» For Windows 8, Windows 8.1, 10, and Windows Server 2012 (R2) users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter. » For Windows 7 and Windows Server 2008 (R2) users, click the Start button, type regedit in the Search input field then press Enter. To run procmon, simply launch the main Procmon.exe command in PowerShell. Procmon64a.exe The alpha 64 procmon binary. To delete the registry value this malware created: Procmon.exe The main EXE that will launch the correct procmon instance (x86 or 圆4). It avoids encrypting files with the following file extensions:

This Ransomware drops the following files: Just confirm this Process Monitor Filter dialog window with the button Ok. After you have confirmed the license dialog on the first run, you will see the main window of ProcMon and a dialog showing a list of the defined Process Monitor Filters. This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Then, you have to extract the archive file and you can start ProcMon by running the Procmon64.exe. Payload: Disables services, Displays message/message boxes, Encrypts files, Terminates processes

Procmon64 vs procmon64a