe18	0xab218	0x196
MonitorFromWindow	0x0	0x10001408	0xabe1c	0xab21c	0x21a
GetMonitorInfoW	0x0	0x1000140c	0xabe20	0xab220	0x15f
GetWindowRect	0x0	0x10001410	0xabe24	0xab224	0x19c
PeekMessageW	0x0	0x10001414	0xabe28	0xab228	0x233
GetClientRect	0x0	0x10001418	0xabe2c	0xab22c	0x114
MapWindowPoints	0x0	0x1000141c	0xabe30	0xab230	0x209
SetWindowPos	0x0	0x10001420	0xabe34	0xab234	0x2c6
DispatchMessageW	0x0	0x10001424	0xabe38	0xab238	0xaf
TranslateMessage	0x0	0x10001428	0xabe3c	0xab23c	0x2fc
GetMessageW	0x0	0x1000142c	0xabe40	0xab240	0x15d
UpdateWindow	0x0	0x10001430	0xabe44	0xab244	0x311
ShowWindow	0x0	0x10001434	0xabe48	0xab248	0x2df
IsWindowVisible	0x0	0x10001438	0xabe4c	0xab24c	0x1e0
GetWindowTextW	0x0	0x1000143c	0xabe50	0xab250	0x1a3
GetWindowThreadProcessId	0x0	0x10001440	0xabe54	0xab254	0x1a4
EnumWindows	0x0	0x10001444	0xabe58	0xab258	0xf2
GetSystemMetrics	0x0	0x10001448	0xabe5c	0xab25c	0x17e
MsgWaitForMultipleObjects	0x0	0x1000144c	0xabe60	0xab260	0x21c
GetParent	0x0	0x10001450	0xabe64	0xab264	0x164
CreateWindowExW	0x0	0x10001454	0xabe68	0xab268	0x6e

SHELL32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SHFileOperationW	0x0	0x10001380	0xabd94	0xab194	0xac
(by ordinal)	0xa5	0x10001384	0xabd98	0xab198	-
SHGetFolderPathW	0x0	0x10001388	0xabd9c	0xab19c	0xc3
SHCreateDirectoryExW	0x0	0x1000138c	0xabda0	0xab1a0	0x8d

ole32.dll (4)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CoUninitialize	0x0	0x10001548	0xabf5c	0xab35c	0x6c
CoCreateInstance	0x0	0x1000154c	0xabf60	0xab360	0x10
CoTaskMemFree	0x0	0x10001550	0xabf64	0xab364	0x68
CoInitialize	0x0	0x10001554	0xabf68	0xab368	0x3e

OLEAUT32.dll (8)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SysAllocStringLen	0x4	0x10001350	0xabd64	0xab164	-
SysFreeString	0x6	0x10001354	0xabd68	0xab168	-
SysStringLen	0x7	0x10001358	0xabd6c	0xab16c	-
SysStringByteLen	0x95	0x1000135c	0xabd70	0xab170	-
SysAllocStringByteLen	0x96	0x10001360	0xabd74	0xab174	-
SysAllocString	0x2	0x10001364	0xabd78	0xab178	-
VariantClear	0x9	0x10001368	0xabd7c	0xab17c	-
VariantInit	0x8	0x1000136c	0xabd80	0xab180	-

SHLWAPI.dll (16)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
PathCompactPathExW	0x0	0x10001394	0xabda8	0xab1a8	0x3f
PathStripToRootW	0x0	0x10001398	0xabdac	0xab1ac	0x97
PathRemoveExtensionW	0x0	0x1000139c	0xabdb0	0xab1b0	0x89
PathFileExistsW	0x0	0x100013a0	0xabdb4	0xab1b4	0x45
StrPBrkW	0x0	0x100013a4	0xabdb8	0xab1b8	0x135
PathAppendW	0x0	0x100013a8	0xabdbc	0xab1bc	0x34
PathCombineW	0x0	0x100013ac	0xabdc0	0xab1c0	0x3a
PathFindExtensionW	0x0	0x100013b0	0xabdc4	0xab1c4	0x47
PathFindFileNameW	0x0	0x100013b4	0xabdc8	0xab1c8	0x49
PathIsDirectoryW	0x0	0x100013b8	0xabdcc	0xab1cc	0x5b
PathIsRelativeW	0x0	0x100013bc	0xabdd0	0xab1d0	0x65
PathQuoteSpacesW	0x0	0x100013c0	0xabdd4	0xab1d4	0x7f
PathRelativePathToW	0x0	0x100013c4	0xabdd8	0xab1d8	0x81
PathGetDriveNumberW	0x0	0x100013c8	0xabddc	0xab1dc	0x55
PathStripPathW	0x0	0x100013cc	0xabde0	0xab1e0	0x95
PathRemoveFileSpecW	0x0	0x100013d0	0xabde4	0xab1e4	0x8b

VERSION.dll (3)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
VerQueryValueW	0x0	0x10001468	0xabe7c	0xab27c	0xe
GetFileVersionInfoW	0x0	0x1000146c	0xabe80	0xab280	0x6
GetFileVersionInfoSizeW	0x0	0x10001470	0xabe84	0xab284	0x5

msi.dll (33)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
(by ordinal)	0xb3	0x100014c0	0xabed4	0xab2d4	-
(by ordinal)	0x74	0x100014c4	0xabed8	0xab2d8	-
(by ordinal)	0xc3	0x100014c8	0xabedc	0xab2dc	-
(by ordinal)	0xd7	0x100014cc	0xabee0	0xab2e0	-
(by ordinal)	0xfe	0x100014d0	0xabee4	0xab2e4	-
(by ordinal)	0x8d	0x100014d4	0xabee8	0xab2e8	-
(by ordinal)	0x119	0x100014d8	0xabeec	0xab2ec	-
(by ordinal)	0xab	0x100014dc	0xabef0	0xab2f0	-
(by ordinal)	0xf6	0x100014e0	0xabef4	0xab2f4	-
(by ordinal)	0xf4	0x100014e4	0xabef8	0xab2f8	-
(by ordinal)	0x5a	0x100014e8	0xabefc	0xab2fc	-
(by ordinal)	0x96	0x100014ec	0xabf00	0xab300	-
(by ordinal)	0x6f	0x100014f0	0xabf04	0xab304	-
(by ordinal)	0x46	0x100014f4	0xabf08	0xab308	-
(by ordinal)	0x76	0x100014f8	0xabf0c	0xab30c	-
(by ordinal)	0xa0	0x100014fc	0xabf10	0xab310	-
(by ordinal)	0x9f	0x10001500	0xabf14	0xab314	-
(by ordinal)	0x20	0x10001504	0xabf18	0xab318	-
(by ordinal)	0x5c	0x10001508	0xabf1c	0xab31c	-
(by ordinal)	0x4e	0x1000150c	0xabf20	0xab320	-
(by ordinal)	0xee	0x10001510	0xabf24	0xab324	-
(by ordinal)	0xbe	0x10001514	0xabf28	0xab328	-
(by ordinal)	0x71	0x10001518	0xabf2c	0xab32c	-
(by ordinal)	0x7d	0x1000151c	0xabf30	0xab330	-
(by ordinal)	0x8	0x10001520	0xabf34	0xab334	-
(by ordinal)	0x73	0x10001524	0xabf38	0xab338	-
(by ordinal)	0x89	0x10001528	0xabf3c	0xab33c	-
(by ordinal)	0xa9	0x1000152c	0xabf40	0xab340	-
(by ordinal)	0x2b	0x10001530	0xabf44	0xab344	-
(by ordinal)	0x11	0x10001534	0xabf48	0xab348	-
(by ordinal)	0x10e	0x10001538	0xabf4c	0xab34c	-
(by ordinal)	0x58	0x1000153c	0xabf50	0xab350	-
(by ordinal)	0xcd	0x10001540	0xabf54	0xab354	-

USERENV.dll (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
UnloadUserProfile	0x0	0x1000145c	0xabe70	0xab270	0x2c
ExpandEnvironmentStringsForUserW	0x0	0x10001460	0xabe74	0xab274	0xc

PSAPI.DLL (2)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
EnumProcessModules	0x0	0x10001374	0xabd88	0xab188	0x4
GetModuleBaseNameW	0x0	0x10001378	0xabd8c	0xab18c	0xe

WINHTTP.dll (15)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WinHttpGetIEProxyConfigForCurrentUser	0x0	0x10001478	0xabe8c	0xab28c	0xd
WinHttpSendRequest	0x0	0x1000147c	0xabe90	0xab290	0x17
WinHttpOpenRequest	0x0	0x10001480	0xabe94	0xab294	0x10
WinHttpConnect	0x0	0x10001484	0xabe98	0xab298	0x8
WinHttpOpen	0x0	0x10001488	0xabe9c	0xab29c	0xf
WinHttpQueryHeaders	0x0	0x1000148c	0xabea0	0xab2a0	0x13
WinHttpDetectAutoProxyConfigUrl	0x0	0x10001490	0xabea4	0xab2a4	0xb
WinHttpGetProxyForUrl	0x0	0x10001494	0xabea8	0xab2a8	0xe
WinHttpCloseHandle	0x0	0x10001498	0xabeac	0xab2ac	0x7
WinHttpQueryDataAvailable	0x0	0x1000149c	0xabeb0	0xab2b0	0x12
WinHttpReadData	0x0	0x100014a0	0xabeb4	0xab2b4	0x15
WinHttpReceiveResponse	0x0	0x100014a4	0xabeb8	0xab2b8	0x16
WinHttpSetStatusCallback	0x0	0x100014a8	0xabebc	0xab2bc	0x1b
WinHttpQueryAuthSchemes	0x0	0x100014ac	0xabec0	0xab2c0	0x11
WinHttpSetCredentials	0x0	0x100014b0	0xabec4	0xab2c4	0x18

Secur32.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
GetComputerObjectNameW	0x0	0x100013d8	0xabdec	0xab1ec	0x1b

WINTRUST.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
WinVerifyTrust	0x0	0x100014b8	0xabecc	0xab2cc	0x73

CRYPT32.dll (11)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
CertVerifyCertificateChainPolicy	0x0	0x100010c4	0xabad8	0xaaed8	0x74
CryptQueryObject	0x0	0x100010c8	0xabadc	0xaaedc	0xbf
CryptMsgGetAndVerifySigner	0x0	0x100010cc	0xabae0	0xaaee0	0xb5
CryptHashPublicKeyInfo	0x0	0x100010d0	0xabae4	0xaaee4	0xa1
CryptMsgGetParam	0x0	0x100010d4	0xabae8	0xaaee8	0xb6
CryptDecodeObject	0x0	0x100010d8	0xabaec	0xaaeec	0x82
CryptMsgClose	0x0	0x100010dc	0xabaf0	0xaaef0	0xaf
CertCloseStore	0x0	0x100010e0	0xabaf4	0xaaef4	0x12
CertFreeCertificateContext	0x0	0x100010e4	0xabaf8	0xaaef8	0x40
CertFreeCertificateChain	0x0	0x100010e8	0xabafc	0xaaefc	0x3d
CertGetCertificateChain	0x0	0x100010ec	0xabb00	0xaaf00	0x45

sqmapi.dll (19)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
SqmGetSession	0x0	0x1000155c	0xabf70	0xab370	0xd
SqmEndSession	0x0	0x10001560	0xabf74	0xab374	0x8
SqmIsWindowsOptedIn	0x0	0x10001564	0xabf78	0xab378	0x11
SqmSetMachineId	0x0	0x10001568	0xabf7c	0xab37c	0x1e
SqmWriteSharedMachineId	0x0	0x1000156c	0xabf80	0xab380	0x2b
SqmReadSharedMachineId	0x0	0x10001570	0xabf84	0xab384	0x12
SqmSetUserId	0x0	0x10001574	0xabf88	0xab388	0x20
SqmWriteSharedUserId	0x0	0x10001578	0xabf8c	0xab38c	0x2c
SqmCreateNewId	0x0	0x1000157c	0xabf90	0xab390	0x7
SqmReadSharedUserId	0x0	0x10001580	0xabf94	0xab394	0x13
SqmAddToStreamString	0x0	0x10001584	0xabf98	0xab398	0x3
SqmAddToStreamDWord	0x0	0x10001588	0xabf9c	0xab39c	0x2
SqmTimerRecord	0x0	0x1000158c	0xabfa0	0xab3a0	0x27
SqmTimerStart	0x0	0x10001590	0xabfa4	0xab3a4	0x28
SqmSetBool	0x0	0x10001594	0xabfa8	0xab3a8	0x18
SqmSet	0x0	0x10001598	0xabfac	0xab3ac	0x14
SqmWaitForUploadComplete	0x0	0x1000159c	0xabfb0	0xab3b0	0x2a
SqmStartUpload	0x0	0x100015a0	0xabfb4	0xab3b4	0x22
SqmSetString	0x0	0x100015a4	0xabfb8	0xab3b8	0x1f

urlmon.dll (1)

»

API Name	Ordinal	IAT Address	Thunk RVA	Thunk Offset	Hint
URLDownloadToFileW	0x0	0x100015ac	0xabfc0	0xab3c0	0x68

Exports (4)

»

Api name	EAT Address	Ordinal
MakePImpl	0x7ab60	0x3
Run	0x5830c	0x4
_DecodePointerInternal@4	0x7adc9	0x1
_EncodePointerInternal@4	0x7ada7	0x2

C:\588bce7c90097ed212\SetupUi.dll

Modified File

Binary

Unknown

»

Also Known As	C:\588bce7c90097ed212\SetupUi.dll[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	317.02 KB
MD5	5008182d2844de04bcb974e08d466cf6
SHA1	b2157384e097f1b9edbc03501d79020d59d97767
SHA256	4d8c667fe6edd8939bb9983c1bddd6dc07169fbff381b48a5aa626f2bf4fe41a
SSDeep	3072:/LTVUK59JN+C0iy4Ww8oBcPFIOrvHvr8QDZHAAKWiIHT6llN1QkvQZCAFaL8+wHO:HOoMFrz8ygAKWiiIyJaBwbMmq6S
ImpHash	None
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x10000000
Entry Point	0x10028789
Size Of Code	0x3d800
Size Of Initialized Data	0xac00
File Type	FileType.dll
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2010-03-18 11:22:35+00:00

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x10001000	0x3d792	0x3d800	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.44
.data	0x1003f000	0x519c	0x3400	0x3dc00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	6.0
.rsrc	0x10045000	0x3b0	0x400	0x41000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.96
.reloc	0x10046000	0x54bc	0x5600	0x41400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.0

C:\588bce7c90097ed212\SetupUi.xsd

Modified File

Text

Unknown

»

Also Known As	C:\588bce7c90097ed212\SetupUi.xsd[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	text/xml
File Size	42.90 KB
MD5	7bfe087b99e8de694382a5380d9f79a9
SHA1	ca67060d6a0be58a4f3e869398c2b74e02b3f4ed
SHA256	e31b9e19d9043558bd51b012d196875af089f5e300f5b3e88f308270d8956243
SSDeep	768:bgzmhAxEWhP9hKbqXPMTVEWBPpVgRy5f2fpeqc4awwf6coKdxGu:bEm2EWhP9hKb+Mawok5OBc4awBKdxD
ImpHash	None

C:\588bce7c90097ed212\SetupUtility.exe

Modified File

Binary

Unknown

»

Also Known As	C:\588bce7c90097ed212\SetupUtility.exe[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	122.52 KB
MD5	bf12f8ddd0806d3d70c2a914f6796089
SHA1	f191735a20fa81ed7c7a932b699459db90d3a241
SHA256	577d7c039f04b43253db6799770657db2c7c36190ba3e6affd8e9d7e459d3817
SSDeep	3072:L+59hI1NktIyU820i1QBXwSa48IFNLMO48aqR:M9hIktywwfYjv60
ImpHash	None
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x400000
Entry Point	0x405eb6
Size Of Code	0x13000
Size Of Initialized Data	0x4c00
File Type	FileType.executable
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2010-03-18 11:22:28+00:00

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x401000	0x12edf	0x13000	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.59
.data	0x414000	0x2ea0	0x1000	0x13400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.99
.rsrc	0x417000	0x3f8	0x400	0x14400	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.96
.reloc	0x418000	0x1666	0x1800	0x14800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	5.99

C:\588bce7c90097ed212\SplashScreen.bmp

Modified File

Stream

Unknown

»

Also Known As	C:\588bce7c90097ed212\SplashScreen.bmp[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/octet-stream
File Size	58.53 KB
MD5	56ecffd96a849a944aa6bf3c0d53264c
SHA1	dfbbeef0be4623e78d0aed5152fd6df37556a498
SHA256	b187edfbefec32f15c12cff58f8dc1e8f1439e1cb6c995ba8133e714590c58d6
SSDeep	768:OuYMYJQub3wFhO6zIlxDPXTEjD7wPo7JtIaxbVObb2lpuwCZoIl/a1jS6ajBBvwb:BAv+xcHTELUovFWbmpuwiV4oOjLA3i5l
ImpHash	None

C:\588bce7c90097ed212\sqmapi.dll

Modified File

Binary

Unknown

»

Also Known As	C:\588bce7c90097ed212\sqmapi.dll[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/vnd.microsoft.portable-executable
File Size	169.72 KB
MD5	16e34fd7ceb60a10d4410f5c0d98615d
SHA1	2ef4634a9c7635b402f9ab78243eb226c471a46a
SHA256	6ad9265b8ee1458b87f9b123703fd8e138529bb8f0dcb8a26b87069fa0592b9b
SSDeep	3072:uochw/MFWrJjKOMxRSepuBaqn/NlnBh2LxDMkHJshWIqbJUKvMRu8GGb4lGHPnWF:zDFB47UhXBh2hHJm7EUbALGb3WJVJ
ImpHash	None
Parser Error Remark	Static engine was unable to completely parse the analyzed file

PE Information

»

Image Base	0x6cd00000
Entry Point	0x6cd01ba2
Size Of Code	0x1e400
Size Of Initialized Data	0x2400
File Type	FileType.dll
Subsystem	Subsystem.windows_gui
Machine Type	MachineType.i386
Compile Timestamp	2006-11-02 09:44:16+00:00

Sections (4)

»

Name	Virtual Address	Virtual Size	Raw Data Size	Raw Data Offset	Flags	Entropy
.text	0x6cd01000	0x1e3af	0x1e400	0x400	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.93
.data	0x6cd20000	0x580	0x600	0x1e800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	5.97
.rsrc	0x6cd21000	0x400	0x400	0x1ee00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.96
.reloc	0x6cd22000	0x1808	0x1a00	0x1f200	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	5.99

Exports (45)

»

Api name	EAT Address	Ordinal
SqmAddToAverage	0x16fc6	0x1
SqmAddToStream	0x176f3	0x2
SqmAddToStreamDWord	0xa727	0x3
SqmAddToStreamString	0xb20b	0x4
SqmAddToStreamV	0x175b1	0x5
SqmCleanup	0x1e75	0x6
SqmClearFlags	0x1707d	0x7
SqmCreateNewId	0x16618	0x8
SqmEndSession	0xabd9	0x9
SqmFlushSession	0x16a5e	0xa
SqmGetEnabled	0x16b90	0xb
SqmGetFlags	0xae65	0xc
SqmGetMachineId	0x173ed	0xd
SqmGetSession	0x32bc	0xe
SqmGetSessionStartTime	0x169ad	0xf
SqmGetUserId	0x174cf	0x10
SqmIncrement	0x16f0f	0x11
SqmIsWindowsOptedIn	0x3fbf	0x12
SqmReadSharedMachineId	0x2e0f	0x13
SqmReadSharedUserId	0x3d03	0x14
SqmSet	0x31ea	0x15
SqmSetAppId	0x3da3	0x16
SqmSetAppVersion	0xb16c	0x17
SqmSetBits	0x16cea	0x18
SqmSetBool	0x9d65	0x19
SqmSetCurrentTimeAsUploadTime	0x166a1	0x1a
SqmSetEnabled	0xaf13	0x1b
SqmSetFlags	0x3805	0x1c
SqmSetIfMax	0x16da1	0x1d
SqmSetIfMin	0x16e58	0x1e
SqmSetMachineId	0x38b9	0x1f
SqmSetString	0xafa2	0x20
SqmSetUserId	0x39bd	0x21
SqmStartSession	0x16c3d	0x22
SqmStartUpload	0x4197	0x23
SqmSysprepGeneralize	0x15fe4	0x24
SqmSysprepSpecialize	0x1616d	0x25
SqmTimerAccumulate	0x1728d	0x26
SqmTimerAddToAverage	0x1733d	0x27
SqmTimerRecord	0x171dd	0x28
SqmTimerStart	0x1712d	0x29
SqmUnattendedSetup	0x161d8	0x2a
SqmWaitForUploadComplete	0xbb1c	0x2b
SqmWriteSharedMachineId	0x16327	0x2c
SqmWriteSharedUserId	0x16513	0x2d

C:\Logs\Security.evtx[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\Security.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.09 MB
MD5	4c060349938f88084ad8562a53395a66
SHA1	a5f315ee4c9bbfd53faf5fafcac8164db4c4a839
SHA256	c6dde067e196b29ac6b3023149fe44490562968f5590c63851143eee8596e152
SSDeep	3072:mw3Udlqvj+fAnsxfZ1mpc3Q57lOtYsndUY8qmlwolf1K/lvCd8UI2:JizndEfcSI2
ImpHash	None

C:\Logs\Setup.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Setup.evtx[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/octet-stream
File Size	96.69 KB
MD5	8f8560d82205174ecbd205ad609c1b7d
SHA1	59ca35f07591bf1b3b9f93161e0be3f102678b82
SHA256	814a4f25ad559663320b4c39a15331667050e99e787010dc66f57f87726ed898
SSDeep	1536:Rzp94cX8ssFs0pqU0fAUCfaxGmfzujU4m++I0G2M5Iv4dP0RfXJ:ppCcX9stqhfUyFfiEHIr2M+wdPaR
ImpHash	None

C:\Logs\System.evtx[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Stream

Unknown

»

Also Known As	C:\Logs\System.evtx (Modified File)
Mime Type	application/octet-stream
File Size	1.09 MB
MD5	2a0d6578b38865ad0b5a7218a718075b
SHA1	b38c6fa5630cb54ec047d8933ffad4c176f84113
SHA256	e2498b6ca9a2efdc1806de88c79affd9df0501a95bf10663619c840e81eee60a
SSDeep	1536:xGdsiVbNe8aisiVbjZw4YvX1MNNDzpMgR2kQJ7JjEUm9Ar98GmmhWvUfyaZA/hJJ:7C1UwZw4YqNBMig5d58GeEAb3Xpv
ImpHash	None

C:\Logs\Windows PowerShell.evtx

Modified File

Stream

Unknown

»

Also Known As	C:\Logs\Windows PowerShell.evtx[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	application/octet-stream
File Size	96.69 KB
MD5	c34c72adbab6fe79127d1ea7f3091115
SHA1	91513ad2ea4f75133cd3e08da445a8ca3a10522a
SHA256	6671a11c7aaba6803b81d4ca9051abed988fae33dba6f0b4a89fbcfde614a73e
SSDeep	1536:XbPsuh400kJNCqos/B2mIL0LWuJQLILmaCqi0jUl3r3BlA7duswUtYEPbDwS:bc5wNCOu3uSLIiaHi0jUFlluOEXwS
ImpHash	None

C:\Program Files\desktop.ini

Modified File

Text

Unknown

»

Also Known As	C:\Program Files\desktop.ini[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT (Dropped File)
Mime Type	text/plain
File Size	248 Bytes
MD5	ff516a988dd3c6fbe0d94f2e2ed9dae5
SHA1	d9e3ba7a3351ff832edee8120cf60b0e561a022a
SHA256	16969aab36e96632e373e58187b0240eee307218b7d52cc38f542c706e68eceb
SSDeep	6:QyqRsiadNqcEEZkqGNGVG/Brm4xS9fy44DNn:QZsiadNnSNs0/o9fy15n
ImpHash	None

C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB[id-qKCXbrQ9].[paradise@all-ransomware.info].PRT

Dropped File

Binary

Unknown

»

Also Known As	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB (Modified File)
Mime Type	application/x-dosexec
File Size	22.76 KB
MD5	0b2043b623fbb8d09b6d81cf9ed90d84
SHA1	156a6f4bc6b7a222f4132d79774758a36e699450
SHA256	b2f29dd8a9f9b357a656fc307780fa8e5c0263cff088aaebcbd5562b051af9ed
SSDeep	384:cXLtgaZwu5DP2B9Rnvm0qgoC3clKioBmHcbkswgWBYt3Nf0GmzO4CEFlfreFIAsg:cJgaZR7W9kV/KXgmwgW2hNM04CEPfaFP
ImpHash	None

C:\Users\FD1HVy\Desktop\id.dp

Dropped File

Text

Unknown

»

Mime Type	text/plain
File Size	8 Bytes
MD5	4f751bf4b80ffd53e51c51fe1c70c889
SHA1	2cde1fdc3971983dd7e4d10e31e8bceec5c409aa
SHA256	e5a79f673ffa99cbf053eed65c0906c2a1f4c9666c07dfdc5eabb5b6f2e93306
SSDeep	3:6HVn:sVn
ImpHash	None

C:\Users\FD1HVy\Documents\DecryptionInfo.auth

Dropped File

Text

Unknown

»

Also Known As	C:\Program Files\DP\DecryptionInfo.auth (Dropped File)
Mime Type	text/plain
File Size	1.57 KB
MD5	83b5dd101a5e06925b6b1e50ee52d4c2
SHA1	3bd39c7fa95941d7b7b5a484711d684f08afbd99
SHA256	a9b4c4caff9fdc8ba47013223ca79b5fac69ffc39cb541b483ff7e0901f3f2fc
SSDeep	24:ZqQUFUp7p2BYu4A2Wsl9VTh/p50/vD8cBGZOMPqH3XnNgCmYY6WKvL4p0m9ziTJL:6FcCYu4wWluLsZOUqH33NFhkamATJL
ImpHash	None

C:\Boot\bg-BG\#DECRYPT MY FILES#.html

Dropped File

Text

Unknown

»

Also Known As	C:\Boot\es-MX\#DECRYPT MY FILES#.html (Dropped File) C:\PerfLogs\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\el-GR\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1036\#DECRYPT MY FILES#.html (Dropped File) C:\Logs\#DECRYPT MY FILES#.html (Dropped File) C:\$GetCurrent\Logs\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\cs-CZ\#DECRYPT MY FILES#.html (Dropped File) C:\$GetCurrent\SafeOS\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1046\#DECRYPT MY FILES#.html (Dropped File) C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1045\#DECRYPT MY FILES#.html (Dropped File) C:\$Recycle.Bin\S-1-5-18\#DECRYPT MY FILES#.html (Dropped File) C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\4YP7HqQHS\#DECRYPT MY FILES#.html (Dropped File) C:\Program Files\Common Files\#DECRYPT MY FILES#.html (Dropped File) C:\$Recycle.Bin\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1040\#DECRYPT MY FILES#.html (Dropped File) C:\Program Files\Common Files\microsoft shared\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1031\#DECRYPT MY FILES#.html (Dropped File) C:\$GetCurrent\#DECRYPT MY FILES#.html (Dropped File) C:\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\de-DE\#DECRYPT MY FILES#.html (Dropped File) C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\euwZWkKHGolY\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1032\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1042\#DECRYPT MY FILES#.html (Dropped File) C:\Users\FD1HVy\Desktop\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1029\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1053\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\3082\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\fi-FI\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1037\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\2052\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1035\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1049\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\en-GB\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\es-ES\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1041\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\Graphics\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\et-EE\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1033\#DECRYPT MY FILES#.html (Dropped File) C:\Program Files\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\Extended\#DECRYPT MY FILES#.html (Dropped File) C:\Program Files\Common Files\DESIGNER\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1028\#DECRYPT MY FILES#.html (Dropped File) C:\Users\FD1HVy\Desktop\URfyazp6YCOme0Ken\tint\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1030\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1043\#DECRYPT MY FILES#.html (Dropped File) C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\Client\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\3076\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\en-US\#DECRYPT MY FILES#.html (Dropped File) C:\Program Files\Common Files\microsoft shared\ClickToRun\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1055\#DECRYPT MY FILES#.html (Dropped File) C:\Boot\da-DK\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1038\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\2070\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1025\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\1044\#DECRYPT MY FILES#.html (Dropped File) C:\588bce7c90097ed212\#DECRYPT MY FILES#.html (Dropped File)
Mime Type	text/html
File Size	5.07 KB
MD5	a98ff90bafeb717be1b78580228daa29
SHA1	7ea0f62f13ae9e214324e3fa63c6ed775a30a1cb
SHA256	8fcaf309f3c3032d8fdd54669f8e4eac318b474929bf47db3b640e31862e7ff3
SSDeep	96:sb9QpOrG5oMDq+hdl4wdLsZOPqeaqMfimdhvsNc3i:sXGTfl1LsZEMfiMhvsNc3i
ImpHash	None

Embedded URLs (2)

»

URL	First Seen	Categories	Threat Names	Reputation Status	WHOIS Data
https://localbitcoins.com/buy_bitcoins/	-	-	-	Unknown	Not Queried
http://www.coindesk.com/information/how-can-i-buy-bitcoins/	-	-	-	Unknown	Not Queried

Remarks (1/1)

There are no files for this filter

There are no files in this analysis

WHOIS Domain Information

Before

After