Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-10-2024 18:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe
Resource
win7-20240903-en
windows7-x64
30 signatures
150 seconds
Behavioral task
behavioral2
Sample
1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
28 signatures
150 seconds
General
-
Target
1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe
-
Size
2.6MB
-
MD5
cf50063a3105d27ba3063575bdf494d6
-
SHA1
d466e9fb8302c07973e9835b252359fe63e0c999
-
SHA256
1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9
-
SHA512
67531b0de8623942929af87f19d10e9945ff599ff04b355643587be7ceac01f6f6273430c70a8e4308a9daee97250334a66e6e52a3ef9c3fda272bdf024eaef9
-
SSDEEP
49152:wgwRXifu1DBgutBPNv4gYlMiokURXK02xaRQBBKhPyla3Crg1Qew1v4Chp/:wgwRXvguPPl4gYlrokhpxxKhPybrQQPh
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\README.txt
Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com
What happened to your files ?
All of your files were protected by a strong encryption with RSA4096
More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)
How did this happen ?
!!! Specially for your PC was generated personal RSA4096 Key , both public and private.
!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.
!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server
What do I do ?
So , there are two ways you can choose: wait for a _miracle_ and get _your_ PRICE DOUBLED! Or start obtaining *BITCOIN NOW! , and restore _YOUR_ _DATA_ easy way
If You have really valuable _DATA_, you better _NOT_ _WASTE_ _YOUR_ _TIME_, because there is _NO_ other way to get your files, except make a _PAYMENT_
Your personal ID: q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38*[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38
If you want to recover your files, write us to our mail
1)[email protected]
And add me/write message - Decryptionguy (use search)
2)[email protected]
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software - it may cause permanent data loss.
We are always ready to cooperate and find the best way to solve your problem.
The faster you write - the more favorable conditions will be for you.
Our company values its reputation. We give all guarantees of your files decryption.
--------------------------------------------------------------------------------------------------------------------------------------------
Emails
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral1/files/0x00070000000192a9-29.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3" DC.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1652 bcdedit.exe 2876 bcdedit.exe -
Renames multiple (9182) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 2744 wbadmin.exe -
pid Process 2768 wbadmin.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocautoupds.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe -
Deletes itself 1 IoCs
pid Process 2680 cmd.exe -
Executes dropped EXE 12 IoCs
pid Process 2472 7za.exe 2416 7za.exe 2808 [email protected]_no gui.exe 3064 PIDAR.exe 2612 Everything.exe 2504 PIDAR.exe 1980 PIDAR.exe 640 PIDAR.exe 1628 DC.exe 1540 Everything.exe 2816 xdel.exe 1036 xdel.exe -
Loads dropped DLL 18 IoCs
pid Process 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 2808 [email protected]_no gui.exe 2808 [email protected]_no gui.exe 3064 PIDAR.exe 3064 PIDAR.exe 2504 PIDAR.exe 1980 PIDAR.exe 640 PIDAR.exe 592 cmd.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command [email protected]_no gui.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open [email protected]_no gui.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" [email protected]_no gui.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open\command PIDAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" [email protected]_no gui.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open\command [email protected]_no gui.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell [email protected]_no gui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection DC.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PIDAR = "\"C:\\Users\\Admin\\AppData\\Local\\1D4F026E-DB59-647A-72D2-3763F22A75A1\\PIDAR.exe\" " [email protected]_no gui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PIDAR.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\README.txt\"" PIDAR.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\I: Everything.exe -
Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 444 powercfg.exe 1236 powercfg.exe 1012 powercfg.exe 2712 powercfg.exe 2624 powercfg.exe 1568 powercfg.exe 1468 powercfg.exe 2636 powercfg.exe 352 powercfg.exe 380 powercfg.exe 2736 powercfg.exe 2884 powercfg.exe 1724 powercfg.exe 2748 powercfg.exe 2768 powercfg.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol DC.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini DC.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar.datastore@cyberfear.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jre7\bin\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.runtime_3.10.0.v20140318-2214.jar.datastore@cyberfear.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\eo\LC_MESSAGES\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.ja_5.5.0.165303.jar.datastore@cyberfear.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.datastore@cyberfear.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_zh_CN.jar.datastore@cyberfear.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jre7\lib\management\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_zh_4.4.0.v20140623020002.jar.datastore@cyberfear.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar.datastore@cyberfear.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.datastore@cyberfear.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.datastore@cyberfear.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\css\[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe -
pid Process 2904 powershell.exe 1184 powershell.exe 1268 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected]_no gui.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdel.exe -
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38 PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open\command [email protected]_no gui.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open [email protected]_no gui.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open\command PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell [email protected]_no gui.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command PIDAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" [email protected]_no gui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command [email protected]_no gui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" [email protected]_no gui.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.com-q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38\ = "mimicfile" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\README.txt\"" PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\exefile [email protected]_no gui.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command PIDAR.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2152 notepad.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 1628 DC.exe 1628 DC.exe 1628 DC.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 3064 PIDAR.exe 1628 DC.exe 1184 powershell.exe 2904 powershell.exe 1268 powershell.exe 1980 PIDAR.exe 640 PIDAR.exe 3064 PIDAR.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2472 7za.exe Token: 35 2472 7za.exe Token: SeRestorePrivilege 2416 7za.exe Token: 35 2416 7za.exe Token: SeSecurityPrivilege 2416 7za.exe Token: SeSecurityPrivilege 2416 7za.exe Token: SeIncreaseQuotaPrivilege 2808 [email protected]_no gui.exe Token: SeSecurityPrivilege 2808 [email protected]_no gui.exe Token: SeTakeOwnershipPrivilege 2808 [email protected]_no gui.exe Token: SeLoadDriverPrivilege 2808 [email protected]_no gui.exe Token: SeSystemProfilePrivilege 2808 [email protected]_no gui.exe Token: SeSystemtimePrivilege 2808 [email protected]_no gui.exe Token: SeProfSingleProcessPrivilege 2808 [email protected]_no gui.exe Token: SeIncBasePriorityPrivilege 2808 [email protected]_no gui.exe Token: SeCreatePagefilePrivilege 2808 [email protected]_no gui.exe Token: SeBackupPrivilege 2808 [email protected]_no gui.exe Token: SeRestorePrivilege 2808 [email protected]_no gui.exe Token: SeShutdownPrivilege 2808 [email protected]_no gui.exe Token: SeDebugPrivilege 2808 [email protected]_no gui.exe Token: SeSystemEnvironmentPrivilege 2808 [email protected]_no gui.exe Token: SeChangeNotifyPrivilege 2808 [email protected]_no gui.exe Token: SeRemoteShutdownPrivilege 2808 [email protected]_no gui.exe Token: SeUndockPrivilege 2808 [email protected]_no gui.exe Token: SeManageVolumePrivilege 2808 [email protected]_no gui.exe Token: SeImpersonatePrivilege 2808 [email protected]_no gui.exe Token: SeCreateGlobalPrivilege 2808 [email protected]_no gui.exe Token: 33 2808 [email protected]_no gui.exe Token: 34 2808 [email protected]_no gui.exe Token: 35 2808 [email protected]_no gui.exe Token: SeIncreaseQuotaPrivilege 3064 PIDAR.exe Token: SeSecurityPrivilege 3064 PIDAR.exe Token: SeTakeOwnershipPrivilege 3064 PIDAR.exe Token: SeLoadDriverPrivilege 3064 PIDAR.exe Token: SeSystemProfilePrivilege 3064 PIDAR.exe Token: SeSystemtimePrivilege 3064 PIDAR.exe Token: SeProfSingleProcessPrivilege 3064 PIDAR.exe Token: SeIncBasePriorityPrivilege 3064 PIDAR.exe Token: SeCreatePagefilePrivilege 3064 PIDAR.exe Token: SeBackupPrivilege 3064 PIDAR.exe Token: SeRestorePrivilege 3064 PIDAR.exe Token: SeShutdownPrivilege 3064 PIDAR.exe Token: SeDebugPrivilege 3064 PIDAR.exe Token: SeSystemEnvironmentPrivilege 3064 PIDAR.exe Token: SeChangeNotifyPrivilege 3064 PIDAR.exe Token: SeRemoteShutdownPrivilege 3064 PIDAR.exe Token: SeUndockPrivilege 3064 PIDAR.exe Token: SeManageVolumePrivilege 3064 PIDAR.exe Token: SeImpersonatePrivilege 3064 PIDAR.exe Token: SeCreateGlobalPrivilege 3064 PIDAR.exe Token: 33 3064 PIDAR.exe Token: 34 3064 PIDAR.exe Token: 35 3064 PIDAR.exe Token: SeDebugPrivilege 1628 DC.exe Token: SeAssignPrimaryTokenPrivilege 1628 DC.exe Token: SeIncreaseQuotaPrivilege 2504 PIDAR.exe Token: SeSecurityPrivilege 2504 PIDAR.exe Token: SeTakeOwnershipPrivilege 2504 PIDAR.exe Token: SeLoadDriverPrivilege 2504 PIDAR.exe Token: SeSystemProfilePrivilege 2504 PIDAR.exe Token: SeSystemtimePrivilege 2504 PIDAR.exe Token: SeProfSingleProcessPrivilege 2504 PIDAR.exe Token: SeIncBasePriorityPrivilege 2504 PIDAR.exe Token: SeCreatePagefilePrivilege 2504 PIDAR.exe Token: SeBackupPrivilege 2504 PIDAR.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2612 Everything.exe 1540 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2472 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 30 PID 3044 wrote to memory of 2472 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 30 PID 3044 wrote to memory of 2472 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 30 PID 3044 wrote to memory of 2472 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 30 PID 3044 wrote to memory of 2416 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 32 PID 3044 wrote to memory of 2416 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 32 PID 3044 wrote to memory of 2416 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 32 PID 3044 wrote to memory of 2416 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 32 PID 3044 wrote to memory of 2808 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 34 PID 3044 wrote to memory of 2808 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 34 PID 3044 wrote to memory of 2808 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 34 PID 3044 wrote to memory of 2808 3044 1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe 34 PID 2808 wrote to memory of 3064 2808 [email protected]_no gui.exe 35 PID 2808 wrote to memory of 3064 2808 [email protected]_no gui.exe 35 PID 2808 wrote to memory of 3064 2808 [email protected]_no gui.exe 35 PID 2808 wrote to memory of 3064 2808 [email protected]_no gui.exe 35 PID 3064 wrote to memory of 2612 3064 PIDAR.exe 36 PID 3064 wrote to memory of 2612 3064 PIDAR.exe 36 PID 3064 wrote to memory of 2612 3064 PIDAR.exe 36 PID 3064 wrote to memory of 2612 3064 PIDAR.exe 36 PID 3064 wrote to memory of 592 3064 PIDAR.exe 37 PID 3064 wrote to memory of 592 3064 PIDAR.exe 37 PID 3064 wrote to memory of 592 3064 PIDAR.exe 37 PID 3064 wrote to memory of 592 3064 PIDAR.exe 37 PID 3064 wrote to memory of 2504 3064 PIDAR.exe 38 PID 3064 wrote to memory of 2504 3064 PIDAR.exe 38 PID 3064 wrote to memory of 2504 3064 PIDAR.exe 38 PID 3064 wrote to memory of 2504 3064 PIDAR.exe 38 PID 3064 wrote to memory of 640 3064 PIDAR.exe 39 PID 3064 wrote to memory of 640 3064 PIDAR.exe 39 PID 3064 wrote to memory of 640 3064 PIDAR.exe 39 PID 3064 wrote to memory of 640 3064 PIDAR.exe 39 PID 3064 wrote to memory of 1980 3064 PIDAR.exe 40 PID 3064 wrote to memory of 1980 3064 PIDAR.exe 40 PID 3064 wrote to memory of 1980 3064 PIDAR.exe 40 PID 3064 wrote to memory of 1980 3064 PIDAR.exe 40 PID 592 wrote to memory of 1628 592 cmd.exe 42 PID 592 wrote to memory of 1628 592 cmd.exe 42 PID 592 wrote to memory of 1628 592 cmd.exe 42 PID 592 wrote to memory of 1628 592 cmd.exe 42 PID 3064 wrote to memory of 2624 3064 PIDAR.exe 44 PID 3064 wrote to memory of 2624 3064 PIDAR.exe 44 PID 3064 wrote to memory of 2624 3064 PIDAR.exe 44 PID 3064 wrote to memory of 2624 3064 PIDAR.exe 44 PID 3064 wrote to memory of 2768 3064 PIDAR.exe 45 PID 3064 wrote to memory of 2768 3064 PIDAR.exe 45 PID 3064 wrote to memory of 2768 3064 PIDAR.exe 45 PID 3064 wrote to memory of 2768 3064 PIDAR.exe 45 PID 3064 wrote to memory of 2884 3064 PIDAR.exe 47 PID 3064 wrote to memory of 2884 3064 PIDAR.exe 47 PID 3064 wrote to memory of 2884 3064 PIDAR.exe 47 PID 3064 wrote to memory of 2884 3064 PIDAR.exe 47 PID 3064 wrote to memory of 2736 3064 PIDAR.exe 48 PID 3064 wrote to memory of 2736 3064 PIDAR.exe 48 PID 3064 wrote to memory of 2736 3064 PIDAR.exe 48 PID 3064 wrote to memory of 2736 3064 PIDAR.exe 48 PID 3064 wrote to memory of 2748 3064 PIDAR.exe 49 PID 3064 wrote to memory of 2748 3064 PIDAR.exe 49 PID 3064 wrote to memory of 2748 3064 PIDAR.exe 49 PID 3064 wrote to memory of 2748 3064 PIDAR.exe 49 PID 3064 wrote to memory of 1724 3064 PIDAR.exe 51 PID 3064 wrote to memory of 1724 3064 PIDAR.exe 51 PID 3064 wrote to memory of 1724 3064 PIDAR.exe 51 PID 3064 wrote to memory of 1724 3064 PIDAR.exe 51 -
System policy modification 1 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " " PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System PIDAR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" PIDAR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "NOT YOUR LANGUAGE? USE https://translate.google.com\n \nWhat happened to your files ?\nAll of your files were protected by a strong encryption with RSA4096\nMore information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem)\n \nHow did this happen ?\n!!! Specially for your PC was generated personal RSA4096 Key , both public and private.\n!!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet.\n!!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server\n \nWhat do I do ?\nSo , there are two ways you can choose: wait for a _miracle_ and get _your_ PRICE DOUBLED! Or start obtaining *BITCOIN NOW! , and restore _YOUR_ _DATA_ easy way\nIf You have really valuable _DATA_, you better _NOT_ _WASTE_ _YOUR_ _TIME_, because there is _NO_ other way to get your files, except make a _PAYMENT_\n \n \nYour personal ID: q1JCQM07Ehvo_LaXm0w9jJv_SslSycSxNw8IIuskb38*[email protected]_LaXm0w9jJv_SslSycSxNw8IIuskb38 \n \n\nIf you want to recover your files, write us to our mail\n1)[email protected]\nAnd add me/write message - Decryptionguy (use search)\n2)[email protected]\n\nAttention!\n\nDo not rename encrypted files. \nDo not try to decrypt your data using third party software - it may cause permanent data loss. \nWe are always ready to cooperate and find the best way to solve your problem. \nThe faster you write - the more favorable conditions will be for you. \nOur company values its reputation. We give all guarantees of your files decryption.\n \n--------------------------------------------------------------------------------------------------------------------------------------------\n" PIDAR.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer PIDAR.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe"C:\Users\Admin\AppData\Local\Temp\1fa8b306a98b3aa8e3338e4f3e80c036feb16b18163778cf9433115cbd8ea8e9.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p1946518016400410350 Everything64.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]_no gui.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]_no gui.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\PIDAR.exe"C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\PIDAR.exe"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3064 -
C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\Everything.exe"C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2612
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\DC.exeDC.exe /D5⤵
- Modifies security service
- Executes dropped EXE
- Windows security modification
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-
-
C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\PIDAR.exe"C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\PIDAR.exe" -e watch -pid 3064 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\PIDAR.exe"C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\PIDAR.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:640
-
-
C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\PIDAR.exe"C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\PIDAR.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1980
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -H off4⤵
- Power Settings
PID:2624
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:2768
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:2884
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:2736
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:2748
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1724
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1236
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:380
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:2712
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1012
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:352
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:2636
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1468
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵
- Power Settings
PID:1568
-
-
C:\Windows\system32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵
- Power Settings
PID:444
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1184
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2904
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:1652
-
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2876
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
PID:2744
-
-
C:\Windows\system32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:2768
-
-
C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\Everything.exe"C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1540
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AllowMultipleTSSessions" /t REG_DWORD /d 0x1 /f4⤵
- System Location Discovery: System Language Discovery
PID:1896
-
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fSingleSessionPerUser" /t REG_DWORD /d 0x0 /f4⤵
- System Location Discovery: System Language Discovery
PID:1948
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\Users\Admin\AppData\Local\README.txt"4⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:2152
-
-
C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\xdel.exe"C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\xdel.exe" -accepteula -p 1 -c C:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816
-
-
C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\xdel.exe"C:\Users\Admin\AppData\Local\1D4F026E-DB59-647A-72D2-3763F22A75A1\xdel.exe" -accepteula -p 1 -c F:\4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1036
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2680
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2276
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1672
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:2208
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:2260
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵PID:1432
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.2MB
MD54e943bbc9c5e53255a74d9a6c5fe43af
SHA1cc1bcfca78803f2b578bd1f32a0c12c2b94cad37
SHA2567977fbf78edd21ea6d9a6274b09fb4929df0a85ac9b87eb67b1231709bd9dad3
SHA512b7be4ee5e6996f20e2b875eeda8a99ffa2348fc0ab37ea41952f2b9659bca3a17caac19de0827e61dfe70182e1eb10b2355f137fd8e7aa64f8c55961a2f58b8c
-
Filesize
20KB
MD5744fc6e97e93deba04f42c11dc8ba0d0
SHA154cf267553d2ae5fa42bca74750a4dcf81474579
SHA256639816eaba463c61e7bab67a7eca80885c1799bb31f6adba4b98b8a5d2c52465
SHA51238bcec92e2ff6f2025d95d4450ddee5852d27c1ade92fde191adfd58e1498ce9efefaf83ba19747b9b080d24ffca7d786d20a1650f8e983a9abc4ba27fe6a49e
-
Filesize
1KB
MD585799e5aab5fd1a8a44a1d25b18ab9f5
SHA1489bad51dd89cad67c999fe25c6ce4a10450e9b5
SHA25607368e6b06a0c6f65c9653975a2f13a4b7cfda11b75c1fc6dda850fa76477fb5
SHA5120c43e323b9abca0fcd4b2c3e1ef8f7d65ee6f9341f01cd6078e4037f5791a8af63d166bb5ff10d935688acf102aec05e52450325a3e7b266a73b6ccc01b3413a
-
Filesize
300B
MD5029b68a0ebac33e45a8a8dea7a79df81
SHA1489701bb5fe85f53efb65d7eeade4d7c455f3aad
SHA256e3eea71d4421322a6be2b7229ccbd42aeb84ec77a096054f12cc9fec5d93dd3c
SHA512ef30db8b516066656a595cdb5bcfad392c51c9d367cdb07c1f8a99fd01df83d37578338729ebded318364f0babd9725137f2384400a9c2f21416138eccc03718
-
Filesize
802KB
MD5ac34ba84a5054cd701efad5dd14645c9
SHA1dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
SHA256c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
SHA512df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
1.6MB
MD5b8dee63df27fbefc900ba69a8392d7a0
SHA14abf7f478e48031bf66cae68d67b9eb658f0123b
SHA256b9f64f96b17d05a523d65518549581e83b1f5b22d72bb91ade0e18cf5e2cde29
SHA5121c05beccdf9823594dd83635c84f7841148100dd1c883590dd28f4bd5a5be27f80113fa16f734c571ff4a067c60901091921951e51483b64fed7fea723ddc3eb
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]_no gui.exe
Filesize2.3MB
MD57e0ed5c2eda1b54c016f6ff95737fd59
SHA1e322ba47cd719e1f05f50e6df709a707378519b0
SHA256d7c3d9e42084f4319428f4624d8f1f9e707d758c1d95f0a6c1b39bc913fd5f8b
SHA512eb25f6264c4ed7e61ad5480986a9db90edb9ceb719569452cd13a6b48a1181f68ba498ce03da061b082a1f432c1c4b007360029ff1c3bdb9ff53d9c4a55484f1
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5630c4d4da589f20d5fa5cbd69c670e8c
SHA14395934d40d899dbd2e9f896be6f1c55b062f925
SHA256671101a7b651b17f95dfd75ddc6c8ed7aa9120400f2f2c04ed0354f9edba2548
SHA512808fae93c1f3210c90d3c448e8667bca441469598de3f2c0973eb6938a2f29c4c39962689ebd8e7d53deb8a867aee57bebf7441baaa0c7c8788e2ed1c2183669
-
Filesize
233B
MD5cd4326a6fd01cd3ca77cfd8d0f53821b
SHA1a1030414d1f8e5d5a6e89d5a309921b8920856f9
SHA2561c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c
SHA51229ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67
-
Filesize
32B
MD5e6c5abba654152bc9e85ebe5578b95d5
SHA182739534235843dfbf0b165709cdd4ef2b7dca42
SHA256532d3d9903695f2f781b1988d58d9307f07047d601bb09a6817bbc2806eacd98
SHA512fc7e7f12996da40da67cefd4b118e157867711371c7792bd88817d07c26b91f2af52bc2782a565706ebcd26a536e158a9a146e06a81263e60ffa87c414f2e10b
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5