Analysis
-
max time kernel
144s -
max time network
181s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
17-07-2021 07:00
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v20210410
General
-
Target
1.exe
-
Size
3.3MB
-
MD5
08684a98326e5e871ee7832859ff16da
-
SHA1
d43d471b3ba5a29edb0910ac5b8db6ce079fece2
-
SHA256
24a163dbbbd12e458bcbcfa3e9707da5c7364369060344f062ef46dbf208169d
-
SHA512
1dacbc24d8acb82df6e9cc2f2659a11c4c7e495557c7ed7767538a6b936aa9b8754957e8c4cff52ac239ad5a122ae18374c92ec9a23cac308dd001ed22a1eee7
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
miniworld.exeMicroMiniNew.exe9M1B.TMPmstray.exe@RecoveryYourFiles@.exepid process 1720 miniworld.exe 1216 MicroMiniNew.exe 1888 9M1B.TMP 1856 mstray.exe 1908 @RecoveryYourFiles@.exe -
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
cmd.exedescription ioc process File renamed C:\Users\Admin\Pictures\EnterUninstall.tif => C:\Users\Admin\Pictures\EnterUninstall.tif.MCNB cmd.exe File renamed C:\Users\Admin\Pictures\MeasureDebug.tif => C:\Users\Admin\Pictures\MeasureDebug.tif.MCNB cmd.exe File renamed C:\Users\Admin\Pictures\OpenTrace.tif => C:\Users\Admin\Pictures\OpenTrace.tif.MCNB cmd.exe File renamed C:\Users\Admin\Pictures\ProtectConfirm.png => C:\Users\Admin\Pictures\ProtectConfirm.png.MCNB cmd.exe File renamed C:\Users\Admin\Pictures\StepConvertFrom.png => C:\Users\Admin\Pictures\StepConvertFrom.png.MCNB cmd.exe File renamed C:\Users\Admin\Pictures\UnblockInvoke.tif => C:\Users\Admin\Pictures\UnblockInvoke.tif.MCNB cmd.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\37A.tmp\9M1B.TMP upx C:\Users\Admin\AppData\Local\Temp\37A.tmp\5HB2.TMP upx C:\Users\Admin\AppData\Roaming\miniworldcfg\9M1B.TMP upx C:\Users\Admin\AppData\Local\Temp\7BE.tmp\2Y8U.TMP upx C:\Windows\System32\mstray.exe upx -
Loads dropped DLL 4 IoCs
Processes:
miniworld.exeMicroMiniNew.exepid process 1720 miniworld.exe 1720 miniworld.exe 1720 miniworld.exe 1216 MicroMiniNew.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msfdhs = "C:\\Windows\\system32\\msfdhs.exe" reg.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mstray = "C:\\Windows\\system32\\mstray.exe" reg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
cmd.exedescription ioc process File opened (read-only) \??\X: cmd.exe File opened (read-only) \??\Z: cmd.exe File opened (read-only) \??\N: cmd.exe File opened (read-only) \??\P: cmd.exe File opened (read-only) \??\R: cmd.exe File opened (read-only) \??\W: cmd.exe File opened (read-only) \??\S: cmd.exe File opened (read-only) \??\U: cmd.exe File opened (read-only) \??\Y: cmd.exe File opened (read-only) \??\F: cmd.exe File opened (read-only) \??\H: cmd.exe File opened (read-only) \??\I: cmd.exe File opened (read-only) \??\J: cmd.exe File opened (read-only) \??\E: cmd.exe File opened (read-only) \??\M: cmd.exe File opened (read-only) \??\T: cmd.exe File opened (read-only) \??\V: cmd.exe File opened (read-only) \??\G: cmd.exe File opened (read-only) \??\K: cmd.exe File opened (read-only) \??\L: cmd.exe File opened (read-only) \??\O: cmd.exe -
Drops file in System32 directory 4 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Windows\system32\msfdhs.exe cmd.exe File opened for modification C:\Windows\system32\msfdhs.exe cmd.exe File created C:\Windows\system32\mstray.exe cmd.exe File opened for modification C:\Windows\system32\mstray.exe cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\37A.tmp\miniworld.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\37A.tmp\miniworld.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\37A.tmp\miniworld.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\37A.tmp\miniworld.exe nsis_installer_2 -
Delays execution with timeout.exe 3 IoCs
Processes:
timeout.exetimeout.exetimeout.exepid process 1080 timeout.exe 1892 timeout.exe 1344 timeout.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 1728 tasklist.exe 1884 tasklist.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1344 taskkill.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 4 IoCs
Processes:
miniworld.exe9M1B.TMPmstray.exe@RecoveryYourFiles@.exepid process 1720 miniworld.exe 1888 9M1B.TMP 1856 mstray.exe 1908 @RecoveryYourFiles@.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
taskkill.exeexplorer.exeAUDIODG.EXEtasklist.exetasklist.exedescription pid process Token: SeDebugPrivilege 1344 taskkill.exe Token: SeShutdownPrivilege 772 explorer.exe Token: SeShutdownPrivilege 772 explorer.exe Token: SeShutdownPrivilege 772 explorer.exe Token: SeShutdownPrivilege 772 explorer.exe Token: SeShutdownPrivilege 772 explorer.exe Token: SeShutdownPrivilege 772 explorer.exe Token: SeShutdownPrivilege 772 explorer.exe Token: 33 1692 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1692 AUDIODG.EXE Token: 33 1692 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1692 AUDIODG.EXE Token: SeDebugPrivilege 1728 tasklist.exe Token: SeShutdownPrivilege 772 explorer.exe Token: SeShutdownPrivilege 772 explorer.exe Token: SeShutdownPrivilege 772 explorer.exe Token: SeDebugPrivilege 1884 tasklist.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
explorer.exepid process 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe -
Suspicious use of SendNotifyMessage 25 IoCs
Processes:
explorer.exepid process 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe 772 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
MicroMiniNew.exe@RecoveryYourFiles@.exepid process 1216 MicroMiniNew.exe 1216 MicroMiniNew.exe 1908 @RecoveryYourFiles@.exe 1908 @RecoveryYourFiles@.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1.execmd.exeminiworld.exe9M1B.TMPcmd.exedescription pid process target process PID 2004 wrote to memory of 1984 2004 1.exe cmd.exe PID 2004 wrote to memory of 1984 2004 1.exe cmd.exe PID 2004 wrote to memory of 1984 2004 1.exe cmd.exe PID 2004 wrote to memory of 1984 2004 1.exe cmd.exe PID 1984 wrote to memory of 1700 1984 cmd.exe reg.exe PID 1984 wrote to memory of 1700 1984 cmd.exe reg.exe PID 1984 wrote to memory of 1700 1984 cmd.exe reg.exe PID 1984 wrote to memory of 1720 1984 cmd.exe miniworld.exe PID 1984 wrote to memory of 1720 1984 cmd.exe miniworld.exe PID 1984 wrote to memory of 1720 1984 cmd.exe miniworld.exe PID 1984 wrote to memory of 1720 1984 cmd.exe miniworld.exe PID 1720 wrote to memory of 1216 1720 miniworld.exe MicroMiniNew.exe PID 1720 wrote to memory of 1216 1720 miniworld.exe MicroMiniNew.exe PID 1720 wrote to memory of 1216 1720 miniworld.exe MicroMiniNew.exe PID 1720 wrote to memory of 1216 1720 miniworld.exe MicroMiniNew.exe PID 1984 wrote to memory of 1544 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 1544 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 1544 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 1888 1984 cmd.exe 9M1B.TMP PID 1984 wrote to memory of 1888 1984 cmd.exe 9M1B.TMP PID 1984 wrote to memory of 1888 1984 cmd.exe 9M1B.TMP PID 1984 wrote to memory of 1888 1984 cmd.exe 9M1B.TMP PID 1888 wrote to memory of 2000 1888 9M1B.TMP cmd.exe PID 1888 wrote to memory of 2000 1888 9M1B.TMP cmd.exe PID 1888 wrote to memory of 2000 1888 9M1B.TMP cmd.exe PID 1888 wrote to memory of 2000 1888 9M1B.TMP cmd.exe PID 2000 wrote to memory of 1820 2000 cmd.exe reg.exe PID 2000 wrote to memory of 1820 2000 cmd.exe reg.exe PID 2000 wrote to memory of 1820 2000 cmd.exe reg.exe PID 2000 wrote to memory of 1700 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1700 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1700 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1832 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1832 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1832 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1692 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1692 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1692 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 576 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 576 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 576 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1812 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1812 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1812 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1592 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1592 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1592 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1596 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1596 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1596 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1684 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1684 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1684 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1680 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1680 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1680 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 1780 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1780 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 1780 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 836 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 836 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 836 2000 cmd.exe cmd.exe PID 2000 wrote to memory of 880 2000 cmd.exe cacls.exe PID 2000 wrote to memory of 880 2000 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\37A.tmp\37B.tmp\37C.bat C:\Users\Admin\AppData\Local\Temp\1.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "msfdhs" /t REG_SZ /d "C:\Windows\system32\msfdhs.exe" /f3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\37A.tmp\miniworld.exeC:\Users\Admin\AppData\Local\Temp\37A.tmp\miniworld.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\MicroMiniNew.exeC:\Users\Admin\AppData\Roaming\miniworldgame4399\MicroMiniNew.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\PING.EXEping -n 120 127.0.0.13⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\miniworldcfg\9M1B.TMPC:\Users\Admin\AppData\Roaming\miniworldcfg\9M1B.TMP3⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7BE.tmp\7BF.tmp\7C0.bat C:\Users\Admin\AppData\Roaming\miniworldcfg\9M1B.TMP"4⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v msfdhs /f5⤵
- Modifies registry key
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"5⤵
-
C:\Windows\system32\cacls.execacls "C:\Users\Admin\Music\*.*" /e /d everyone5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"5⤵
-
C:\Windows\system32\cacls.execacls "C:\Users\Admin\Downloads\*.*" /e /d everyone5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"5⤵
-
C:\Windows\system32\cacls.execacls "C:\Users\Admin\Links\*.*" /e /d everyone5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"5⤵
-
C:\Windows\system32\cacls.execacls "C:\Users\Admin\Favorites\*.*" /e /d everyone5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"5⤵
-
C:\Windows\system32\cacls.execacls "C:\Users\Admin\Documents\*.*" /e /d everyone5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"5⤵
-
C:\Windows\system32\cacls.execacls "C:\Users\Admin\Videos\*.*" /e /d everyone5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"5⤵
-
C:\Windows\system32\cacls.execacls "C:\Users\Admin\Pictures\*.*" /e /d everyone5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo y"5⤵
-
C:\Windows\system32\cacls.execacls "C:\Users\Admin\Desktop\*.*" /e /d everyone5⤵
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "mstray" /t REG_SZ /d "C:\Windows\system32\mstray.exe" /f5⤵
- Adds Run key to start application
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe5⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\mstray.exeC:\Windows\system32\mstray.exe5⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\D3A.tmp\D3B.tmp\D3C.bat C:\Windows\system32\mstray.exe"6⤵
-
C:\Windows\system32\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist|find /i "@RecoveryYourFiles@.exe"7⤵
-
C:\Windows\system32\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\find.exefind /i "@RecoveryYourFiles@.exe"8⤵
-
C:\MiniworldRansom\@RecoveryYourFiles@.exeC:\MiniworldRansom\@RecoveryYourFiles@.exe7⤵
- Executes dropped EXE
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c tasklist|find /i "@RecoveryYourFiles@.exe"7⤵
-
C:\Windows\system32\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\find.exefind /i "@RecoveryYourFiles@.exe"8⤵
-
C:\Windows\system32\timeout.exetimeout /t 37⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5301⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\MiniworldRansom\@RecoveryYourFiles@.exeMD5
4fa99da1c78cfaa53253e55043e5f5d4
SHA1ba8f4be3e782283cc0bacd20eab8a50960bd27a7
SHA256a65554fbc7aded7f05894923c699c17b909f810a0a4ddf60cf053f07a190db85
SHA512146da3fc2ca5825b04ceb398ae8d4e711ca77f6f3be6fb5ae7d35030b300e24d00ea8acbe8db2f5ecaebdaa07e7e3e1a84db595d07d061c1dc30d4291feb697f
-
C:\MiniworldRansom\@RecoveryYourFiles@.exeMD5
4fa99da1c78cfaa53253e55043e5f5d4
SHA1ba8f4be3e782283cc0bacd20eab8a50960bd27a7
SHA256a65554fbc7aded7f05894923c699c17b909f810a0a4ddf60cf053f07a190db85
SHA512146da3fc2ca5825b04ceb398ae8d4e711ca77f6f3be6fb5ae7d35030b300e24d00ea8acbe8db2f5ecaebdaa07e7e3e1a84db595d07d061c1dc30d4291feb697f
-
C:\Users\Admin\AppData\Local\Temp\37A.tmp\37B.tmp\37C.batMD5
7866a5a1582f206546bf8c8c89f74671
SHA1e05c6d1ea5e8f25e61f15150a3c75d25a1cc1e94
SHA256327288a7f22e769ccc62e9b33885872785239d1341166660edd7b727839e67c5
SHA51253dce31e13ff1fbeb4621d89508499787041e34f201d09bb1a66c4f9650eae4cf431da663da8b19ac04f1a7bc4b01c27ce1e1ba36e544515111673a63f3281f3
-
C:\Users\Admin\AppData\Local\Temp\37A.tmp\5HB2.TMPMD5
de756b93882386b7ef059489d1e56ca0
SHA1de7acd75203c104ef7ea3fbc3aa1ebdc72e585e2
SHA256de6d189d084d07e0981df8e4a7956f6019f9e696180de0a4dea29aa4eca42ea0
SHA512c8c2e603c5140043bba22f15f34a3be21a933d4aa39ec79b34813c58023e0ab3172ba1f25da74c54179f3f4ba4fe442b3d1d8684baf15057ef407f81b6f05a57
-
C:\Users\Admin\AppData\Local\Temp\37A.tmp\9M1B.TMPMD5
15f71f76e53975f8276b6736741342f3
SHA1b185723d4b783392dc0229cee1b3d682662cea37
SHA256d455b4adb3367a9f0dc67c1f4ff2371d5495eac4db016fbabe4fe8e3d61b2a06
SHA5124ad2b8f1220188ece7b66f9480f72fd90212ff75bb587d557187b6ed0039bfe7f74f957fc5ca3c5fa88457736eb78a93a64332c3b81e75e624dc777077681e02
-
C:\Users\Admin\AppData\Local\Temp\37A.tmp\miniworld.exeMD5
bae388b46046dbc75bbb71c7cde7d347
SHA12f29c1788b4ec4a50e9c7b165fd40a931950638c
SHA256409607b463d6bdb1feb2be7179cab037e450b1a503694ff8efdeec285c572d58
SHA51224a9863fe782cacd357604e37c32fc1986626d261d5a0f9e37a24cc6111eb6a037c820ba30bd5fd66801f2c1b2f9cb28254f20ef07cea26fda9c9baad569d16b
-
C:\Users\Admin\AppData\Local\Temp\37A.tmp\miniworld.exeMD5
bae388b46046dbc75bbb71c7cde7d347
SHA12f29c1788b4ec4a50e9c7b165fd40a931950638c
SHA256409607b463d6bdb1feb2be7179cab037e450b1a503694ff8efdeec285c572d58
SHA51224a9863fe782cacd357604e37c32fc1986626d261d5a0f9e37a24cc6111eb6a037c820ba30bd5fd66801f2c1b2f9cb28254f20ef07cea26fda9c9baad569d16b
-
C:\Users\Admin\AppData\Local\Temp\7BE.tmp\2Y8U.TMPMD5
a8b1f3a1ff16facab894394044460a67
SHA184807917cd43a75d295340263f34cde7655f90db
SHA256c35eecb5533a63a7f9f0e32ce559f679e7207448f5be5ccbb2c368cd20aeaab1
SHA51247fb76a21cecc65474ccd9c6b355afbb61aa482671a61682b6b2759f995bdaf166b97f6153513e7058beb107a24637254f854d58a34bacca80931558d4bd2425
-
C:\Users\Admin\AppData\Local\Temp\7BE.tmp\3R9J.TMPMD5
4fa99da1c78cfaa53253e55043e5f5d4
SHA1ba8f4be3e782283cc0bacd20eab8a50960bd27a7
SHA256a65554fbc7aded7f05894923c699c17b909f810a0a4ddf60cf053f07a190db85
SHA512146da3fc2ca5825b04ceb398ae8d4e711ca77f6f3be6fb5ae7d35030b300e24d00ea8acbe8db2f5ecaebdaa07e7e3e1a84db595d07d061c1dc30d4291feb697f
-
C:\Users\Admin\AppData\Local\Temp\7BE.tmp\7BF.tmp\7C0.batMD5
e9b7f5e881a2acedaed2ab8a383ae868
SHA1007dd77306674371ac941350e391f76b95d75892
SHA2567f46a26b89ef1c5f291b2b5a389160ff00c072e90e8796a0ccd0818476fa7e43
SHA512bdeb27b48621b5cef41c3c9329ba64c47347d6ee6489177ab2a9ca3a4529bd823f760dcec3d3f030bba517c6accc89d3277c6699a08d32fc33bec6b6e1860acd
-
C:\Users\Admin\AppData\Local\Temp\7BE.tmp\@readme@.txtMD5
d2d51c6d6cc1cdd77ef953437e55086c
SHA12b4d4a9ff45540c137a426ea93d508c8364e1e9e
SHA2566266559ecd24ef4be236373a0b059415d24ad689ad0a60ba7ee0ca0ee99d31b9
SHA512440eb2ebb00a3008bf40d2a1a59ce88ca49db30c9fe8179e0947e5b75d6007678e54fc4c2bd1df6f5dfdc4629e7fa99d0039154b9d0904b8ef142f7e681aa7da
-
C:\Users\Admin\AppData\Local\Temp\7BE.tmp\background.jpgMD5
8caeb0ab9e567bbe2bb1d3a6f8871782
SHA1c7a5522eccaab5c0d435cf32a982c24ec69ceda3
SHA2561fead54464769a95c719c665083cd6022c2f8f85d8b865f5481a7ad09d4c1631
SHA5123d2bb691304c873a8ace9ea8909cd466278487ac2af87fbbb973038e3d0e5bd24e74f85ef7158c1f44290ac21e52ad1ed3bfa1fa061c9fda0165f085c7880619
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp\D3B.tmp\D3C.batMD5
3f8ac701a1bdb8ce5a89f49c3071aff4
SHA184e76f63cf9f91495a5e7eb9220f10c51e4d828f
SHA2562354202cdaf8d417b682ba1440e84f0aea6495fa4268fb306647a2ea22df9d56
SHA5121a884548f1fb52d770ee2e1d88282bbc81a0bdbd67087e401efc7ede3afd3f3bc7424100a1e21cd718930d06671af3fe7a51e8812309846a6c9d2b3b49894045
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\4399ÃÔÄãÊÀ½ç\minigame.lnkMD5
32749ea5695322becde0a977963d6e33
SHA1c1427991f46b88caf12c1f9e3c9e16cf170404f8
SHA256905d572b4312971eecd4ed538ab2727a2387099c05a34dc5b3bd94569a70f6cf
SHA512322910b2501a1e5ac0d89072306185372d80d2dbaa15c27859b35fec221241052de93250d993e43dcf154b1ccedf07663dc379abe649ba373a5983e57b82ddda
-
C:\Users\Admin\AppData\Roaming\miniworldcfg\9M1B.TMPMD5
15f71f76e53975f8276b6736741342f3
SHA1b185723d4b783392dc0229cee1b3d682662cea37
SHA256d455b4adb3367a9f0dc67c1f4ff2371d5495eac4db016fbabe4fe8e3d61b2a06
SHA5124ad2b8f1220188ece7b66f9480f72fd90212ff75bb587d557187b6ed0039bfe7f74f957fc5ca3c5fa88457736eb78a93a64332c3b81e75e624dc777077681e02
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\MicroMiniNew.exeMD5
0ad083f1ab7f60a008b32b061585cd30
SHA1d793b1c480dd34ed8cf5614df04980e1675476d1
SHA256b02107806809c0a7cdf58dc12269e3d7490f29bb1f0e1e98bb09c33fe05ec515
SHA512cc0a12c8ad1fe800247f8de15fca1cd1001a8c08186e35fb2096cd55f25c8d8f9510fce073538a3423b5f4959881c677c7de3273cca861567d01e2829167adaa
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\MicroMiniNew.exeMD5
0ad083f1ab7f60a008b32b061585cd30
SHA1d793b1c480dd34ed8cf5614df04980e1675476d1
SHA256b02107806809c0a7cdf58dc12269e3d7490f29bb1f0e1e98bb09c33fe05ec515
SHA512cc0a12c8ad1fe800247f8de15fca1cd1001a8c08186e35fb2096cd55f25c8d8f9510fce073538a3423b5f4959881c677c7de3273cca861567d01e2829167adaa
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\configbase.iniMD5
ce5a8f0dee9325fb9fdacc3414ee6f7d
SHA18ee29de24d1da1b38d280585af2bb4bd6055ff9e
SHA256624cccda01537346133fd1c582854b40662e106c1da9f28c00d59fe5fb1a2177
SHA512fe75c935a3275d61aaa9d00e01746f0b64825c4e717eb26c1125202c1a85b2a780d86e937427fe80652b1a3afc3f6a45136340cf56327c110b4d9c82b327e74a
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\configload.iniMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\iworld.cfgMD5
be9daf97fdd47f20ad2bee8204af3a77
SHA1972d17598b7ee2e3831bdc1d631f9df0379320df
SHA2565b6d8ddac6b84d99d9fec6e752a4f10211504469eacf1d3fcccf66d72960a1a4
SHA512a3d075902ae741beb4072c0bd8a5436381770b3f016ff35bc627437ce746d24b097ff54225455975c4bd7995d50be47e6fde5fcdcae1c446ac2e6862951cb139
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\miniworld.icoMD5
4f4d64d85a5de8dbd878eb500f382c24
SHA1b7c5bd63219f1064dc3a89962583932cd2c814b8
SHA25679190dbfb16e0db887cc9242ee926ba4ece5917ca95d661ef899969cd980fe7b
SHA512384d5d31ae1e7c2c143975da066e7662e0eeb3853472607be3bcf5a2571c4fb9569e84aaffa51b06870763177ee6dfb7a8c76b494307982fd1884e67985050e3
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\pluginres\min_d.pngMD5
f5fc331014a665ad411853230edee24d
SHA15f68ee4a608dbb93814a2f0b19e5decac8f7a66f
SHA256eefe5954750f6581d2565f997c91e217e015feb94d6cc6afb5a1cd3274ae7f4f
SHA51235d7f2b9213b17504cd4f5c90407c48d0d7a4188ab89cf728f93555eb003ba233b64d64e3fcae85bf6a14bb0231957deb8bc3f6759b310028b74406449623a2c
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\pluginres\min_n.pngMD5
4aa66ddc1d6b29451572cf87a4266b3d
SHA1216cf850cf161b908ccd9353fa8b64a0c65c57d5
SHA256296d3d4ca8370140c2a1076d75fe9ea212c8f5d4fa9b19c595f348fcebba9527
SHA51207db33f69a3de9a9a67b9e43ce9bf6310b662e1256d10c759e1bb0fe7fbbeafde4956ffda5ac78fda5f8d459f0895fa658d11af964421c616362ec405c5067f7
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\pluginres\min_o.pngMD5
a74c17afe0499a91fc330cc9ac87e806
SHA1d2f374c1737edd4d80c51d2e6185ac4e94560327
SHA256626fa01e5a7d8c03cd1611304480765fff7d6c21e505b2fd9f165f5d919329be
SHA5125c65605800bd1faefe7b67c810582ecea723742bfc3ebb498e046a96db383e7e26358ac0985b845a7ddac7dc5ef03bd480297f66e36e21216be369496789481a
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\pluginres\progress.pngMD5
ed625e96d3b25264b479c9aac6f5d05c
SHA19a724ddf49b3112e58df6d96e00f0b645698535d
SHA256ec9e8f05b87d8a886a329ff6167e56d411ae0effc30fe376e0a1ce929d80c3eb
SHA5120bf3e9a76b7bcb91291720456d76a0342c26ff1ad060b3d53b14ea15d0c4affb103ddf97d95c0c95efbf4f9d72bc43ecd2e7b79fb05374d1a80fdc202b268014
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\pluginres\progressBk.pngMD5
ca240697cb1c9812162e418dec891060
SHA1591e4b63bdf84b1f110509bf4f25426a790b6081
SHA256693621b6c27b406e9d72f570bde86948ba0555b843df5c91045178e7ed1b0b4d
SHA512245a9d42c87909633e4eda535288a9c5d1443e15eca63dbdaa8229c1dca70240a782b16367ead2682fd9f54619301876eb66e649c3c731ef3ce60728e57ea682
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\pluginres\quit_d.pngMD5
1d1b1ebe64bb941cb4e0271f49dfaa85
SHA127d2c5a125691e5c2283d3f7183769edba84b2f5
SHA2563f8cfe42591c5e62e2912bb9dc3fba59aebbf41cff4a39b799ba1bae71bf5386
SHA5124afc5f71b5297adc91614d325496a2cc049970df56db3d7f257f5dce9c8d1e4da802bf8ff098eebc5f897d038e09bbcd232b7cecc7ae5c7c4528d9bcc1f5afb1
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\pluginres\quit_n.pngMD5
344e680ba78618cfe32aa47809327636
SHA1319d83047b7b0234049c3fd3d2ec47265c0785a6
SHA25601be4079f7b15cc97033f74908663fd10f5d1562452541690a0f30e66bf8482a
SHA512d852fa9d19a0ec55a1e0dc2fd9aea0fcb4085a567ddf47b22295e795321662ff3edd38f562f2c8af6facc77dd8bf8e0e11724c1f9e5fc24b286642d58994f676
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\pluginres\quit_o.pngMD5
2742e08c12a45ddbe9b0b0822216c378
SHA19a078511c4dd05a92ed95f6a90c0d7e4e58d5400
SHA256ae18079d9fb79f3ba83cd1fed72c09e9e3940a9aab2e9a167daeba0eda049fb3
SHA512738de9afcd49d332fb0c107adf9236cad575ccfa54c505978c2fd62ebd8a81ff62b515060b64641746b51ab1aaaa057b9603d02fb1940ceafad9f0b168b51aef
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\pluginres\start.pngMD5
12c6368cb25e4e407002cd652223792c
SHA136bb70ca245512d6c3e09c8fcf46adf86dc1b983
SHA256be537cc3adb595d8739f01049e05f5636f52057591ace371101ecc4141b7d270
SHA512541339b7ddcecc52d064ea8ea1113f84b1332a3b287ac6826e9bae049ae20a98e97d9a9c553d8a44d3610b9fd53f080665e2cfb8d599d0577a50eae07ff1637b
-
C:\Users\Admin\AppData\Roaming\miniworldgame4399\start.mnwMD5
16fa73eb3867b9dd16194ae843c65ca3
SHA194abe7de3ab4e1fcf91646fb1e206b92e1058d87
SHA25634afe6c9f1455b6d580a4d0365d7397ab7c0ca2fd7f974df3a9aad969c2158e4
SHA5123805097122581e8b82de793870cb461732ce76eec061411dde8d9da300fdcf9c9d22072ea33f255d8306d16fd89f27b042f225b16538d339dca1127c59fafdd0
-
C:\Users\Admin\desktop\4399ÃÔÄãÊÀ½ç.lnkMD5
415c3a064be1b98f002099cd5e46e624
SHA1cf03c1bad6e9bbfce9d1cab81a0c2fe779a44a95
SHA2562356c6c7d4c8383c8ed1b8337118fd0b0efd9043979d64c97c1aa9273e223f0f
SHA5125af2fb3a4fb4dd423305a24e7c3b81b612c71fffd32c75dc6b10081bed1c07f35bd813d0be2bc70cbf443756246bb2e14b2e84e7738a1c3e22f495d4d7b83562
-
C:\Users\Public\Desktop\@RecoveryYourFiles@.exeMD5
4fa99da1c78cfaa53253e55043e5f5d4
SHA1ba8f4be3e782283cc0bacd20eab8a50960bd27a7
SHA256a65554fbc7aded7f05894923c699c17b909f810a0a4ddf60cf053f07a190db85
SHA512146da3fc2ca5825b04ceb398ae8d4e711ca77f6f3be6fb5ae7d35030b300e24d00ea8acbe8db2f5ecaebdaa07e7e3e1a84db595d07d061c1dc30d4291feb697f
-
C:\Users\Public\Desktop\@readme@.txtMD5
d2d51c6d6cc1cdd77ef953437e55086c
SHA12b4d4a9ff45540c137a426ea93d508c8364e1e9e
SHA2566266559ecd24ef4be236373a0b059415d24ad689ad0a60ba7ee0ca0ee99d31b9
SHA512440eb2ebb00a3008bf40d2a1a59ce88ca49db30c9fe8179e0947e5b75d6007678e54fc4c2bd1df6f5dfdc4629e7fa99d0039154b9d0904b8ef142f7e681aa7da
-
C:\Windows\System32\mstray.exeMD5
a8b1f3a1ff16facab894394044460a67
SHA184807917cd43a75d295340263f34cde7655f90db
SHA256c35eecb5533a63a7f9f0e32ce559f679e7207448f5be5ccbb2c368cd20aeaab1
SHA51247fb76a21cecc65474ccd9c6b355afbb61aa482671a61682b6b2759f995bdaf166b97f6153513e7058beb107a24637254f854d58a34bacca80931558d4bd2425
-
\Users\Admin\AppData\Roaming\miniworldgame4399\MicroMiniNew.exeMD5
0ad083f1ab7f60a008b32b061585cd30
SHA1d793b1c480dd34ed8cf5614df04980e1675476d1
SHA256b02107806809c0a7cdf58dc12269e3d7490f29bb1f0e1e98bb09c33fe05ec515
SHA512cc0a12c8ad1fe800247f8de15fca1cd1001a8c08186e35fb2096cd55f25c8d8f9510fce073538a3423b5f4959881c677c7de3273cca861567d01e2829167adaa
-
\Users\Admin\AppData\Roaming\miniworldgame4399\MicroMiniNew.exeMD5
0ad083f1ab7f60a008b32b061585cd30
SHA1d793b1c480dd34ed8cf5614df04980e1675476d1
SHA256b02107806809c0a7cdf58dc12269e3d7490f29bb1f0e1e98bb09c33fe05ec515
SHA512cc0a12c8ad1fe800247f8de15fca1cd1001a8c08186e35fb2096cd55f25c8d8f9510fce073538a3423b5f4959881c677c7de3273cca861567d01e2829167adaa
-
\Users\Admin\AppData\Roaming\miniworldgame4399\MicroMiniNew.exeMD5
0ad083f1ab7f60a008b32b061585cd30
SHA1d793b1c480dd34ed8cf5614df04980e1675476d1
SHA256b02107806809c0a7cdf58dc12269e3d7490f29bb1f0e1e98bb09c33fe05ec515
SHA512cc0a12c8ad1fe800247f8de15fca1cd1001a8c08186e35fb2096cd55f25c8d8f9510fce073538a3423b5f4959881c677c7de3273cca861567d01e2829167adaa
-
\Users\Admin\AppData\Roaming\miniworldgame4399\start.mnwMD5
16fa73eb3867b9dd16194ae843c65ca3
SHA194abe7de3ab4e1fcf91646fb1e206b92e1058d87
SHA25634afe6c9f1455b6d580a4d0365d7397ab7c0ca2fd7f974df3a9aad969c2158e4
SHA5123805097122581e8b82de793870cb461732ce76eec061411dde8d9da300fdcf9c9d22072ea33f255d8306d16fd89f27b042f225b16538d339dca1127c59fafdd0
-
memory/576-102-0x0000000000000000-mapping.dmp
-
memory/772-122-0x0000000000000000-mapping.dmp
-
memory/772-141-0x00000000043B0000-0x00000000043ED000-memory.dmpFilesize
244KB
-
memory/772-125-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/836-109-0x0000000000000000-mapping.dmp
-
memory/880-110-0x0000000000000000-mapping.dmp
-
memory/1080-129-0x0000000000000000-mapping.dmp
-
memory/1216-73-0x0000000000000000-mapping.dmp
-
memory/1296-111-0x0000000000000000-mapping.dmp
-
memory/1304-142-0x0000000000000000-mapping.dmp
-
memory/1344-121-0x0000000000000000-mapping.dmp
-
memory/1344-145-0x0000000000000000-mapping.dmp
-
memory/1356-112-0x0000000000000000-mapping.dmp
-
memory/1356-133-0x0000000000000000-mapping.dmp
-
memory/1376-120-0x0000000000000000-mapping.dmp
-
memory/1400-127-0x0000000000000000-mapping.dmp
-
memory/1544-76-0x0000000000000000-mapping.dmp
-
memory/1592-104-0x0000000000000000-mapping.dmp
-
memory/1596-105-0x0000000000000000-mapping.dmp
-
memory/1680-107-0x0000000000000000-mapping.dmp
-
memory/1684-106-0x0000000000000000-mapping.dmp
-
memory/1692-101-0x0000000000000000-mapping.dmp
-
memory/1700-99-0x0000000000000000-mapping.dmp
-
memory/1700-65-0x0000000000000000-mapping.dmp
-
memory/1720-67-0x0000000000000000-mapping.dmp
-
memory/1724-115-0x0000000000000000-mapping.dmp
-
memory/1728-134-0x0000000000000000-mapping.dmp
-
memory/1768-135-0x0000000000000000-mapping.dmp
-
memory/1768-114-0x0000000000000000-mapping.dmp
-
memory/1780-108-0x0000000000000000-mapping.dmp
-
memory/1812-103-0x0000000000000000-mapping.dmp
-
memory/1820-98-0x0000000000000000-mapping.dmp
-
memory/1832-100-0x0000000000000000-mapping.dmp
-
memory/1856-123-0x0000000000000000-mapping.dmp
-
memory/1880-144-0x0000000000000000-mapping.dmp
-
memory/1884-143-0x0000000000000000-mapping.dmp
-
memory/1888-93-0x0000000000000000-mapping.dmp
-
memory/1892-139-0x0000000000000000-mapping.dmp
-
memory/1908-137-0x0000000000000000-mapping.dmp
-
memory/1984-61-0x0000000000000000-mapping.dmp
-
memory/2000-96-0x0000000000000000-mapping.dmp
-
memory/2004-60-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB