08b82e2125b63ec97ed8fb9cbf829ca31935b8dfa2f67be4d686353570554281

Analysis

max time kernel
139s
max time network
103s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21-11-2022 00:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0v3yT8.06.10.exe
Size

2.4MB
MD5

3fcf77ffa0763350a1df45ab3b89f26a
SHA1

0431c506fb86f1813621bc0d09ba12389021cc6b
SHA256

08b82e2125b63ec97ed8fb9cbf829ca31935b8dfa2f67be4d686353570554281
SHA512

07568d02a3cddf5285cf3ea7ab4bc05fb3cc0739b4bd59c75bdf60f0950a52e4ecc2168f53d5f41031271716ecc8babd164e42007c1cdf9ba00e55124232b842
SSDEEP

49152:wgwREifu1DBgutBPNbPz0F3SMzx5QPdqGbHpIAxKof9X7PID/n3ZkIe:wgwREvguPPxzsfTe8GbHjkofeD/n2z

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

DC.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3" DC.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3"	DC.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

system86.exe0v3yT8.06.10.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	system86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	system86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell	0v3yT8.06.10.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	system86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open	0v3yT8.06.10.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

system86.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system86.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1664 bcdedit.exe
1784 bcdedit.exe
Deletes System State backups 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

684 wbadmin.exe
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exe

pid process

1708 wbadmin.exe

pid	process
1664	bcdedit.exe
1784	bcdedit.exe

pid	process
684	wbadmin.exe

pid	process
1708	wbadmin.exe

Executes dropped EXE 10 IoCs

Processes:

7za.exe7za.exe0v3yT8.06.10.exesystem86.exeDC.exesystem86.exesystem86.exesystem86.exeEverything.exeEverything.exe

pid	process
1720	7za.exe
1552	7za.exe
2032	0v3yT8.06.10.exe
1012	system86.exe
1544	DC.exe
1440	system86.exe
1852	system86.exe
1316	system86.exe
1220	Everything.exe
364	Everything.exe

Modifies extensions of user files 4 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

system86.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\FindHide.raw => C:\Users\Admin\Pictures\FindHide.raw.0v3yT8	system86.exe
File opened for modification	C:\Users\Admin\Pictures\FindHide.raw.0v3yT8	system86.exe
File renamed	C:\Users\Admin\Pictures\CompareEnable.png => C:\Users\Admin\Pictures\CompareEnable.png.0v3yT8	system86.exe
File opened for modification	C:\Users\Admin\Pictures\CompareEnable.png.0v3yT8	system86.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

system86.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	system86.exe

Loads dropped DLL 15 IoCs

Processes:

0v3yT8.06.10.exe0v3yT8.06.10.exesystem86.execmd.exesystem86.exesystem86.exesystem86.exe

pid	process
1404	0v3yT8.06.10.exe
1404	0v3yT8.06.10.exe
1404	0v3yT8.06.10.exe
2032	0v3yT8.06.10.exe
2032	0v3yT8.06.10.exe
1012	system86.exe
836	cmd.exe
1440	system86.exe
1852	system86.exe
1316	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

DC.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection DC.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	DC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0v3yT8.06.10.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	0v3yT8.06.10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system86 = "\"C:\\Users\\Admin\\AppData\\Local\\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\\system86.exe\" "	0v3yT8.06.10.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

system86.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system86.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system86.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

system86.exeEverything.exeEverything.exe

description	ioc	process
File opened (read-only)	\??\E:	system86.exe
File opened (read-only)	\??\F:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\B:	system86.exe
File opened (read-only)	\??\G:	system86.exe
File opened (read-only)	\??\Z:	system86.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\J:	system86.exe
File opened (read-only)	\??\O:	system86.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\W:	system86.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\L:	system86.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\P:	system86.exe
File opened (read-only)	\??\Q:	system86.exe
File opened (read-only)	\??\X:	system86.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\F:	Everything.exe
File opened (read-only)	\??\I:	system86.exe
File opened (read-only)	\??\M:	system86.exe
File opened (read-only)	\??\R:	system86.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\S:	system86.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\F:	system86.exe
File opened (read-only)	\??\K:	system86.exe
File opened (read-only)	\??\V:	system86.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\A:	system86.exe
File opened (read-only)	\??\H:	system86.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe

Drops file in System32 directory 2 IoCs

Processes:

DC.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	DC.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	DC.exe

Drops file in Windows directory 3 IoCs

Processes:

wbadmin.exe

description	ioc	process
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	wbadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 19 IoCs

Processes:

system86.exe0v3yT8.06.10.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	system86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile	0v3yT8.06.10.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	system86.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command	system86.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell	0v3yT8.06.10.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\How-to-decrypt.txt\""	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	0v3yT8.06.10.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open	0v3yT8.06.10.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	system86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	system86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.0v3yT8	system86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.0v3yT8\ = "mimicfile"	system86.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	0v3yT8.06.10.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

DC.exesystem86.exesystem86.exesystem86.exepowershell.exepowershell.exepowershell.exe

pid	process
1544	DC.exe
1544	DC.exe
1544	DC.exe
1544	DC.exe
1852	system86.exe
1316	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
1012	system86.exe
932	powershell.exe
1284	powershell.exe
1600	powershell.exe
1012	system86.exe
1012	system86.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7za.exe7za.exe0v3yT8.06.10.exesystem86.exeDC.exesystem86.exe

description	pid	process
Token: SeRestorePrivilege	1720	7za.exe
Token: 35	1720	7za.exe
Token: SeRestorePrivilege	1552	7za.exe
Token: 35	1552	7za.exe
Token: SeSecurityPrivilege	1552	7za.exe
Token: SeSecurityPrivilege	1552	7za.exe
Token: SeIncreaseQuotaPrivilege	2032	0v3yT8.06.10.exe
Token: SeSecurityPrivilege	2032	0v3yT8.06.10.exe
Token: SeTakeOwnershipPrivilege	2032	0v3yT8.06.10.exe
Token: SeLoadDriverPrivilege	2032	0v3yT8.06.10.exe
Token: SeSystemProfilePrivilege	2032	0v3yT8.06.10.exe
Token: SeSystemtimePrivilege	2032	0v3yT8.06.10.exe
Token: SeProfSingleProcessPrivilege	2032	0v3yT8.06.10.exe
Token: SeIncBasePriorityPrivilege	2032	0v3yT8.06.10.exe
Token: SeCreatePagefilePrivilege	2032	0v3yT8.06.10.exe
Token: SeBackupPrivilege	2032	0v3yT8.06.10.exe
Token: SeRestorePrivilege	2032	0v3yT8.06.10.exe
Token: SeShutdownPrivilege	2032	0v3yT8.06.10.exe
Token: SeDebugPrivilege	2032	0v3yT8.06.10.exe
Token: SeSystemEnvironmentPrivilege	2032	0v3yT8.06.10.exe
Token: SeChangeNotifyPrivilege	2032	0v3yT8.06.10.exe
Token: SeRemoteShutdownPrivilege	2032	0v3yT8.06.10.exe
Token: SeUndockPrivilege	2032	0v3yT8.06.10.exe
Token: SeManageVolumePrivilege	2032	0v3yT8.06.10.exe
Token: SeImpersonatePrivilege	2032	0v3yT8.06.10.exe
Token: SeCreateGlobalPrivilege	2032	0v3yT8.06.10.exe
Token: 33	2032	0v3yT8.06.10.exe
Token: 34	2032	0v3yT8.06.10.exe
Token: 35	2032	0v3yT8.06.10.exe
Token: SeIncreaseQuotaPrivilege	1012	system86.exe
Token: SeSecurityPrivilege	1012	system86.exe
Token: SeTakeOwnershipPrivilege	1012	system86.exe
Token: SeLoadDriverPrivilege	1012	system86.exe
Token: SeSystemProfilePrivilege	1012	system86.exe
Token: SeSystemtimePrivilege	1012	system86.exe
Token: SeProfSingleProcessPrivilege	1012	system86.exe
Token: SeIncBasePriorityPrivilege	1012	system86.exe
Token: SeCreatePagefilePrivilege	1012	system86.exe
Token: SeBackupPrivilege	1012	system86.exe
Token: SeRestorePrivilege	1012	system86.exe
Token: SeShutdownPrivilege	1012	system86.exe
Token: SeDebugPrivilege	1012	system86.exe
Token: SeSystemEnvironmentPrivilege	1012	system86.exe
Token: SeChangeNotifyPrivilege	1012	system86.exe
Token: SeRemoteShutdownPrivilege	1012	system86.exe
Token: SeUndockPrivilege	1012	system86.exe
Token: SeManageVolumePrivilege	1012	system86.exe
Token: SeImpersonatePrivilege	1012	system86.exe
Token: SeCreateGlobalPrivilege	1012	system86.exe
Token: 33	1012	system86.exe
Token: 34	1012	system86.exe
Token: 35	1012	system86.exe
Token: SeDebugPrivilege	1544	DC.exe
Token: SeAssignPrimaryTokenPrivilege	1544	DC.exe
Token: SeIncreaseQuotaPrivilege	1544	DC.exe
Token: 0	1544	DC.exe
Token: SeIncreaseQuotaPrivilege	1440	system86.exe
Token: SeSecurityPrivilege	1440	system86.exe
Token: SeTakeOwnershipPrivilege	1440	system86.exe
Token: SeLoadDriverPrivilege	1440	system86.exe
Token: SeSystemProfilePrivilege	1440	system86.exe
Token: SeSystemtimePrivilege	1440	system86.exe
Token: SeProfSingleProcessPrivilege	1440	system86.exe
Token: SeIncBasePriorityPrivilege	1440	system86.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Everything.exeEverything.exe

pid process

1220 Everything.exe
364 Everything.exe

pid	process
1220	Everything.exe
364	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0v3yT8.06.10.exe0v3yT8.06.10.exesystem86.execmd.exe

description	pid	process	target process
PID 1404 wrote to memory of 1720	1404	0v3yT8.06.10.exe	7za.exe
PID 1404 wrote to memory of 1720	1404	0v3yT8.06.10.exe	7za.exe
PID 1404 wrote to memory of 1720	1404	0v3yT8.06.10.exe	7za.exe
PID 1404 wrote to memory of 1720	1404	0v3yT8.06.10.exe	7za.exe
PID 1404 wrote to memory of 1552	1404	0v3yT8.06.10.exe	7za.exe
PID 1404 wrote to memory of 1552	1404	0v3yT8.06.10.exe	7za.exe
PID 1404 wrote to memory of 1552	1404	0v3yT8.06.10.exe	7za.exe
PID 1404 wrote to memory of 1552	1404	0v3yT8.06.10.exe	7za.exe
PID 1404 wrote to memory of 2032	1404	0v3yT8.06.10.exe	0v3yT8.06.10.exe
PID 1404 wrote to memory of 2032	1404	0v3yT8.06.10.exe	0v3yT8.06.10.exe
PID 1404 wrote to memory of 2032	1404	0v3yT8.06.10.exe	0v3yT8.06.10.exe
PID 1404 wrote to memory of 2032	1404	0v3yT8.06.10.exe	0v3yT8.06.10.exe
PID 2032 wrote to memory of 1012	2032	0v3yT8.06.10.exe	system86.exe
PID 2032 wrote to memory of 1012	2032	0v3yT8.06.10.exe	system86.exe
PID 2032 wrote to memory of 1012	2032	0v3yT8.06.10.exe	system86.exe
PID 2032 wrote to memory of 1012	2032	0v3yT8.06.10.exe	system86.exe
PID 1012 wrote to memory of 836	1012	system86.exe	cmd.exe
PID 1012 wrote to memory of 836	1012	system86.exe	cmd.exe
PID 1012 wrote to memory of 836	1012	system86.exe	cmd.exe
PID 1012 wrote to memory of 836	1012	system86.exe	cmd.exe
PID 836 wrote to memory of 1544	836	cmd.exe	DC.exe
PID 836 wrote to memory of 1544	836	cmd.exe	DC.exe
PID 836 wrote to memory of 1544	836	cmd.exe	DC.exe
PID 836 wrote to memory of 1544	836	cmd.exe	DC.exe
PID 1012 wrote to memory of 1440	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1440	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1440	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1440	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1852	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1852	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1852	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1852	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1316	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1316	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1316	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1316	1012	system86.exe	system86.exe
PID 1012 wrote to memory of 1220	1012	system86.exe	Everything.exe
PID 1012 wrote to memory of 1220	1012	system86.exe	Everything.exe
PID 1012 wrote to memory of 1220	1012	system86.exe	Everything.exe
PID 1012 wrote to memory of 1220	1012	system86.exe	Everything.exe
PID 1012 wrote to memory of 280	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 280	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 280	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 280	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 328	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 328	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 328	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 328	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 848	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 848	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 848	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 848	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 1816	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 1816	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 1816	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 1816	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 1332	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 1332	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 1332	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 1332	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 976	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 976	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 976	1012	system86.exe	powercfg.exe
PID 1012 wrote to memory of 976	1012	system86.exe	powercfg.exe

System policy modification 1 TTPs 11 IoCs

evasion

Modify Registry

T1112

Processes:

system86.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	system86.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	system86.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	system86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	system86.exe

C:\Users\Admin\AppData\Local\Temp\0v3yT8.06.10.exe
"C:\Users\Admin\AppData\Local\Temp\0v3yT8.06.10.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p933916544411611201 Everything64.dll
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1552

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe
"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe"
2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"
3⤵
- Modifies system executable filetype association
- UAC bypass
- Executes dropped EXE
- Modifies extensions of user files
- Sets file execution options in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c DC.exe /D
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:836

C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\DC.exe
DC.exe /D
5⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e watch -pid 1012 -!
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e ul1
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1852

C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e ul2
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1316

C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe" -startup
4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:1220

C:\Windows\system32\powercfg.exe
powercfg.exe -H off
4⤵
PID:280

C:\Windows\system32\powercfg.exe
powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
4⤵
PID:328

C:\Windows\system32\powercfg.exe
powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
4⤵
PID:848

C:\Windows\system32\powercfg.exe
powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
4⤵
PID:1816

C:\Windows\system32\powercfg.exe
powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
4⤵
PID:1332

C:\Windows\system32\powercfg.exe
powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
4⤵
PID:976

C:\Windows\system32\powercfg.exe
powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
4⤵
PID:776

C:\Windows\system32\powercfg.exe
powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
4⤵
PID:800

C:\Windows\system32\powercfg.exe
powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
4⤵
PID:536

C:\Windows\system32\powercfg.exe
powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
4⤵
PID:520

C:\Windows\system32\powercfg.exe
powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
4⤵
PID:1808

C:\Windows\system32\powercfg.exe
powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
4⤵
PID:1752

C:\Windows\system32\powercfg.exe
powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
4⤵
PID:1992

C:\Windows\system32\powercfg.exe
powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
4⤵
PID:1928

C:\Windows\system32\powercfg.exe
powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
4⤵
PID:556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1600

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:1664

C:\Windows\system32\bcdedit.exe
bcdedit.exe /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:1784

C:\Windows\system32\wbadmin.exe
wbadmin.exe DELETE SYSTEMSTATEBACKUP
4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:684

C:\Windows\system32\wbadmin.exe
wbadmin.exe delete catalog -quiet
4⤵
- Deletes backup catalog
PID:1708

C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe" -startup
4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:364

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:588

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1748

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:1456

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1144

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

T1112

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe
Filesize
2.0MB

MD5
6d081da0c4ea3eff0e18d414047bb5fd

SHA1
992fca17ad2fe4a6523c3858c87b0e5203628032

SHA256
a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e

SHA512
12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe
Filesize
2.0MB

MD5
6d081da0c4ea3eff0e18d414047bb5fd

SHA1
992fca17ad2fe4a6523c3858c87b0e5203628032

SHA256
a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e

SHA512
12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe
Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini
Filesize
548B

MD5
742c2400f2de964d0cce4a8dabadd708

SHA1
c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

SHA256
2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

SHA512
63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini
Filesize
550B

MD5
51014c0c06acdd80f9ae4469e7d30a9e

SHA1
204e6a57c44242fad874377851b13099dfe60176

SHA256
89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

SHA512
79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
Filesize
1.5MB

MD5
c73353f0e0abf5ca18a10a268aefdb68

SHA1
36887b5890bbd753f9556476ddb376208fe195fb

SHA256
1e077fc068b060e4356876e29ce01fd63598f1579a841336f4a30f73eda1f328

SHA512
212546b076b59867ecf67b4cb060789b23ec9c167d0f0b311581ce272bb261cb4f8d8540fae3311fd3059906464214defb3cb3415fcf4769bfbe4e6bbaf4ad63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel.exe
Filesize
350KB

MD5
803df907d936e08fbbd06020c411be93

SHA1
4aa4b498ae037a2b0479659374a5c3af5f6b8d97

SHA256
e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

SHA512
5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel64.exe
Filesize
448KB

MD5
e2114b1627889b250c7fd0425ba1bd54

SHA1
97412dba3cbeb0125c71b7b2ab194ea2fdff51b2

SHA256
5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60

SHA512
76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\session.tmp
Filesize
32B

MD5
e8cb764dda43cde825b772148a9005f5

SHA1
7634d3686bc531e8e382a59493024916cdac3c28

SHA256
160211a63ccba5381d6f68ef7e49a1dbb3a7c53df4a61fb3d2cbd7b2b011f97f

SHA512
ebe6c5f4a6f70cc7bceba30ddbdb2adde53c0a83bc3342ec96cdf722440fba1f8b49bc4d3257c281e9a2cd2f6ea4b87a15f4c0d881be77572187af9307688926

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\7za.exe
Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\DC.exe
Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\DC.exe
Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.db
Filesize
9.2MB

MD5
4f06d9a9fb8b4769ec5862e4c2897f1f

SHA1
2544998dc1f0844b63491755b50a6d9c408d5bb4

SHA256
a8f6d013035ae4afbe7117a494bcaf0fab3a34870ad1bd7251467d568817b1b4

SHA512
7bafd602ad043a985e0733edfedb8c58dfc0941af232ef30f1498b2231a7fab3b90b9bb10a03e11503090ea48e2fc525d3688103fb639a9761760f815a3c792f

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.ini
Filesize
20KB

MD5
df912a7ee93f69c084e7da25da83cb4d

SHA1
1eacb5984364272cf64fe8a163a48b248376021c

SHA256
6ac2d94d89b25f49e02d7f4627b11b51b253b29c2e8a144ffd77498433203c27

SHA512
4dc3eae0a8e86b4455ed919526cdd8b2dc2b2c846cac739dbb95b4930924dc8143e7a21864db3fa902c492d273ce5b4c3ff26bb617549d8c8055756dffd4f56b

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.ini
Filesize
548B

MD5
742c2400f2de964d0cce4a8dabadd708

SHA1
c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

SHA256
2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

SHA512
63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything2.ini
Filesize
550B

MD5
51014c0c06acdd80f9ae4469e7d30a9e

SHA1
204e6a57c44242fad874377851b13099dfe60176

SHA256
89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

SHA512
79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything64.dll
Filesize
1.5MB

MD5
c73353f0e0abf5ca18a10a268aefdb68

SHA1
36887b5890bbd753f9556476ddb376208fe195fb

SHA256
1e077fc068b060e4356876e29ce01fd63598f1579a841336f4a30f73eda1f328

SHA512
212546b076b59867ecf67b4cb060789b23ec9c167d0f0b311581ce272bb261cb4f8d8540fae3311fd3059906464214defb3cb3415fcf4769bfbe4e6bbaf4ad63

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\sdel.exe
Filesize
350KB

MD5
803df907d936e08fbbd06020c411be93

SHA1
4aa4b498ae037a2b0479659374a5c3af5f6b8d97

SHA256
e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

SHA512
5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\sdel64.exe
Filesize
448KB

MD5
e2114b1627889b250c7fd0425ba1bd54

SHA1
97412dba3cbeb0125c71b7b2ab194ea2fdff51b2

SHA256
5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60

SHA512
76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\session.tmp
Filesize
32B

MD5
e8cb764dda43cde825b772148a9005f5

SHA1
7634d3686bc531e8e382a59493024916cdac3c28

SHA256
160211a63ccba5381d6f68ef7e49a1dbb3a7c53df4a61fb3d2cbd7b2b011f97f

SHA512
ebe6c5f4a6f70cc7bceba30ddbdb2adde53c0a83bc3342ec96cdf722440fba1f8b49bc4d3257c281e9a2cd2f6ea4b87a15f4c0d881be77572187af9307688926

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
Filesize
2.0MB

MD5
6d081da0c4ea3eff0e18d414047bb5fd

SHA1
992fca17ad2fe4a6523c3858c87b0e5203628032

SHA256
a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e

SHA512
12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
Filesize
2.0MB

MD5
6d081da0c4ea3eff0e18d414047bb5fd

SHA1
992fca17ad2fe4a6523c3858c87b0e5203628032

SHA256
a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e

SHA512
12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
Filesize
2.0MB

MD5
6d081da0c4ea3eff0e18d414047bb5fd

SHA1
992fca17ad2fe4a6523c3858c87b0e5203628032

SHA256
a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e

SHA512
12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
Filesize
2.0MB

MD5
6d081da0c4ea3eff0e18d414047bb5fd

SHA1
992fca17ad2fe4a6523c3858c87b0e5203628032

SHA256
a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e

SHA512
12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7

Download Submit
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
Filesize
2.0MB

MD5
6d081da0c4ea3eff0e18d414047bb5fd

SHA1
992fca17ad2fe4a6523c3858c87b0e5203628032

SHA256
a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e

SHA512
12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
b144f14fd00dbe6ef9f5043ba18d3bc6

SHA1
4a8346fe557a4286c29d78621ddc4ac9b0d5ed81

SHA256
53a6faa6c196bf44d94031e58879410ee7ae485ac1e8f3e84dd77d6290da2482

SHA512
f4badf14042bd0d61c6621eb967ffd59e4b9a762aa02fe3de9a269138323b3491cbdc43bc5540335372985505785861d28075c5fb9e0990e82fb6330431b46a2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
b144f14fd00dbe6ef9f5043ba18d3bc6

SHA1
4a8346fe557a4286c29d78621ddc4ac9b0d5ed81

SHA256
53a6faa6c196bf44d94031e58879410ee7ae485ac1e8f3e84dd77d6290da2482

SHA512
f4badf14042bd0d61c6621eb967ffd59e4b9a762aa02fe3de9a269138323b3491cbdc43bc5540335372985505785861d28075c5fb9e0990e82fb6330431b46a2

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe
Filesize
2.0MB

MD5
6d081da0c4ea3eff0e18d414047bb5fd

SHA1
992fca17ad2fe4a6523c3858c87b0e5203628032

SHA256
a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e

SHA512
12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\DC.exe
Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
Filesize
2.0MB

MD5
6d081da0c4ea3eff0e18d414047bb5fd

SHA1
992fca17ad2fe4a6523c3858c87b0e5203628032

SHA256
a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e

SHA512
12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7

Download Submit
memory/280-118-0x0000000000000000-mapping.dmp

Download
memory/328-119-0x0000000000000000-mapping.dmp

Download
memory/364-165-0x0000000000000000-mapping.dmp

Download
memory/520-127-0x0000000000000000-mapping.dmp

Download
memory/536-126-0x0000000000000000-mapping.dmp

Download
memory/556-132-0x0000000000000000-mapping.dmp

Download
memory/684-161-0x0000000000000000-mapping.dmp

Download
memory/776-124-0x0000000000000000-mapping.dmp

Download
memory/800-125-0x0000000000000000-mapping.dmp

Download
memory/836-92-0x0000000000000000-mapping.dmp

Download
memory/848-120-0x0000000000000000-mapping.dmp

Download
memory/932-141-0x000007FEF34D0000-0x000007FEF3EF3000-memory.dmp

Filesize
10.1MB

Download
memory/932-134-0x0000000000000000-mapping.dmp

Download
memory/932-156-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/932-144-0x000007FEF2330000-0x000007FEF2E8D000-memory.dmp

Filesize
11.4MB

Download
memory/932-145-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/932-154-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/932-150-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Filesize
3.0MB

Download
memory/932-155-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/976-123-0x0000000000000000-mapping.dmp

Download
memory/1012-77-0x0000000000000000-mapping.dmp

Download
memory/1220-111-0x0000000000000000-mapping.dmp

Download
memory/1284-133-0x0000000000000000-mapping.dmp

Download
memory/1284-148-0x000007FEF2330000-0x000007FEF2E8D000-memory.dmp

Filesize
11.4MB

Download
memory/1284-136-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download
memory/1284-142-0x000007FEF34D0000-0x000007FEF3EF3000-memory.dmp

Filesize
10.1MB

Download
memory/1284-146-0x0000000001E54000-0x0000000001E57000-memory.dmp

Filesize
12KB

Download
memory/1284-153-0x0000000001E5B000-0x0000000001E7A000-memory.dmp

Filesize
124KB

Download
memory/1284-152-0x0000000001E54000-0x0000000001E57000-memory.dmp

Filesize
12KB

Download
memory/1316-104-0x0000000000000000-mapping.dmp

Download
memory/1332-122-0x0000000000000000-mapping.dmp

Download
memory/1404-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1440-97-0x0000000000000000-mapping.dmp

Download
memory/1544-94-0x0000000000000000-mapping.dmp

Download
memory/1552-59-0x0000000000000000-mapping.dmp

Download
memory/1600-158-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/1600-157-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1600-149-0x000007FEF2330000-0x000007FEF2E8D000-memory.dmp

Filesize
11.4MB

Download
memory/1600-151-0x000000001B7B0000-0x000000001BAAF000-memory.dmp

Filesize
3.0MB

Download
memory/1600-147-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/1600-143-0x000007FEF34D0000-0x000007FEF3EF3000-memory.dmp

Filesize
10.1MB

Download
memory/1600-135-0x0000000000000000-mapping.dmp

Download
memory/1664-159-0x0000000000000000-mapping.dmp

Download
memory/1708-162-0x0000000000000000-mapping.dmp

Download
memory/1720-56-0x0000000000000000-mapping.dmp

Download
memory/1752-129-0x0000000000000000-mapping.dmp

Download
memory/1784-160-0x0000000000000000-mapping.dmp

Download
memory/1808-128-0x0000000000000000-mapping.dmp

Download
memory/1816-121-0x0000000000000000-mapping.dmp

Download
memory/1852-99-0x0000000000000000-mapping.dmp

Download
memory/1928-131-0x0000000000000000-mapping.dmp

Download
memory/1992-130-0x0000000000000000-mapping.dmp

Download
memory/2032-64-0x0000000000000000-mapping.dmp

Download