Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 14:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
221121-antabafb8z.exe
Resource
win7-20240221-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
221121-antabafb8z.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
30 signatures
150 seconds
General
-
Target
221121-antabafb8z.exe
-
Size
2.4MB
-
MD5
3fcf77ffa0763350a1df45ab3b89f26a
-
SHA1
0431c506fb86f1813621bc0d09ba12389021cc6b
-
SHA256
08b82e2125b63ec97ed8fb9cbf829ca31935b8dfa2f67be4d686353570554281
-
SHA512
07568d02a3cddf5285cf3ea7ab4bc05fb3cc0739b4bd59c75bdf60f0950a52e4ecc2168f53d5f41031271716ecc8babd164e42007c1cdf9ba00e55124232b842
-
SSDEEP
49152:wgwREifu1DBgutBPNbPz0F3SMzx5QPdqGbHpIAxKof9X7PID/n3ZkIe:wgwREvguPPxzsfTe8GbHjkofeD/n2z
Score
10/10
Malware Config
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral1/files/0x0009000000015e9a-31.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3" DC.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" system86.exe -
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
resource yara_rule behavioral1/files/0x0009000000015e9a-31.dat INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM -
Detects command variations typically used by ransomware 1 IoCs
resource yara_rule behavioral1/files/0x0009000000015e9a-31.dat INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware 1 IoCs
resource yara_rule behavioral1/files/0x0009000000015e9a-31.dat INDICATOR_SUSPICIOUS_USNDeleteJournal -
Detects executables containing commands for clearing Windows Event Logs 1 IoCs
resource yara_rule behavioral1/files/0x0009000000015e9a-31.dat INDICATOR_SUSPICIOUS_ClearWinLogs -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1372 bcdedit.exe 2100 bcdedit.exe -
Renames multiple (210) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 824 wbadmin.exe -
pid Process 1468 wbadmin.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe system86.exe -
Executes dropped EXE 10 IoCs
pid Process 2992 7za.exe 2324 7za.exe 2128 0v3yT8.06.10.exe 2504 system86.exe 2828 DC.exe 1072 system86.exe 2640 system86.exe 2500 system86.exe 1596 Everything.exe 2236 Everything.exe -
Loads dropped DLL 15 IoCs
pid Process 1812 221121-antabafb8z.exe 1812 221121-antabafb8z.exe 1812 221121-antabafb8z.exe 2128 0v3yT8.06.10.exe 2128 0v3yT8.06.10.exe 2504 system86.exe 1076 cmd.exe 2640 system86.exe 1072 system86.exe 2500 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" system86.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open\command system86.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell 0v3yT8.06.10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open\command 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open 0v3yT8.06.10.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" 0v3yT8.06.10.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" system86.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 0v3yT8.06.10.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection DC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system86 = "\"C:\\Users\\Admin\\AppData\\Local\\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\\system86.exe\" " 0v3yT8.06.10.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system86.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: system86.exe File opened (read-only) \??\V: system86.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\O: system86.exe File opened (read-only) \??\P: system86.exe File opened (read-only) \??\R: system86.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\B: system86.exe File opened (read-only) \??\I: system86.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\A: system86.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\G: system86.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\H: system86.exe File opened (read-only) \??\M: system86.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\E: system86.exe File opened (read-only) \??\Q: system86.exe File opened (read-only) \??\Z: system86.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\L: system86.exe File opened (read-only) \??\W: system86.exe File opened (read-only) \??\X: system86.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\K: system86.exe File opened (read-only) \??\T: system86.exe File opened (read-only) \??\Y: system86.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\N: system86.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\B: Everything.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol DC.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini DC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 0v3yT8.06.10.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" 0v3yT8.06.10.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\How-to-decrypt.txt\"" system86.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell 0v3yT8.06.10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.0v3yT8\ = "mimicfile" system86.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open\command 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open 0v3yT8.06.10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell system86.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile 0v3yT8.06.10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" system86.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open\command system86.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" system86.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command system86.exe Key created \REGISTRY\MACHINE\Software\Classes\.0v3yT8 system86.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2828 DC.exe 2828 DC.exe 2828 DC.exe 2828 DC.exe 2640 system86.exe 2500 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2504 system86.exe 2336 powershell.exe 2332 powershell.exe 1332 powershell.exe 2504 system86.exe 2504 system86.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2992 7za.exe Token: 35 2992 7za.exe Token: SeRestorePrivilege 2324 7za.exe Token: 35 2324 7za.exe Token: SeSecurityPrivilege 2324 7za.exe Token: SeSecurityPrivilege 2324 7za.exe Token: SeIncreaseQuotaPrivilege 2128 0v3yT8.06.10.exe Token: SeSecurityPrivilege 2128 0v3yT8.06.10.exe Token: SeTakeOwnershipPrivilege 2128 0v3yT8.06.10.exe Token: SeLoadDriverPrivilege 2128 0v3yT8.06.10.exe Token: SeSystemProfilePrivilege 2128 0v3yT8.06.10.exe Token: SeSystemtimePrivilege 2128 0v3yT8.06.10.exe Token: SeProfSingleProcessPrivilege 2128 0v3yT8.06.10.exe Token: SeIncBasePriorityPrivilege 2128 0v3yT8.06.10.exe Token: SeCreatePagefilePrivilege 2128 0v3yT8.06.10.exe Token: SeBackupPrivilege 2128 0v3yT8.06.10.exe Token: SeRestorePrivilege 2128 0v3yT8.06.10.exe Token: SeShutdownPrivilege 2128 0v3yT8.06.10.exe Token: SeDebugPrivilege 2128 0v3yT8.06.10.exe Token: SeSystemEnvironmentPrivilege 2128 0v3yT8.06.10.exe Token: SeChangeNotifyPrivilege 2128 0v3yT8.06.10.exe Token: SeRemoteShutdownPrivilege 2128 0v3yT8.06.10.exe Token: SeUndockPrivilege 2128 0v3yT8.06.10.exe Token: SeManageVolumePrivilege 2128 0v3yT8.06.10.exe Token: SeImpersonatePrivilege 2128 0v3yT8.06.10.exe Token: SeCreateGlobalPrivilege 2128 0v3yT8.06.10.exe Token: 33 2128 0v3yT8.06.10.exe Token: 34 2128 0v3yT8.06.10.exe Token: 35 2128 0v3yT8.06.10.exe Token: SeIncreaseQuotaPrivilege 2504 system86.exe Token: SeSecurityPrivilege 2504 system86.exe Token: SeTakeOwnershipPrivilege 2504 system86.exe Token: SeLoadDriverPrivilege 2504 system86.exe Token: SeSystemProfilePrivilege 2504 system86.exe Token: SeSystemtimePrivilege 2504 system86.exe Token: SeProfSingleProcessPrivilege 2504 system86.exe Token: SeIncBasePriorityPrivilege 2504 system86.exe Token: SeCreatePagefilePrivilege 2504 system86.exe Token: SeBackupPrivilege 2504 system86.exe Token: SeRestorePrivilege 2504 system86.exe Token: SeShutdownPrivilege 2504 system86.exe Token: SeDebugPrivilege 2504 system86.exe Token: SeSystemEnvironmentPrivilege 2504 system86.exe Token: SeChangeNotifyPrivilege 2504 system86.exe Token: SeRemoteShutdownPrivilege 2504 system86.exe Token: SeUndockPrivilege 2504 system86.exe Token: SeManageVolumePrivilege 2504 system86.exe Token: SeImpersonatePrivilege 2504 system86.exe Token: SeCreateGlobalPrivilege 2504 system86.exe Token: 33 2504 system86.exe Token: 34 2504 system86.exe Token: 35 2504 system86.exe Token: SeDebugPrivilege 2828 DC.exe Token: SeAssignPrimaryTokenPrivilege 2828 DC.exe Token: SeIncreaseQuotaPrivilege 2640 system86.exe Token: SeSecurityPrivilege 2640 system86.exe Token: SeTakeOwnershipPrivilege 2640 system86.exe Token: SeLoadDriverPrivilege 2640 system86.exe Token: SeSystemProfilePrivilege 2640 system86.exe Token: SeSystemtimePrivilege 2640 system86.exe Token: SeProfSingleProcessPrivilege 2640 system86.exe Token: SeIncBasePriorityPrivilege 2640 system86.exe Token: SeCreatePagefilePrivilege 2640 system86.exe Token: SeBackupPrivilege 2640 system86.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1596 Everything.exe 2236 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2992 1812 221121-antabafb8z.exe 28 PID 1812 wrote to memory of 2992 1812 221121-antabafb8z.exe 28 PID 1812 wrote to memory of 2992 1812 221121-antabafb8z.exe 28 PID 1812 wrote to memory of 2992 1812 221121-antabafb8z.exe 28 PID 1812 wrote to memory of 2324 1812 221121-antabafb8z.exe 30 PID 1812 wrote to memory of 2324 1812 221121-antabafb8z.exe 30 PID 1812 wrote to memory of 2324 1812 221121-antabafb8z.exe 30 PID 1812 wrote to memory of 2324 1812 221121-antabafb8z.exe 30 PID 1812 wrote to memory of 2128 1812 221121-antabafb8z.exe 32 PID 1812 wrote to memory of 2128 1812 221121-antabafb8z.exe 32 PID 1812 wrote to memory of 2128 1812 221121-antabafb8z.exe 32 PID 1812 wrote to memory of 2128 1812 221121-antabafb8z.exe 32 PID 2128 wrote to memory of 2504 2128 0v3yT8.06.10.exe 33 PID 2128 wrote to memory of 2504 2128 0v3yT8.06.10.exe 33 PID 2128 wrote to memory of 2504 2128 0v3yT8.06.10.exe 33 PID 2128 wrote to memory of 2504 2128 0v3yT8.06.10.exe 33 PID 2504 wrote to memory of 1076 2504 system86.exe 39 PID 2504 wrote to memory of 1076 2504 system86.exe 39 PID 2504 wrote to memory of 1076 2504 system86.exe 39 PID 2504 wrote to memory of 1076 2504 system86.exe 39 PID 1076 wrote to memory of 2828 1076 cmd.exe 37 PID 1076 wrote to memory of 2828 1076 cmd.exe 37 PID 1076 wrote to memory of 2828 1076 cmd.exe 37 PID 1076 wrote to memory of 2828 1076 cmd.exe 37 PID 2504 wrote to memory of 1072 2504 system86.exe 36 PID 2504 wrote to memory of 1072 2504 system86.exe 36 PID 2504 wrote to memory of 1072 2504 system86.exe 36 PID 2504 wrote to memory of 1072 2504 system86.exe 36 PID 2504 wrote to memory of 2500 2504 system86.exe 35 PID 2504 wrote to memory of 2500 2504 system86.exe 35 PID 2504 wrote to memory of 2500 2504 system86.exe 35 PID 2504 wrote to memory of 2500 2504 system86.exe 35 PID 2504 wrote to memory of 2640 2504 system86.exe 34 PID 2504 wrote to memory of 2640 2504 system86.exe 34 PID 2504 wrote to memory of 2640 2504 system86.exe 34 PID 2504 wrote to memory of 2640 2504 system86.exe 34 PID 2504 wrote to memory of 1596 2504 system86.exe 41 PID 2504 wrote to memory of 1596 2504 system86.exe 41 PID 2504 wrote to memory of 1596 2504 system86.exe 41 PID 2504 wrote to memory of 1596 2504 system86.exe 41 PID 2504 wrote to memory of 2256 2504 system86.exe 42 PID 2504 wrote to memory of 2256 2504 system86.exe 42 PID 2504 wrote to memory of 2256 2504 system86.exe 42 PID 2504 wrote to memory of 2256 2504 system86.exe 42 PID 2504 wrote to memory of 2100 2504 system86.exe 77 PID 2504 wrote to memory of 2100 2504 system86.exe 77 PID 2504 wrote to memory of 2100 2504 system86.exe 77 PID 2504 wrote to memory of 2100 2504 system86.exe 77 PID 2504 wrote to memory of 2916 2504 system86.exe 76 PID 2504 wrote to memory of 2916 2504 system86.exe 76 PID 2504 wrote to memory of 2916 2504 system86.exe 76 PID 2504 wrote to memory of 2916 2504 system86.exe 76 PID 2504 wrote to memory of 2248 2504 system86.exe 74 PID 2504 wrote to memory of 2248 2504 system86.exe 74 PID 2504 wrote to memory of 2248 2504 system86.exe 74 PID 2504 wrote to memory of 2248 2504 system86.exe 74 PID 2504 wrote to memory of 1860 2504 system86.exe 43 PID 2504 wrote to memory of 1860 2504 system86.exe 43 PID 2504 wrote to memory of 1860 2504 system86.exe 43 PID 2504 wrote to memory of 1860 2504 system86.exe 43 PID 2504 wrote to memory of 344 2504 system86.exe 69 PID 2504 wrote to memory of 344 2504 system86.exe 69 PID 2504 wrote to memory of 344 2504 system86.exe 69 PID 2504 wrote to memory of 344 2504 system86.exe 69 -
System policy modification 1 TTPs 11 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system86.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer system86.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\221121-antabafb8z.exe"C:\Users\Admin\AppData\Local\Temp\221121-antabafb8z.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p933916544411611201 Everything64.dll2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"3⤵
- UAC bypass
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2504 -
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2640
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2500
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e watch -pid 2504 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:1596
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -H off4⤵PID:2256
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:1860
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:972
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:1140
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1332
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2332
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵PID:432
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵PID:2612
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:840
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:992
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2608
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:1808
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2388
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:344
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2248
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2916
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2100
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1372
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2100
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
PID:824
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:1468
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2236
-
-
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\DC.exeDC.exe /D1⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2788
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1800
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:1660
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1540
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1816
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
2File Deletion
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5cb7ad438670eae537f6160bd6bede7b0
SHA1fe90fc1ed86ac74d35cd88a20208a55f4f336268
SHA2565342e7adbbaad25538bef62eeb08984939e5da983512a455114429753df5e989
SHA512aaeaf9a7d2f134ea2886e531d576fa12b715351ad05a73c192ebd5629dddbf6a20c7398d04491db8abf32475773d64567169f15b135912a3701e37978175820a
-
Filesize
2.0MB
MD56d081da0c4ea3eff0e18d414047bb5fd
SHA1992fca17ad2fe4a6523c3858c87b0e5203628032
SHA256a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e
SHA51212ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
Filesize
1.3MB
MD527404877b7d975cf59b510af42e4396a
SHA19780f4f3c0dbaa8ef643692962a0171dca33db57
SHA2565b73344aa268f35ab8747c33a8f7589b00558f78d72b3bf7d6cb8541c32a409c
SHA5124cd25d2cf56bff614f15a02e117240c3f38037aad7b32901f826f7095df56534f3549fcc1e97dbe082ada7128dab3b2c14e548b65d327b7d378d881d8fb867c5
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
1.5MB
MD5c73353f0e0abf5ca18a10a268aefdb68
SHA136887b5890bbd753f9556476ddb376208fe195fb
SHA2561e077fc068b060e4356876e29ce01fd63598f1579a841336f4a30f73eda1f328
SHA512212546b076b59867ecf67b4cb060789b23ec9c167d0f0b311581ce272bb261cb4f8d8540fae3311fd3059906464214defb3cb3415fcf4769bfbe4e6bbaf4ad63
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
448KB
MD5e2114b1627889b250c7fd0425ba1bd54
SHA197412dba3cbeb0125c71b7b2ab194ea2fdff51b2
SHA2565434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60
SHA51276ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1
-
Filesize
9.2MB
MD534969a0b25815a619292e9393b38ce11
SHA179d03dc6709167694b3bfdee6398db03ecf4ffeb
SHA25619254501de5987f8b4c9d357805894a142e87966084af59437d58afcf7499e81
SHA512241760a78cded5bfe38978ae3e83d74dc42b6512a0b13c89a980587962855dabbf886f52794996453260a33976ada255f25c8313458197056ebed01cc6683c6a
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
20KB
MD57f4f714c031313ac917f6cc16d0e7dd4
SHA141c19ad147300d93907bdbdfbf707fd28c0705f4
SHA256122d5cbf2ed0c9aa6df478c862f8917af4baf7f5069f22994adfc95da874f835
SHA512a54d739b4b7b0f49437796875203d7c4c0157a0c9e2fb49ea870d5863439c4a9d50b66ac610e0282a5ee99e8d84ce60a643ac8ea1a6ea62a238ed5ab6628921e
-
Filesize
32B
MD5e8cb764dda43cde825b772148a9005f5
SHA17634d3686bc531e8e382a59493024916cdac3c28
SHA256160211a63ccba5381d6f68ef7e49a1dbb3a7c53df4a61fb3d2cbd7b2b011f97f
SHA512ebe6c5f4a6f70cc7bceba30ddbdb2adde53c0a83bc3342ec96cdf722440fba1f8b49bc4d3257c281e9a2cd2f6ea4b87a15f4c0d881be77572187af9307688926
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5db0200daf596cd47dfc062891f982f1d
SHA1607b5c8a0e12356eef38d6742dfd29456a912511
SHA256765ffb23f2fe535513058d7a96753dfc9e40054a682f3f96a6e1abc17d7f8ed4
SHA512a0ce04eed67fc8e3fc3591df1674400f25bcbd67cd272f1f5628c43df2418c4291382db0878242025e5db6bc6fcdce55b02a45bb8b30d08eb2ce6dd5fd07ea48
-
Filesize
233B
MD5cd4326a6fd01cd3ca77cfd8d0f53821b
SHA1a1030414d1f8e5d5a6e89d5a309921b8920856f9
SHA2561c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c
SHA51229ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5