Analysis
-
max time kernel
135s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 10:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
Resource
win7-20240221-en
windows7-x64
31 signatures
150 seconds
Behavioral task
behavioral2
Sample
1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
28 signatures
150 seconds
General
-
Target
1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe
-
Size
2.6MB
-
MD5
88d00427a014f1fdb88383a6a8ab97a5
-
SHA1
d8c5d3ab8e11aa9dd5236625b610837b5cbbfd27
-
SHA256
1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca
-
SHA512
764319cdf3423a0c38f9050694bd936f2081d1ae34580aa055171ac84ae4b77d488422a68a5e607d2df6ba2627835990fba93a8a405d29cd88c1cde828ce3531
-
SSDEEP
49152:wgwR0ifu1DBgutBPNw6m+sqFrDCcTeL7dzXVeH0Bl1nzBJ6GDaJP:wgwR0vguPPK6GkDC7hv1zeP
Malware Config
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023409-37.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2240 bcdedit.exe 1544 bcdedit.exe -
Renames multiple (4476) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3188 wbadmin.exe -
pid Process 1616 wbadmin.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql-exchange.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msexchangesa.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe YOURDATA.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe -
Executes dropped EXE 10 IoCs
pid Process 3400 7za.exe 1044 7za.exe 2192 5koto.exe 1732 YOURDATA.exe 2016 DC.exe 4468 YOURDATA.exe 4004 YOURDATA.exe 2856 YOURDATA.exe 4652 Everything.exe 2272 Everything.exe -
Loads dropped DLL 5 IoCs
pid Process 2192 5koto.exe 1732 YOURDATA.exe 4004 YOURDATA.exe 2856 YOURDATA.exe 4468 YOURDATA.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open 5koto.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open\command 5koto.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YOURDATA = "\"C:\\Users\\Admin\\AppData\\Local\\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\\YOURDATA.exe\" " 5koto.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\U: Everything.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_Subscription-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_KMS_Client_AE-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\[email protected] YOURDATA.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\intf\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ppd.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-ppd.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-ul-phn.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ppd.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-ul-oob.xrm-ms.getmydata@tutamail.com.5000USD YOURDATA.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] YOURDATA.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\[email protected] YOURDATA.exe -
pid Process 744 powershell.exe 4620 powershell.exe 2824 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe -
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile 5koto.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command YOURDATA.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open\command YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\.5000USD YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.5000USD\ = "mimicfile" YOURDATA.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open\command 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open 5koto.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command YOURDATA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\----Read-Me-----.txt\"" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 5koto.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 5koto.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\exefile\shell 5koto.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile YOURDATA.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4004 YOURDATA.exe 4004 YOURDATA.exe 2856 YOURDATA.exe 2856 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 1732 YOURDATA.exe 2824 powershell.exe 2824 powershell.exe 744 powershell.exe 744 powershell.exe 4620 powershell.exe 4620 powershell.exe 744 powershell.exe 2824 powershell.exe 4620 powershell.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe 4004 YOURDATA.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3400 7za.exe Token: 35 3400 7za.exe Token: SeRestorePrivilege 1044 7za.exe Token: 35 1044 7za.exe Token: SeSecurityPrivilege 1044 7za.exe Token: SeSecurityPrivilege 1044 7za.exe Token: SeIncreaseQuotaPrivilege 2192 5koto.exe Token: SeSecurityPrivilege 2192 5koto.exe Token: SeTakeOwnershipPrivilege 2192 5koto.exe Token: SeLoadDriverPrivilege 2192 5koto.exe Token: SeSystemProfilePrivilege 2192 5koto.exe Token: SeSystemtimePrivilege 2192 5koto.exe Token: SeProfSingleProcessPrivilege 2192 5koto.exe Token: SeIncBasePriorityPrivilege 2192 5koto.exe Token: SeCreatePagefilePrivilege 2192 5koto.exe Token: SeBackupPrivilege 2192 5koto.exe Token: SeRestorePrivilege 2192 5koto.exe Token: SeShutdownPrivilege 2192 5koto.exe Token: SeDebugPrivilege 2192 5koto.exe Token: SeSystemEnvironmentPrivilege 2192 5koto.exe Token: SeChangeNotifyPrivilege 2192 5koto.exe Token: SeRemoteShutdownPrivilege 2192 5koto.exe Token: SeUndockPrivilege 2192 5koto.exe Token: SeManageVolumePrivilege 2192 5koto.exe Token: SeImpersonatePrivilege 2192 5koto.exe Token: SeCreateGlobalPrivilege 2192 5koto.exe Token: 33 2192 5koto.exe Token: 34 2192 5koto.exe Token: 35 2192 5koto.exe Token: 36 2192 5koto.exe Token: SeIncreaseQuotaPrivilege 1732 YOURDATA.exe Token: SeSecurityPrivilege 1732 YOURDATA.exe Token: SeTakeOwnershipPrivilege 1732 YOURDATA.exe Token: SeLoadDriverPrivilege 1732 YOURDATA.exe Token: SeSystemProfilePrivilege 1732 YOURDATA.exe Token: SeSystemtimePrivilege 1732 YOURDATA.exe Token: SeProfSingleProcessPrivilege 1732 YOURDATA.exe Token: SeIncBasePriorityPrivilege 1732 YOURDATA.exe Token: SeCreatePagefilePrivilege 1732 YOURDATA.exe Token: SeBackupPrivilege 1732 YOURDATA.exe Token: SeRestorePrivilege 1732 YOURDATA.exe Token: SeShutdownPrivilege 1732 YOURDATA.exe Token: SeDebugPrivilege 1732 YOURDATA.exe Token: SeSystemEnvironmentPrivilege 1732 YOURDATA.exe Token: SeChangeNotifyPrivilege 1732 YOURDATA.exe Token: SeRemoteShutdownPrivilege 1732 YOURDATA.exe Token: SeUndockPrivilege 1732 YOURDATA.exe Token: SeManageVolumePrivilege 1732 YOURDATA.exe Token: SeImpersonatePrivilege 1732 YOURDATA.exe Token: SeCreateGlobalPrivilege 1732 YOURDATA.exe Token: 33 1732 YOURDATA.exe Token: 34 1732 YOURDATA.exe Token: 35 1732 YOURDATA.exe Token: 36 1732 YOURDATA.exe Token: SeIncreaseQuotaPrivilege 4468 YOURDATA.exe Token: SeSecurityPrivilege 4468 YOURDATA.exe Token: SeIncreaseQuotaPrivilege 4004 YOURDATA.exe Token: SeTakeOwnershipPrivilege 4468 YOURDATA.exe Token: SeSecurityPrivilege 4004 YOURDATA.exe Token: SeLoadDriverPrivilege 4468 YOURDATA.exe Token: SeTakeOwnershipPrivilege 4004 YOURDATA.exe Token: SeSystemProfilePrivilege 4468 YOURDATA.exe Token: SeLoadDriverPrivilege 4004 YOURDATA.exe Token: SeSystemtimePrivilege 4468 YOURDATA.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4652 Everything.exe 2272 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2208 wrote to memory of 3400 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 83 PID 2208 wrote to memory of 3400 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 83 PID 2208 wrote to memory of 3400 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 83 PID 2208 wrote to memory of 1044 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 86 PID 2208 wrote to memory of 1044 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 86 PID 2208 wrote to memory of 1044 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 86 PID 2208 wrote to memory of 2192 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 89 PID 2208 wrote to memory of 2192 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 89 PID 2208 wrote to memory of 2192 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 89 PID 2192 wrote to memory of 1732 2192 5koto.exe 91 PID 2192 wrote to memory of 1732 2192 5koto.exe 91 PID 2192 wrote to memory of 1732 2192 5koto.exe 91 PID 1732 wrote to memory of 1600 1732 YOURDATA.exe 94 PID 1732 wrote to memory of 1600 1732 YOURDATA.exe 94 PID 1732 wrote to memory of 1600 1732 YOURDATA.exe 94 PID 1600 wrote to memory of 2016 1600 cmd.exe 96 PID 1600 wrote to memory of 2016 1600 cmd.exe 96 PID 1600 wrote to memory of 2016 1600 cmd.exe 96 PID 1732 wrote to memory of 4468 1732 YOURDATA.exe 100 PID 1732 wrote to memory of 4468 1732 YOURDATA.exe 100 PID 1732 wrote to memory of 4468 1732 YOURDATA.exe 100 PID 1732 wrote to memory of 4004 1732 YOURDATA.exe 101 PID 1732 wrote to memory of 4004 1732 YOURDATA.exe 101 PID 1732 wrote to memory of 4004 1732 YOURDATA.exe 101 PID 1732 wrote to memory of 2856 1732 YOURDATA.exe 102 PID 1732 wrote to memory of 2856 1732 YOURDATA.exe 102 PID 1732 wrote to memory of 2856 1732 YOURDATA.exe 102 PID 1732 wrote to memory of 4652 1732 YOURDATA.exe 107 PID 1732 wrote to memory of 4652 1732 YOURDATA.exe 107 PID 1732 wrote to memory of 4652 1732 YOURDATA.exe 107 PID 2208 wrote to memory of 2396 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 108 PID 2208 wrote to memory of 2396 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 108 PID 2208 wrote to memory of 2396 2208 1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe 108 PID 1732 wrote to memory of 4740 1732 YOURDATA.exe 125 PID 1732 wrote to memory of 4740 1732 YOURDATA.exe 125 PID 1732 wrote to memory of 2024 1732 YOURDATA.exe 126 PID 1732 wrote to memory of 2024 1732 YOURDATA.exe 126 PID 1732 wrote to memory of 4544 1732 YOURDATA.exe 127 PID 1732 wrote to memory of 4544 1732 YOURDATA.exe 127 PID 1732 wrote to memory of 3112 1732 YOURDATA.exe 128 PID 1732 wrote to memory of 3112 1732 YOURDATA.exe 128 PID 1732 wrote to memory of 3884 1732 YOURDATA.exe 129 PID 1732 wrote to memory of 3884 1732 YOURDATA.exe 129 PID 1732 wrote to memory of 2088 1732 YOURDATA.exe 130 PID 1732 wrote to memory of 2088 1732 YOURDATA.exe 130 PID 1732 wrote to memory of 4580 1732 YOURDATA.exe 131 PID 1732 wrote to memory of 4580 1732 YOURDATA.exe 131 PID 1732 wrote to memory of 3708 1732 YOURDATA.exe 132 PID 1732 wrote to memory of 3708 1732 YOURDATA.exe 132 PID 1732 wrote to memory of 2016 1732 YOURDATA.exe 133 PID 1732 wrote to memory of 2016 1732 YOURDATA.exe 133 PID 1732 wrote to memory of 400 1732 YOURDATA.exe 134 PID 1732 wrote to memory of 400 1732 YOURDATA.exe 134 PID 1732 wrote to memory of 2516 1732 YOURDATA.exe 136 PID 1732 wrote to memory of 2516 1732 YOURDATA.exe 136 PID 1732 wrote to memory of 3060 1732 YOURDATA.exe 137 PID 1732 wrote to memory of 3060 1732 YOURDATA.exe 137 PID 1732 wrote to memory of 2176 1732 YOURDATA.exe 138 PID 1732 wrote to memory of 2176 1732 YOURDATA.exe 138 PID 1732 wrote to memory of 1056 1732 YOURDATA.exe 140 PID 1732 wrote to memory of 1056 1732 YOURDATA.exe 140 PID 1732 wrote to memory of 964 1732 YOURDATA.exe 141 PID 1732 wrote to memory of 964 1732 YOURDATA.exe 141 PID 1732 wrote to memory of 4620 1732 YOURDATA.exe 143 -
System policy modification 1 TTPs 11 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YOURDATA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" YOURDATA.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System YOURDATA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" YOURDATA.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe"C:\Users\Admin\AppData\Local\Temp\1280eee88bc188622bceadd8a427c5f5e242ddfd175c378b3d828e5e7a0d66ca.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3400
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p5056156942493511584 Everything64.dll2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1044
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\5koto.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"3⤵
- UAC bypass
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1732 -
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\DC.exeDC.exe /D5⤵
- Executes dropped EXE
PID:2016
-
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e watch -pid 1732 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\YOURDATA.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2856
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:4652
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off4⤵PID:4740
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2024
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:4544
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:3112
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:3884
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2088
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:4580
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:3708
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2016
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:400
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2516
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:3060
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:2176
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵PID:1056
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵PID:964
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4620
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:744
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2824
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2240
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:1544
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
PID:3188
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:1616
-
-
C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe"C:\Users\Admin\AppData\Local\{9CF35124-2A95-8BC1-6BED-E1481CA3C123}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2272
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵PID:2396
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2672
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3752
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1952
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1012
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3924
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:64
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3172
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4924
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2968
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2984
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5104
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1404
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2512
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:2688
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3216
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:4536
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c4cc5d37a94bfea307880ec294545449
SHA12818f9f126051fd85511f32f881fcd4d844baf96
SHA2566fe197a1ad00e11d795af415ba03ae6c434c0be1916d9f2553e51590ce87d310
SHA512c5a7968a446be5963306599fab3052ebe02e25ad1fcc71ba6d7cb76d767b1a6dfc0a6ac07a184f9999b42a015f93647a7333f1370f67171d2995fa0307e4cede
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
1KB
MD5963146083fe374ae23a67448d63bc620
SHA12448befee1fb7057308afafdf9265610acbc42b9
SHA256d1e2940cd2225f75a66bb66005945bbae7403bb979212b673d9e188d383ab0ca
SHA5126109ce143104d222d58aedc548793a69bcbb177cc768c831e1176cf69221a7dcbad56e8b5007d2215f41e020b1f9880eb5fc01cc2f934d68c04aa730a7cc7aba
-
Filesize
300B
MD55807dbdb0aa9156ab44cd310c0c60428
SHA1bd144bf252b3e8595881467eeb049271a4535bb5
SHA25681b0b200867139dad232e22131799ab5836cd7ee429f179b9c767c6ed2e0b0d3
SHA512497d73bbf28f1ee251acc24b6a0a2089b8a6940767dd3972128e347578c019063ccfdc9d077ae70192d12fb0f38e10e583f08e56e2f524acc9e521ce2af915fe
-
Filesize
2.3MB
MD568d90c681c9748e8489f3f9fc622301d
SHA1931ebcaec96692ba2054379a489a4af0451bf630
SHA256cfbcf827900a5dc36d1d2ba4b4879ce703a429b1952e6e9616f498a9bde68c91
SHA5124dcd84246dec0522787dff8fb1ff90e418e1ed47496f9e35e56e5c5c26dcc8a2283a0478bcbd44d61a763ea46b050675aca1d93a6ff628d39f7f51e254fbdd80
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
1.7MB
MD51538b51a67fde66f3b41b5ac47f4ac1b
SHA1296956729df307b32e8fd9fd4388e6f2dbfb5298
SHA2560053300049b43fe839eb1c630b42157f5dd7dfddb49e9ee77a5ce317f925727a
SHA5129f6507d23f7c2be73fc3b43de3e90fb80c76d0aae618deb73658e8c225357e9d9a2d54111e306f3d9caed177a0a8e8c5c162c91cdef3502c45e050c168c5c8f5
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
13.2MB
MD58c09542fc8d91b14c95ee99e096b44d6
SHA16bd9352b444c38703e3385eca1e1c32b770a1ff5
SHA256fe7444376e01135fbd3bc2d13d2cf599a355d1919eb0c1a18be8fd0cc4cd8ca7
SHA512ab67dce12f6003aa5865ea1fbda25e12dd13f604194133060a90637642e50abffb92fe90577478a013a59465d5dc58c3f2f1ab0bc3f4ebec7ae381a2a7987f23
-
Filesize
20KB
MD506a5bb0858b672f816aced409993feb6
SHA1eb8467217d1a4436aa80727643877815655701ee
SHA256eb1bc5c7a7e7c0458e5a7567720a735f9685a2caaa94365ce871eb77baae4172
SHA512160fd926e83ec00ee9eace8d9b35c5c40f48a943704fd4212f7d8d46c9e6f4d03b1efd963fe47b943d3dfe489935931e15d30399f85db87755d90c63b9eabb91
-
Filesize
32B
MD5db8332eca6977d932f5f8729815d9046
SHA1f9c93d0ad19f8c54dd229c93c39d8589a6785c88
SHA2564b27dc533ce42ac1ab0d89cdf9cb399c673537ec624193911f4a4906ce784854
SHA512ef0dbc6730103d8e0d4817d86885ccb9d1171a90929744f3e4e0a609b99b2fdc6898c98bb87608cfbe3c00dd245b61eb1fa67f8d3a944e61c9fbab84f888c4a3
-
Filesize
36KB
MD5ee5b003da9451399cb7482d169bd0da6
SHA1c0ed14c89061e4c6b77eba7fafe87b064e41fbed
SHA2569fdb28d2614a026ab72de0a7706f400a990247d778d4067c7cc40be4eb102b0c
SHA5128db3935fb33dc7fe3c0b4a6897da7f8b73430ad7fd465b4300a9ab66ae9a03d06f5cb677ee818dd16eab251231a01a3ba58369226cdda84ebef7c98aa3c4890c
-
Filesize
33KB
MD58976e5b29a56e2971fb6bcc822f3c83d
SHA103bb80289d77d317cd70f1db219b966c0230dc84
SHA256631da407ce7a69d82fc3c5914c7c0282be341182d0146b72c398f14605d5e404
SHA51270633a3187ee3b77a184469aa87b1735fb678337d574ab63bce19fba140fc604334840b5e03f173e1dd58b9c3d6301d706c4d855d88115c380062ac5a96529b4