Reply to thread

Message

<blockquote data-quote="Evjl&amp;#039;s Rain" data-source="post: 613876" data-attributes="member: 51905">thank you for clarification <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />I counted the memory usage of the 2 processes ~39-40Mb = 80Mb. If I had counted private bytes, it was around 40-50Mb =&gt; OK. Sorry, I&#039;m not a coder/developer, I don&#039;t know much <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />I was using Office 2007 portable (illegal) and RansomOff actually detected it once as ransomware before the VM froze and BSODThere were 3 autorun entries I saw in Autoruns program so I&#039;m not sure exactly which one caused BSODI can give the hash of 2 potential samples which caused BSOD (ransomware.exe and sure ransomware/screenlocker)ransomware.exe<a href="https://www.virustotal.com/vi/file/fb061305a6af048ecee60f8588c641cd18f9cc1975f96ef2d3b7666b5d5345ad/analysis/1490244626/" target="_blank">Antivirus scan for fb061305a6af048ecee60f8588c641cd18f9cc1975f96ef2d3b7666b5d5345ad at 2017-03-23 04:50:26 UTC - VirusTotal</a>sure ransomware<a href="https://www.virustotal.com/vi/file/9182432e60ea007cbfae7eed92082e7ef0f2d00674dfe1b2ad956f7c9d494adb/analysis/1486011727/" target="_blank">Antivirus scan for 9182432e60ea007cbfae7eed92082e7ef0f2d00674dfe1b2ad956f7c9d494adb at 2017-02-02 05:02:07 UTC - VirusTotal</a>after the reboot, I think ransomoff intercepted the malwares but also blocked something which caused BSOD, but no popup was seen. Exact same situation happened to Office 2007 portable (detected as ransomware with a popup =&gt; froze =&gt; BSOD)if you can&#039;t find them I can send it to you, no problemI&#039;m looking forward to the later versions as this program is very good <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />I still have the snapshot of the tested VM. I may help</blockquote>

[QUOTE="Evjl's Rain, post: 613876, member: 51905"] thank you for clarification :) I counted the memory usage of the 2 processes ~39-40Mb = 80Mb. If I had counted private bytes, it was around 40-50Mb => OK. Sorry, I'm not a coder/developer, I don't know much :) I was using Office 2007 portable (illegal) and RansomOff actually detected it once as ransomware before the VM froze and BSOD There were 3 autorun entries I saw in Autoruns program so I'm not sure exactly which one caused BSOD I can give the hash of 2 potential samples which caused BSOD (ransomware.exe and sure ransomware/screenlocker) ransomware.exe [URL='https://www.virustotal.com/vi/file/fb061305a6af048ecee60f8588c641cd18f9cc1975f96ef2d3b7666b5d5345ad/analysis/1490244626/']Antivirus scan for fb061305a6af048ecee60f8588c641cd18f9cc1975f96ef2d3b7666b5d5345ad at 2017-03-23 04:50:26 UTC - VirusTotal[/URL] sure ransomware [URL='https://www.virustotal.com/vi/file/9182432e60ea007cbfae7eed92082e7ef0f2d00674dfe1b2ad956f7c9d494adb/analysis/1486011727/']Antivirus scan for 9182432e60ea007cbfae7eed92082e7ef0f2d00674dfe1b2ad956f7c9d494adb at 2017-02-02 05:02:07 UTC - VirusTotal[/URL] after the reboot, I think ransomoff intercepted the malwares but also blocked something which caused BSOD, but no popup was seen. Exact same situation happened to Office 2007 portable (detected as ransomware with a popup => froze => BSOD) if you can't find them I can send it to you, no problem I'm looking forward to the later versions as this program is very good :) I still have the snapshot of the tested VM. I may help [/QUOTE]

Verification