Analysis
-
max time kernel
129s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 10:14
Static task
static1
Behavioral task
behavioral1
Sample
1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
Resource
win10v2004-20240508-en
General
-
Target
1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
-
Size
2.6MB
-
MD5
88d00427a014f1fdb88383a6a8ab97a5
-
SHA1
d8c5d3ab8e11aa9dd5236625b610837b5cbbfd27
-
SHA256
1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca
-
SHA512
764319cdf3423a0c38f9050694bd936f2081d1ae34580aa055171ac84ae4b77d488422a68a5e607d2df6ba2627835990fba93a8a405d29cd88c1cde828ce3531
-
SSDEEP
49152:wgwR0ifu1DBgutBPNw6m+sqFrDCcTeL7dzXVeH0Bl1nzBJ6GDaJP:wgwR0vguPPK6GkDC7hv1zeP
Malware Config
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral1/files/0x00070000000173d8-29.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3" DC.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" YOURDATA.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2212 bcdedit.exe 304 bcdedit.exe -
Renames multiple (6339) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 1468 wbadmin.exe -
pid Process 2052 wbadmin.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\outlook.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql-exchange.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangeadtopology.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangesa.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangeadtopology.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe -
Deletes itself 1 IoCs
pid Process 2956 cmd.exe -
Executes dropped EXE 10 IoCs
pid Process 2600 7za.exe 2556 7za.exe 2440 5koto.exe 2984 YOURDATA.exe 2872 DC.exe 448 YOURDATA.exe 1484 YOURDATA.exe 2480 YOURDATA.exe 1664 Everything.exe 3004 Everything.exe -
Loads dropped DLL 19 IoCs
pid Process 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 2440 5koto.exe 2440 5koto.exe 2984 YOURDATA.exe 2760 cmd.exe 448 YOURDATA.exe 1484 YOURDATA.exe 2480 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open\command 5koto.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open\command YOURDATA.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell 5koto.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection DC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YOURDATA = "\"C:\\Users\\Admin\\AppData\\Local\\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\\YOURDATA.exe\" " 5koto.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\V: Everything.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol DC.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini DC.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_hover.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_FileOffMask.bmp.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0286034.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.HXS.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400003.PNG.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Discussion.gta.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\README.txt.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS11.POC.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149627.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01064_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\OpenMeasure.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\vlc.mo.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm YOURDATA.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\ECLIPSE.ELM.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\HLS.api.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.fca.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148309.JPG.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01461_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\newgrounds.luac.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\weather.css.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18180_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBCALSO.POC.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ApothecaryResume.dotx.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msadomd28.tlb.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\settings.css.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD00160_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0234001.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00915_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00459_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106124.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGAD.DPV.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01628_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00184_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382959.JPG.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CONTACTINFOBB.POC.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\CalendarViewButtonImages.jpg.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299611.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01639_.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Amman.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\OriginLetter.Dotx.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)greenStateIcon.png.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103402.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0102984.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Foundry.thmx.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_1.emf.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151055.WMF.getmydata@tutamail.com.5000USD YOURDATA.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl wbadmin.exe -
pid Process 1916 powershell.exe 904 powershell.exe 1936 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\----Read-Me-----.txt\"" YOURDATA.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell 5koto.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\.5000USD YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open\command 5koto.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.5000USD\ = "mimicfile" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open 5koto.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command YOURDATA.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2872 DC.exe 2872 DC.exe 2872 DC.exe 2872 DC.exe 1484 YOURDATA.exe 2480 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 2984 YOURDATA.exe 1916 powershell.exe 904 powershell.exe 1936 powershell.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe 1484 YOURDATA.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2600 7za.exe Token: 35 2600 7za.exe Token: SeRestorePrivilege 2556 7za.exe Token: 35 2556 7za.exe Token: SeSecurityPrivilege 2556 7za.exe Token: SeSecurityPrivilege 2556 7za.exe Token: SeIncreaseQuotaPrivilege 2440 5koto.exe Token: SeSecurityPrivilege 2440 5koto.exe Token: SeTakeOwnershipPrivilege 2440 5koto.exe Token: SeLoadDriverPrivilege 2440 5koto.exe Token: SeSystemProfilePrivilege 2440 5koto.exe Token: SeSystemtimePrivilege 2440 5koto.exe Token: SeProfSingleProcessPrivilege 2440 5koto.exe Token: SeIncBasePriorityPrivilege 2440 5koto.exe Token: SeCreatePagefilePrivilege 2440 5koto.exe Token: SeBackupPrivilege 2440 5koto.exe Token: SeRestorePrivilege 2440 5koto.exe Token: SeShutdownPrivilege 2440 5koto.exe Token: SeDebugPrivilege 2440 5koto.exe Token: SeSystemEnvironmentPrivilege 2440 5koto.exe Token: SeChangeNotifyPrivilege 2440 5koto.exe Token: SeRemoteShutdownPrivilege 2440 5koto.exe Token: SeUndockPrivilege 2440 5koto.exe Token: SeManageVolumePrivilege 2440 5koto.exe Token: SeImpersonatePrivilege 2440 5koto.exe Token: SeCreateGlobalPrivilege 2440 5koto.exe Token: 33 2440 5koto.exe Token: 34 2440 5koto.exe Token: 35 2440 5koto.exe Token: SeIncreaseQuotaPrivilege 2984 YOURDATA.exe Token: SeSecurityPrivilege 2984 YOURDATA.exe Token: SeTakeOwnershipPrivilege 2984 YOURDATA.exe Token: SeLoadDriverPrivilege 2984 YOURDATA.exe Token: SeSystemProfilePrivilege 2984 YOURDATA.exe Token: SeSystemtimePrivilege 2984 YOURDATA.exe Token: SeProfSingleProcessPrivilege 2984 YOURDATA.exe Token: SeIncBasePriorityPrivilege 2984 YOURDATA.exe Token: SeCreatePagefilePrivilege 2984 YOURDATA.exe Token: SeBackupPrivilege 2984 YOURDATA.exe Token: SeRestorePrivilege 2984 YOURDATA.exe Token: SeShutdownPrivilege 2984 YOURDATA.exe Token: SeDebugPrivilege 2984 YOURDATA.exe Token: SeSystemEnvironmentPrivilege 2984 YOURDATA.exe Token: SeChangeNotifyPrivilege 2984 YOURDATA.exe Token: SeRemoteShutdownPrivilege 2984 YOURDATA.exe Token: SeUndockPrivilege 2984 YOURDATA.exe Token: SeManageVolumePrivilege 2984 YOURDATA.exe Token: SeImpersonatePrivilege 2984 YOURDATA.exe Token: SeCreateGlobalPrivilege 2984 YOURDATA.exe Token: 33 2984 YOURDATA.exe Token: 34 2984 YOURDATA.exe Token: 35 2984 YOURDATA.exe Token: SeDebugPrivilege 2872 DC.exe Token: SeAssignPrimaryTokenPrivilege 2872 DC.exe Token: SeIncreaseQuotaPrivilege 2872 DC.exe Token: 0 2872 DC.exe Token: SeIncreaseQuotaPrivilege 448 YOURDATA.exe Token: SeSecurityPrivilege 448 YOURDATA.exe Token: SeTakeOwnershipPrivilege 448 YOURDATA.exe Token: SeLoadDriverPrivilege 448 YOURDATA.exe Token: SeSystemProfilePrivilege 448 YOURDATA.exe Token: SeSystemtimePrivilege 448 YOURDATA.exe Token: SeProfSingleProcessPrivilege 448 YOURDATA.exe Token: SeIncBasePriorityPrivilege 448 YOURDATA.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1664 Everything.exe 3004 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2600 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 28 PID 2684 wrote to memory of 2600 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 28 PID 2684 wrote to memory of 2600 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 28 PID 2684 wrote to memory of 2600 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 28 PID 2684 wrote to memory of 2556 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 30 PID 2684 wrote to memory of 2556 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 30 PID 2684 wrote to memory of 2556 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 30 PID 2684 wrote to memory of 2556 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 30 PID 2684 wrote to memory of 2440 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 32 PID 2684 wrote to memory of 2440 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 32 PID 2684 wrote to memory of 2440 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 32 PID 2684 wrote to memory of 2440 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 32 PID 2440 wrote to memory of 2984 2440 5koto.exe 33 PID 2440 wrote to memory of 2984 2440 5koto.exe 33 PID 2440 wrote to memory of 2984 2440 5koto.exe 33 PID 2440 wrote to memory of 2984 2440 5koto.exe 33 PID 2984 wrote to memory of 2760 2984 YOURDATA.exe 34 PID 2984 wrote to memory of 2760 2984 YOURDATA.exe 34 PID 2984 wrote to memory of 2760 2984 YOURDATA.exe 34 PID 2984 wrote to memory of 2760 2984 YOURDATA.exe 34 PID 2760 wrote to memory of 2872 2760 cmd.exe 36 PID 2760 wrote to memory of 2872 2760 cmd.exe 36 PID 2760 wrote to memory of 2872 2760 cmd.exe 36 PID 2760 wrote to memory of 2872 2760 cmd.exe 36 PID 2984 wrote to memory of 448 2984 YOURDATA.exe 38 PID 2984 wrote to memory of 448 2984 YOURDATA.exe 38 PID 2984 wrote to memory of 448 2984 YOURDATA.exe 38 PID 2984 wrote to memory of 448 2984 YOURDATA.exe 38 PID 2984 wrote to memory of 1484 2984 YOURDATA.exe 39 PID 2984 wrote to memory of 1484 2984 YOURDATA.exe 39 PID 2984 wrote to memory of 1484 2984 YOURDATA.exe 39 PID 2984 wrote to memory of 1484 2984 YOURDATA.exe 39 PID 2984 wrote to memory of 2480 2984 YOURDATA.exe 40 PID 2984 wrote to memory of 2480 2984 YOURDATA.exe 40 PID 2984 wrote to memory of 2480 2984 YOURDATA.exe 40 PID 2984 wrote to memory of 2480 2984 YOURDATA.exe 40 PID 2984 wrote to memory of 1664 2984 YOURDATA.exe 41 PID 2984 wrote to memory of 1664 2984 YOURDATA.exe 41 PID 2984 wrote to memory of 1664 2984 YOURDATA.exe 41 PID 2984 wrote to memory of 1664 2984 YOURDATA.exe 41 PID 2684 wrote to memory of 2956 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 42 PID 2684 wrote to memory of 2956 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 42 PID 2684 wrote to memory of 2956 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 42 PID 2684 wrote to memory of 2956 2684 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 42 PID 2984 wrote to memory of 292 2984 YOURDATA.exe 44 PID 2984 wrote to memory of 292 2984 YOURDATA.exe 44 PID 2984 wrote to memory of 292 2984 YOURDATA.exe 44 PID 2984 wrote to memory of 292 2984 YOURDATA.exe 44 PID 2984 wrote to memory of 1800 2984 YOURDATA.exe 46 PID 2984 wrote to memory of 1800 2984 YOURDATA.exe 46 PID 2984 wrote to memory of 1800 2984 YOURDATA.exe 46 PID 2984 wrote to memory of 1800 2984 YOURDATA.exe 46 PID 2984 wrote to memory of 1012 2984 YOURDATA.exe 48 PID 2984 wrote to memory of 1012 2984 YOURDATA.exe 48 PID 2984 wrote to memory of 1012 2984 YOURDATA.exe 48 PID 2984 wrote to memory of 1012 2984 YOURDATA.exe 48 PID 2984 wrote to memory of 452 2984 YOURDATA.exe 50 PID 2984 wrote to memory of 452 2984 YOURDATA.exe 50 PID 2984 wrote to memory of 452 2984 YOURDATA.exe 50 PID 2984 wrote to memory of 452 2984 YOURDATA.exe 50 PID 2984 wrote to memory of 2308 2984 YOURDATA.exe 51 PID 2984 wrote to memory of 2308 2984 YOURDATA.exe 51 PID 2984 wrote to memory of 2308 2984 YOURDATA.exe 51 PID 2984 wrote to memory of 2308 2984 YOURDATA.exe 51 -
System policy modification 1 TTPs 11 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" YOURDATA.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe"C:\Users\Admin\AppData\Local\Temp\1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p5056156942493511584 Everything64.dll2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"3⤵
- UAC bypass
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2984 -
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\DC.exeDC.exe /D5⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e watch -pid 2984 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:448
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1484
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:1664
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -H off4⤵PID:292
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:1800
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:1012
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:452
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2308
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2120
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2060
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2132
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2868
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:1400
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:1804
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2588
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:1952
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵PID:1600
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵PID:1812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1936
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:904
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2212
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:304
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1468
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:2052
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:3004
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- Deletes itself
PID:2956
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1060
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3036
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:2356
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:636
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:2992
Network
- No results found
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
152 B 3
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
152 B 3
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
152 B 3
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
-
100 B 2
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
2File Deletion
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59c3e8f3535755c20c895758b9b07db4d
SHA16b1e6fe0eb10df64aa369d6f51cf28c2481a653c
SHA25655a1cfee5c8e82057be18e773b38ae787835e243933f32ba91ff1d7e262a8b8a
SHA5124a44a04e3decfeeb56ef0648d14b1242f2f3a29a16a385d087f0cc496e08478ff66bde95928ca7d5849e8481249814d6c5743222fd6a6a648bd1c2bfe5d94ced
-
Filesize
300B
MD55807dbdb0aa9156ab44cd310c0c60428
SHA1bd144bf252b3e8595881467eeb049271a4535bb5
SHA25681b0b200867139dad232e22131799ab5836cd7ee429f179b9c767c6ed2e0b0d3
SHA512497d73bbf28f1ee251acc24b6a0a2089b8a6940767dd3972128e347578c019063ccfdc9d077ae70192d12fb0f38e10e583f08e56e2f524acc9e521ce2af915fe
-
Filesize
2.3MB
MD568d90c681c9748e8489f3f9fc622301d
SHA1931ebcaec96692ba2054379a489a4af0451bf630
SHA256cfbcf827900a5dc36d1d2ba4b4879ce703a429b1952e6e9616f498a9bde68c91
SHA5124dcd84246dec0522787dff8fb1ff90e418e1ed47496f9e35e56e5c5c26dcc8a2283a0478bcbd44d61a763ea46b050675aca1d93a6ff628d39f7f51e254fbdd80
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
1.7MB
MD51538b51a67fde66f3b41b5ac47f4ac1b
SHA1296956729df307b32e8fd9fd4388e6f2dbfb5298
SHA2560053300049b43fe839eb1c630b42157f5dd7dfddb49e9ee77a5ce317f925727a
SHA5129f6507d23f7c2be73fc3b43de3e90fb80c76d0aae618deb73658e8c225357e9d9a2d54111e306f3d9caed177a0a8e8c5c162c91cdef3502c45e050c168c5c8f5
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
9.3MB
MD584e6a634adec4b0929a9f8474457df7c
SHA1dbd6f62d15403b294920d60d9dd2aa4658cf30df
SHA2564473dfaa64e090855780708d12532d93ab33e3dfb7428371e3409e9f7495d855
SHA51261ed82df05ed9ed7d258b8b0bc8517658007c232b047cf6250b27556090d2e6afa0d710a7e2ed7e53e1df997a8480c29101767f6aa59c204308e544e29075b64
-
Filesize
20KB
MD5ac883b6e8cdfe4e5cd7d296d524509e1
SHA181917290cde0e10ad974e62d82844f89e12da5b1
SHA256eea81f348b3c3788114dd8cd534c85bd266e73bd29891f44ea131df4351f2957
SHA512e21352a240f740b3d9d188398ef6603828f84491cddaecb19d2b9c16d283b23827d9754d467b1c4832f29e1cba8d715adc14bc71a11459745ecb2c02736a1d49
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5a528eb4025616a050a19e14795694647
SHA13bdc94af64ad7e2bf62948adb5046ac6db1a20bc
SHA25643b93004d8594e53053e0204a5ef30334eb3682eeb8d24248c9816e49b2d6bf8
SHA512147db829b7be84b04ddf9122802c34a33726bbe51dee4705d9fd6ab21b49ce4aea73945b37f9ef4ecd53c2b7aaa09773020d1a36e8cf30b650d615d41f23efad
-
Filesize
233B
MD5cd4326a6fd01cd3ca77cfd8d0f53821b
SHA1a1030414d1f8e5d5a6e89d5a309921b8920856f9
SHA2561c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c
SHA51229ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67
-
Filesize
31KB
MD55e3494a511648b1ebc8b5c30fc3339b3
SHA12b075672b67a09e77fc1d8eb8e21f337d1828c2d
SHA256cc3927b9729de9484990f2feaa7b1ba4d099de53f155d0d787e2507aa36fd099
SHA51201e41ce03b0c37636f4ae4ca6b30a07100a9f72c1b261fb6c8a780a24f40f6f65b84563566ac5a41ea324202926723ba4cdb2ba3f93956081b3db9a9b4fb7055
-
Filesize
32KB
MD52e1424c6432274ea6feb4ba2bfa29640
SHA153057dccdee9db064ebbc1f79f363d60e2140d00
SHA25666de96def06da9a65109c324b07907d40a23735be62eba7463704cfb3c534787
SHA5121c593243760c8ebf5b2a79456648eec228ca2ab4ed62763705e34d246abc92ffa26fc00a55e2787f954a1a9c179422aa66ccc603621b820a40c74ee764926b91
-
Filesize
32B
MD5adf39505f1937ffe3212d171e3e63e81
SHA1cf5248cf710a4aa1c71219fb45671da5cf9aecc9
SHA256a011ff148d68f0ed2721c35a4ba382ebd75ea40c44b15e1d77705934548ee4fa
SHA5128f691bf75717dcb77d9dfa93b2953dd28aece1b109d61bb174e1b491f91a02bb8dadbbb91c48cde44eb65558f00b6371cb5082ba5157325069a836cb0327a3a9
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62