Analysis
-
max time kernel
127s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 01:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe
Resource
win7-20240903-en
windows7-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
29 signatures
150 seconds
General
-
Target
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe
-
Size
2.2MB
-
MD5
801c430414f434df6fc24a9891b3b118
-
SHA1
27301b1a6c2078f4eec06ec6f1f947f22a1598fc
-
SHA256
2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68
-
SHA512
e2c5e42a09c235d89ceb298ed27815c5b922e547568111ae916032f5cb85d89b197080d6641cf697f2fa18e11aebe66bef1669dc2155e9a89bfeb5e05eff1c29
-
SSDEEP
49152:wgwRwifu1DBgutBPNcpwcjVpNMkCZZpsYpmwZ3hQ8cTEo8:wgwRwvguPP4wc3NMkCGGmugTEt
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\README.txt
Ransom Note
Hello my dear friend (Do not scan the files with antivirus in any case. In case of data loss, the consequences are yours)
Your data is encrypted
Your personal ID: 7Z-tqjqXXQrFdts9ktmGZ5kdMqlPIpWgEte4gu8wCgE*[email protected]
Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted
The only method of recovering files is to purchase decrypt tool and unique key for you.
Write to our mail - [email protected]
In case of no answer in 24 hours write us to this backup e-mail: [email protected]
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly.
Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software - it may cause permanent data loss.
We are always ready to cooperate and find the best way to solve your problem.
The faster you write - the more favorable conditions will be for you.
Our company values its reputation. We give all guarantees of your files decryption.
What are your recommendations?
- Never change the name of the files, if you want to manipulate the files, be sure to back them up. If there are any problems with the files, we are not responsible for them.
- Never work with intermediary companies because they charge you more money.Don't be afraid of us, just email us.
Sensitive data on your system was DOWNLOADED.
If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly.
Data includes:
- Employees personal data, CVs, DL, SSN.
- Complete network map including credentials for local and remote services.
- Private financial information including: clients data, bills, budgets, annual reports, bank statements.
- Manufacturing documents including: datagrams, schemas, drawings in solidworks format
- And more...
What are the dangers of leaking your company's data.
First of all, you will receive fines from the government such as the GDRP and many others, you can be sued by customers of your firm for leaking information that was confidential. Your leaked data will be used by all the hackers on the planet for various unpleasant things. For example, social engineering, your employees' personal data can be used to re-infiltrate your company. Bank details and passports can be used to create bank accounts and online wallets through which criminal money will be laundered. On another vacation trip, you will have to explain to the FBI where you got millions of dollars worth of stolen cryptocurrency transferred through your accounts on cryptocurrency exchanges. Your personal information could be used to make loans or buy appliances. You would later have to prove in court that it wasn't you who took out the loan and pay off someone else's loan. Your competitors may use the stolen information to steal technology or to improve their processes, your working methods, suppliers, investors, sponsors, employees, it will all be in the public domain. You won't be happy if your competitors lure your employees to other firms offering better wages, will you? Your competitors will use your information against you. For example, look for tax violations in the financial documents or any other violations, so you have to close your firm. According to statistics, two thirds of small and medium-sized companies close within half a year after a data breach. You will have to find and fix the vulnerabilities in your network, work with the customers affected by data leaks. All of these are very costly procedures that can exceed the cost of a ransomware buyout by a factor of hundreds. It's much easier, cheaper and faster to pay us the ransom. Well and most importantly, you will suffer a reputational loss, you have been building your company for many years, and now your reputation will be destroyed.
Do not go to the police or FBI for help and do not tell anyone that we attacked you.
They won't help and will only make your situation worse. In 7 years not a single member of our group has been caught by the police, we are top-notch hackers and never leave a trace of crime. The police will try to stop you from paying the ransom in any way they can. The first thing they will tell you is that there is no guarantee to decrypt your files and delete the stolen files, this is not true, we can do a test decryption before payment and your data will be guaranteed to be deleted because it is a matter of our reputation, we make hundreds of millions of dollars and we are not going to lose income because of your files. It is very beneficial for the police and the FBI to let everyone on the planet know about the leak of your data, because then your state will receive fines under GDPR and other similar laws. The fines will go to fund the police and FBI. The police and FBI will not be able to stop lawsuits from your customers for leaking personal and private information. The police and FBI will not protect you from repeat attacks. Paying us a ransom is much cheaper and more profitable than paying fines and legal fees.
If you do not pay the ransom, we will attack your company again in the future.
Emails
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral2/files/0x0007000000023c8e-35.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
Mimic family
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 324 bcdedit.exe 3416 bcdedit.exe -
Renames multiple (5868) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4668 wbadmin.exe -
pid Process 3252 wbadmin.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe -
Executes dropped EXE 9 IoCs
pid Process 1164 7za.exe 1784 7za.exe 184 [email protected] 3444 PIDAR.exe 856 PIDAR.exe 3600 PIDAR.exe 3260 PIDAR.exe 2424 Everything.exe 4460 Everything.exe -
Loads dropped DLL 5 IoCs
pid Process 184 [email protected] 3444 PIDAR.exe 3260 PIDAR.exe 856 PIDAR.exe 3600 PIDAR.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell [email protected] Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open [email protected] Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command [email protected] Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" [email protected] Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" [email protected] -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PIDAR = "\"C:\\Users\\Admin\\AppData\\Local\\3F4FFA8F-24F8-6F78-A0DA-370314484853\\PIDAR.exe\" " [email protected] -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\A: Everything.exe -
Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1732 powercfg.exe 1224 powercfg.exe 4296 powercfg.exe 4888 powercfg.exe 692 powercfg.exe 380 powercfg.exe 2952 powercfg.exe 3280 powercfg.exe 2284 powercfg.exe 3300 powercfg.exe 1532 powercfg.exe 4928 powercfg.exe 852 powercfg.exe 3304 powercfg.exe 3144 powercfg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\[email protected] PIDAR.exe File opened for modification C:\Program Files\Windows Mail\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] PIDAR.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\[email protected] PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ja-jp\[email protected] PIDAR.exe File opened for modification C:\Program Files\7-Zip\Lang\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.Demetro9990@cock.li PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-si\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\[email protected] PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\Analysis\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\it-it\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\it-it\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fi-fi\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\[email protected] PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fa\LC_MESSAGES\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - [email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019DemoR_BypassTrial180-ppd.xrm-ms.Demetro9990@cock.li PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\[email protected] PIDAR.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jre-1.8\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\[email protected] PIDAR.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe -
pid Process 400 powershell.exe 3356 powershell.exe 4540 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe -
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command [email protected] Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" [email protected] Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\README.txt\"" PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\.li PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.li\ = "mimicfile" PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command [email protected] Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell [email protected] Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\exefile\shell\open [email protected] -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 3444 PIDAR.exe 400 powershell.exe 400 powershell.exe 3600 PIDAR.exe 3600 PIDAR.exe 3356 powershell.exe 3356 powershell.exe 3260 PIDAR.exe 3260 PIDAR.exe 4540 powershell.exe 4540 powershell.exe 400 powershell.exe 3356 powershell.exe 4540 powershell.exe 3444 PIDAR.exe 3444 PIDAR.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1164 7za.exe Token: 35 1164 7za.exe Token: SeRestorePrivilege 1784 7za.exe Token: 35 1784 7za.exe Token: SeSecurityPrivilege 1784 7za.exe Token: SeSecurityPrivilege 1784 7za.exe Token: SeIncreaseQuotaPrivilege 184 [email protected] Token: SeSecurityPrivilege 184 [email protected] Token: SeTakeOwnershipPrivilege 184 [email protected] Token: SeLoadDriverPrivilege 184 [email protected] Token: SeSystemProfilePrivilege 184 [email protected] Token: SeSystemtimePrivilege 184 [email protected] Token: SeProfSingleProcessPrivilege 184 [email protected] Token: SeIncBasePriorityPrivilege 184 [email protected] Token: SeCreatePagefilePrivilege 184 [email protected] Token: SeBackupPrivilege 184 [email protected] Token: SeRestorePrivilege 184 [email protected] Token: SeShutdownPrivilege 184 [email protected] Token: SeDebugPrivilege 184 [email protected] Token: SeSystemEnvironmentPrivilege 184 [email protected] Token: SeChangeNotifyPrivilege 184 [email protected] Token: SeRemoteShutdownPrivilege 184 [email protected] Token: SeUndockPrivilege 184 [email protected] Token: SeManageVolumePrivilege 184 [email protected] Token: SeImpersonatePrivilege 184 [email protected] Token: SeCreateGlobalPrivilege 184 [email protected] Token: 33 184 [email protected] Token: 34 184 [email protected] Token: 35 184 [email protected] Token: 36 184 [email protected] Token: SeIncreaseQuotaPrivilege 3444 PIDAR.exe Token: SeSecurityPrivilege 3444 PIDAR.exe Token: SeTakeOwnershipPrivilege 3444 PIDAR.exe Token: SeLoadDriverPrivilege 3444 PIDAR.exe Token: SeSystemProfilePrivilege 3444 PIDAR.exe Token: SeSystemtimePrivilege 3444 PIDAR.exe Token: SeProfSingleProcessPrivilege 3444 PIDAR.exe Token: SeIncBasePriorityPrivilege 3444 PIDAR.exe Token: SeCreatePagefilePrivilege 3444 PIDAR.exe Token: SeBackupPrivilege 3444 PIDAR.exe Token: SeRestorePrivilege 3444 PIDAR.exe Token: SeShutdownPrivilege 3444 PIDAR.exe Token: SeDebugPrivilege 3444 PIDAR.exe Token: SeSystemEnvironmentPrivilege 3444 PIDAR.exe Token: SeChangeNotifyPrivilege 3444 PIDAR.exe Token: SeRemoteShutdownPrivilege 3444 PIDAR.exe Token: SeUndockPrivilege 3444 PIDAR.exe Token: SeManageVolumePrivilege 3444 PIDAR.exe Token: SeImpersonatePrivilege 3444 PIDAR.exe Token: SeCreateGlobalPrivilege 3444 PIDAR.exe Token: 33 3444 PIDAR.exe Token: 34 3444 PIDAR.exe Token: 35 3444 PIDAR.exe Token: 36 3444 PIDAR.exe Token: SeIncreaseQuotaPrivilege 3600 PIDAR.exe Token: SeSecurityPrivilege 3600 PIDAR.exe Token: SeTakeOwnershipPrivilege 3600 PIDAR.exe Token: SeLoadDriverPrivilege 3600 PIDAR.exe Token: SeSystemProfilePrivilege 3600 PIDAR.exe Token: SeSystemtimePrivilege 3600 PIDAR.exe Token: SeProfSingleProcessPrivilege 3600 PIDAR.exe Token: SeIncBasePriorityPrivilege 3600 PIDAR.exe Token: SeCreatePagefilePrivilege 3600 PIDAR.exe Token: SeBackupPrivilege 3600 PIDAR.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2424 Everything.exe 4460 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 1164 4872 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe 86 PID 4872 wrote to memory of 1164 4872 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe 86 PID 4872 wrote to memory of 1164 4872 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe 86 PID 4872 wrote to memory of 1784 4872 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe 88 PID 4872 wrote to memory of 1784 4872 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe 88 PID 4872 wrote to memory of 1784 4872 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe 88 PID 4872 wrote to memory of 184 4872 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe 90 PID 4872 wrote to memory of 184 4872 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe 90 PID 4872 wrote to memory of 184 4872 2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe 90 PID 184 wrote to memory of 3444 184 [email protected] 91 PID 184 wrote to memory of 3444 184 [email protected] 91 PID 184 wrote to memory of 3444 184 [email protected] 91 PID 3444 wrote to memory of 856 3444 PIDAR.exe 94 PID 3444 wrote to memory of 856 3444 PIDAR.exe 94 PID 3444 wrote to memory of 856 3444 PIDAR.exe 94 PID 3444 wrote to memory of 3600 3444 PIDAR.exe 95 PID 3444 wrote to memory of 3600 3444 PIDAR.exe 95 PID 3444 wrote to memory of 3600 3444 PIDAR.exe 95 PID 3444 wrote to memory of 3260 3444 PIDAR.exe 96 PID 3444 wrote to memory of 3260 3444 PIDAR.exe 96 PID 3444 wrote to memory of 3260 3444 PIDAR.exe 96 PID 3444 wrote to memory of 2424 3444 PIDAR.exe 97 PID 3444 wrote to memory of 2424 3444 PIDAR.exe 97 PID 3444 wrote to memory of 2424 3444 PIDAR.exe 97 PID 3444 wrote to memory of 3300 3444 PIDAR.exe 100 PID 3444 wrote to memory of 3300 3444 PIDAR.exe 100 PID 3444 wrote to memory of 380 3444 PIDAR.exe 101 PID 3444 wrote to memory of 380 3444 PIDAR.exe 101 PID 3444 wrote to memory of 1532 3444 PIDAR.exe 102 PID 3444 wrote to memory of 1532 3444 PIDAR.exe 102 PID 3444 wrote to memory of 4928 3444 PIDAR.exe 103 PID 3444 wrote to memory of 4928 3444 PIDAR.exe 103 PID 3444 wrote to memory of 852 3444 PIDAR.exe 104 PID 3444 wrote to memory of 852 3444 PIDAR.exe 104 PID 3444 wrote to memory of 3304 3444 PIDAR.exe 105 PID 3444 wrote to memory of 3304 3444 PIDAR.exe 105 PID 3444 wrote to memory of 1732 3444 PIDAR.exe 106 PID 3444 wrote to memory of 1732 3444 PIDAR.exe 106 PID 3444 wrote to memory of 2952 3444 PIDAR.exe 107 PID 3444 wrote to memory of 2952 3444 PIDAR.exe 107 PID 3444 wrote to memory of 1224 3444 PIDAR.exe 108 PID 3444 wrote to memory of 1224 3444 PIDAR.exe 108 PID 3444 wrote to memory of 3280 3444 PIDAR.exe 109 PID 3444 wrote to memory of 3280 3444 PIDAR.exe 109 PID 3444 wrote to memory of 4296 3444 PIDAR.exe 110 PID 3444 wrote to memory of 4296 3444 PIDAR.exe 110 PID 3444 wrote to memory of 4888 3444 PIDAR.exe 111 PID 3444 wrote to memory of 4888 3444 PIDAR.exe 111 PID 3444 wrote to memory of 3144 3444 PIDAR.exe 112 PID 3444 wrote to memory of 3144 3444 PIDAR.exe 112 PID 3444 wrote to memory of 2284 3444 PIDAR.exe 113 PID 3444 wrote to memory of 2284 3444 PIDAR.exe 113 PID 3444 wrote to memory of 692 3444 PIDAR.exe 114 PID 3444 wrote to memory of 692 3444 PIDAR.exe 114 PID 3444 wrote to memory of 400 3444 PIDAR.exe 115 PID 3444 wrote to memory of 400 3444 PIDAR.exe 115 PID 3444 wrote to memory of 3356 3444 PIDAR.exe 116 PID 3444 wrote to memory of 3356 3444 PIDAR.exe 116 PID 3444 wrote to memory of 4540 3444 PIDAR.exe 117 PID 3444 wrote to memory of 4540 3444 PIDAR.exe 117 PID 3444 wrote to memory of 324 3444 PIDAR.exe 157 PID 3444 wrote to memory of 324 3444 PIDAR.exe 157 PID 3444 wrote to memory of 3416 3444 PIDAR.exe 158 PID 3444 wrote to memory of 3416 3444 PIDAR.exe 158 -
System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System PIDAR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection PIDAR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" PIDAR.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer PIDAR.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe"C:\Users\Admin\AppData\Local\Temp\2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p89905472210203597 Everything64.dll2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:184 -
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"3⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3444 -
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe" -e watch -pid 3444 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:856
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3600
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\PIDAR.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\Everything.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2424
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off4⤵
- Power Settings
PID:3300
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:380
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1532
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:4928
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:852
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:3304
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:1732
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:2952
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:1224
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:3280
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵
- Power Settings
PID:4296
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵
- Power Settings
PID:4888
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵
- Power Settings
PID:3144
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵
- Power Settings
PID:2284
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵
- Power Settings
PID:692
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4540
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:324
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:3416
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4668
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:3252
-
-
C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\Everything.exe"C:\Users\Admin\AppData\Local\3F4FFA8F-24F8-6F78-A0DA-370314484853\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4460
-
-
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2844
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1100
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4068
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3512
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2584
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2016
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3220
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:688
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2524
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2276
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:1120
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:2524
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1176
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:3064
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3916
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.2MB
MD5d15c9bb5964f413edfad814823832aae
SHA1166919f0bcf7ed56a36fd61df66f8ef514f04c5e
SHA2560f292c53dfc11ab5ba310095b21aaf48204c5043be885f47dd8e999c073cc539
SHA5122aa4dda6ae67c494a7706c83b8dbff2273de64b2ce019a63b3c4da6a64530791ac98d7aa3119c73d69a8b7289cf6db9d72ee5b98c3d86b28dbe573220afedf2c
-
Filesize
20KB
MD5e031c0543912a4d4a983ebf9cb6c3e94
SHA119a504ee176297c03d38abe704d07fcbe8a862b0
SHA256f3b34b7d89734aaacb05789a2833ff68990ea0f375ce669f57f94dded9703872
SHA5125ae3776ccb0f59138874e635b68a32d51e98b459742775b2fb097e99a7c427c287e640c88ebbd70527af20d0ccdd0ca9991d58cfd569edc59c6f56c84bfcce6f
-
Filesize
32B
MD52cd031fe63f41888c7daf152bc0cb919
SHA1621a2a56c7513b6c12fc1f5eb80d09b0ca1bb542
SHA25642faa83c2038b14d8cdd0c6330a0f17fb5865f1b8b6214b377fa1fa092672e0e
SHA5120614ebbb131c78beb9eddacb13a7503ec8b22115adac37011d3d30b7cfdcf92a0fa22e09ed2dcdec0616a812b37e8e8b8986cd5970c64ce61bb1180488591cb3
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD559d97011e091004eaffb9816aa0b9abd
SHA11602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA25618f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
SHA512d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
-
Filesize
1KB
MD5925acffe86071a2de4f77f059596a4d3
SHA10890e8b055f6bff77ee247625f0fc5399670f94c
SHA2565e9055bb1c76fcdd057a21e12ae737100ee272872f190a2de310ef14703ac76a
SHA51220e4912800b9fd9ed93f426fd6835232f7d34680d0007728ae9cc55e8bbae6acd0303e5fcf6d38261c8a4bbe61c50a958ecc82c9e09a80d20d2c7e12334d3790
-
Filesize
5KB
MD55cf0e7ed3f8463b92325619d1cfa2f25
SHA1f4819994f8eaa14d3592107825df01f2a8ded058
SHA256e447b78a3b363c1a348dc017c1e62ccb4c2c07ab325ab0190993d38cae0d962e
SHA512d79edef66678e9f6ecf9502c02b98e81c7d67228d05001dfb8906f4987b9c56486cbe4bedacfecab18c9a29dd408a6278cb5363686971e0d662c2e9e28154aaf
-
Filesize
772KB
MD5b93eb0a48c91a53bda6a1a074a4b431e
SHA1ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA256ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
SHA512732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\[email protected]
Filesize2.3MB
MD56775b0b2cdd7cd537f132f77b73144b0
SHA1a1bfc2ea21424a20431d0ac527916c7463eabb65
SHA2564d5a5a19280efcff80150219ab749ca08c692e876b3a9f6a71c1af63b971f47f
SHA512b1bea613fdb9c3d049243f82cb7370ac0c62eed38e6eec3d3312ca3f7e4cfc12283f244ea1eafafa123927b41cc9667603a55058991e8a23e8a4df151de65749
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
548B
MD5742c2400f2de964d0cce4a8dabadd708
SHA1c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA2562fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
SHA51263a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
-
Filesize
550B
MD551014c0c06acdd80f9ae4469e7d30a9e
SHA1204e6a57c44242fad874377851b13099dfe60176
SHA25689ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
SHA51279b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
1.2MB
MD53983d31b7a906d3351ef223ab4ffaa0a
SHA165b317231fbe779516558261b4b0f3e839e7e946
SHA256db3ba29eb00805d400c41be842b176a24c2a14efffb9a78ed34e630749bf31c1
SHA5125231b5b31aa9702aef52fcde8ce384477ff4ff1a7cc9f9a634035aaa2d328e0eaf991228b71b5e0c51ecf737b95c6a6a937808d22a4ca64432a2c74fbd9f4595
-
Filesize
350KB
MD5803df907d936e08fbbd06020c411be93
SHA14aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA256e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
SHA5125b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82