Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/05/2026, 01:44
Behavioral task
behavioral1
Sample
sub_3a0ab5c065a2.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
31 signatures
150 seconds
Behavioral task
behavioral2
Sample
sub_3a0ab5c065a2.exe
Resource
win11-20260513-en
windows11-21h2-x64
21 signatures
150 seconds
General
- Target sub_3a0ab5c065a2.exe
- Size 6.2MB
- Sample260524-b53ezset7j
- SHA256 3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
- MD5 a6f124515524bab5cabd4e749df9770f
- SHA1 b1929abb6f538c636bf4210a173678bde64614c7
- SHA512 e8c48ba0087460ccf5da71bdbec440c3dd2b260913552a332ef3c3c22a5e294672b3b1cb4f77db612b97e96d5f27e16f8e7190571c96db4efbacdf3256e3043f
- SSDEEP 98304:vk5b0H4+DGmnxx8g8Noib+Ug1E4fKcHzLBsbGsLlyndn8S1ad3dWpELfxl6:vNHJx8Wib1gY+zuPLMdb143dWObv6
- TLSH T1496633A294CA6E65F24D3CB24E321E17A550DCA0878761BF92EF004D651B2CD2BFE74D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Path
-
C:\Users\Admin\AppData\Local\README.txt
Ransom Note
- Hello my dear friend (Do not scan the files with antivirus in any case. In case of data loss, the consequences are yours) Your data is encrypted Your personal ID: b47wfj10V74JZZeHdphr4D7Uvzh3vTZAK1upaIV7iWw*[email protected] Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted The only method of recovering files is to purchase decrypt tool and unique key for you. If you want to recover your files, write us to this e-mail: [email protected] In case of no answer in 24 hours write us to this backup e-mail: [email protected] Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software - it may cause permanent data loss. We are always ready to cooperate and find the best way to solve your problem. The faster you write - the more favorable conditions will be for you. Our company values its reputation. We give all guarantees of your files decryption. What are your recommendations? - Never change the name of the files, if you want to manipulate the files, be sure to back them up. If there are any problems with the files, we are not responsible for them. - Never work with intermediary companies because they charge you more money.Don't be afraid of us, just email us. Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more...
Emails
-
b47wfj10V74JZZeHdphr4D7Uvzh3vTZAK1upaIV7iWw*[email protected]
Signatures
- Family: Mimic
Ransomware family was first exploited in the wild in 2022.
- Detects Mimic ransomware 60 IoCs
resource yara_rule behavioral1/memory/2628-14-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-16-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-15-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-20-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-21-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-22-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-24-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-23-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-25-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-51-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/764-183-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-185-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-184-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-189-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-190-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-191-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-192-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-193-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-266-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/2628-267-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/2628-291-0x00000000000D0000-0x0000000001039000-memory.dmp family_mimic behavioral1/memory/4272-303-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-309-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-307-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-308-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4272-313-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4272-315-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-318-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-320-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-321-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-322-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-317-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-316-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-312-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4272-311-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4272-310-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4272-314-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4272-301-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-298-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-325-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-326-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-324-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-323-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-361-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-365-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-363-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4272-362-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-360-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-410-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-411-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4872-412-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-417-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4272-419-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-420-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-425-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-429-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-433-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/764-437-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4268-441-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic behavioral1/memory/4272-442-0x0000000000E00000-0x0000000001D69000-memory.dmp family_mimic - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ PIDAR.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ sub_3a0ab5c065a2.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ PIDAR.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ PIDAR.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ PIDAR.exe - Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 1176 bcdedit.exe 5052 bcdedit.exe -
pid Process 5092 wbadmin.exe -
pid Process 2096 wbadmin.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\beserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8s.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1cv8c.exe PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" PIDAR.exe - Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion sub_3a0ab5c065a2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion sub_3a0ab5c065a2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PIDAR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PIDAR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PIDAR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PIDAR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PIDAR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion PIDAR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PIDAR.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion PIDAR.exe - Executes dropped EXE 7 IoCs
pid Process 764 PIDAR.exe 3324 Everything.exe 4872 PIDAR.exe 4272 PIDAR.exe 4268 PIDAR.exe 2504 DC.exe 2660 Everything.exe - Loads dropped DLL 5 IoCs
pid Process 2628 sub_3a0ab5c065a2.exe 764 PIDAR.exe 4268 PIDAR.exe 4272 PIDAR.exe 4872 PIDAR.exe - Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command sub_3a0ab5c065a2.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell sub_3a0ab5c065a2.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open sub_3a0ab5c065a2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" sub_3a0ab5c065a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open\command PIDAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" sub_3a0ab5c065a2.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open\command sub_3a0ab5c065a2.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command PIDAR.exe -
resource yara_rule behavioral1/memory/2628-0-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-14-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-13-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-16-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-15-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-20-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-21-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-22-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-24-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-23-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-25-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/2628-51-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/files/0x000700000002447a-161.dat themida behavioral1/memory/764-162-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-182-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-183-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-185-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-184-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-189-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-190-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-191-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-192-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-193-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-266-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/2628-267-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/4272-284-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-285-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-286-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/2628-291-0x00000000000D0000-0x0000000001039000-memory.dmp themida behavioral1/memory/4272-303-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-309-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-307-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-305-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-308-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4272-313-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4272-315-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-319-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-318-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-320-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-321-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-322-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-317-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-316-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-312-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4272-311-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4272-310-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4272-314-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-304-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4272-301-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-300-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4272-299-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-298-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-325-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-326-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-324-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-323-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-361-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-365-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4268-363-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4272-362-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-360-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-410-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/764-411-0x0000000000E00000-0x0000000001D69000-memory.dmp themida behavioral1/memory/4872-412-0x0000000000E00000-0x0000000001D69000-memory.dmp themida - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PIDAR = "\"C:\\Users\\Admin\\AppData\\Local\\4B4D602C-A265-4002-905B-FF9B27D786BD\\PIDAR.exe\" " sub_3a0ab5c065a2.exe - Checks whether UAC is enabled 1 TTPs 5 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PIDAR.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PIDAR.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PIDAR.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA PIDAR.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA sub_3a0ab5c065a2.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\A: Everything.exe - Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 2500 powercfg.exe 1840 powercfg.exe 3428 powercfg.exe 2568 powercfg.exe 4856 powercfg.exe 652 powercfg.exe 4836 powercfg.exe 3648 powercfg.exe 4692 powercfg.exe 2016 powercfg.exe 1860 powercfg.exe 1776 powercfg.exe 1772 powercfg.exe 4188 powercfg.exe 260 powercfg.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2628 sub_3a0ab5c065a2.exe 764 PIDAR.exe 4268 PIDAR.exe 4272 PIDAR.exe 4872 PIDAR.exe - Drops file in Program Files directory 32 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\classes.jsa PIDAR.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa PIDAR.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\[email protected] PIDAR.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\[email protected] PIDAR.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\[email protected] PIDAR.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\[email protected] PIDAR.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
pid Process 4336 powershell.exe 844 powershell.exe 2712 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sub_3a0ab5c065a2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PIDAR.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName vds.exe - Modifies registry class 19 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\README.txt\"" PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command sub_3a0ab5c065a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" sub_3a0ab5c065a2.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open\command sub_3a0ab5c065a2.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open sub_3a0ab5c065a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command PIDAR.exe Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" sub_3a0ab5c065a2.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell\open\command PIDAR.exe Key created \REGISTRY\MACHINE\Software\Classes\.com PIDAR.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.com\ = "mimicfile" PIDAR.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile sub_3a0ab5c065a2.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\exefile\shell sub_3a0ab5c065a2.exe - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 764 PIDAR.exe 4272 PIDAR.exe 4272 PIDAR.exe 4268 PIDAR.exe 4268 PIDAR.exe 844 powershell.exe 844 powershell.exe 2712 powershell.exe 2712 powershell.exe 4336 powershell.exe 4336 powershell.exe 4336 powershell.exe 2712 powershell.exe 844 powershell.exe 764 PIDAR.exe 764 PIDAR.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeSecurityPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeTakeOwnershipPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeLoadDriverPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeSystemProfilePrivilege 2628 sub_3a0ab5c065a2.exe Token: SeSystemtimePrivilege 2628 sub_3a0ab5c065a2.exe Token: SeProfSingleProcessPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeIncBasePriorityPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeCreatePagefilePrivilege 2628 sub_3a0ab5c065a2.exe Token: SeBackupPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeRestorePrivilege 2628 sub_3a0ab5c065a2.exe Token: SeShutdownPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeDebugPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeSystemEnvironmentPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeChangeNotifyPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeRemoteShutdownPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeUndockPrivilege 2628 sub_3a0ab5c065a2.exe Token: SeManageVolumePrivilege 2628 sub_3a0ab5c065a2.exe Token: SeImpersonatePrivilege 2628 sub_3a0ab5c065a2.exe Token: SeCreateGlobalPrivilege 2628 sub_3a0ab5c065a2.exe Token: 33 2628 sub_3a0ab5c065a2.exe Token: 34 2628 sub_3a0ab5c065a2.exe Token: 35 2628 sub_3a0ab5c065a2.exe Token: 36 2628 sub_3a0ab5c065a2.exe Token: SeIncreaseQuotaPrivilege 764 PIDAR.exe Token: SeSecurityPrivilege 764 PIDAR.exe Token: SeTakeOwnershipPrivilege 764 PIDAR.exe Token: SeLoadDriverPrivilege 764 PIDAR.exe Token: SeSystemProfilePrivilege 764 PIDAR.exe Token: SeSystemtimePrivilege 764 PIDAR.exe Token: SeProfSingleProcessPrivilege 764 PIDAR.exe Token: SeIncBasePriorityPrivilege 764 PIDAR.exe Token: SeCreatePagefilePrivilege 764 PIDAR.exe Token: SeBackupPrivilege 764 PIDAR.exe Token: SeRestorePrivilege 764 PIDAR.exe Token: SeShutdownPrivilege 764 PIDAR.exe Token: SeDebugPrivilege 764 PIDAR.exe Token: SeSystemEnvironmentPrivilege 764 PIDAR.exe Token: SeChangeNotifyPrivilege 764 PIDAR.exe Token: SeRemoteShutdownPrivilege 764 PIDAR.exe Token: SeUndockPrivilege 764 PIDAR.exe Token: SeManageVolumePrivilege 764 PIDAR.exe Token: SeImpersonatePrivilege 764 PIDAR.exe Token: SeCreateGlobalPrivilege 764 PIDAR.exe Token: 33 764 PIDAR.exe Token: 34 764 PIDAR.exe Token: 35 764 PIDAR.exe Token: 36 764 PIDAR.exe Token: SeIncreaseQuotaPrivilege 4272 PIDAR.exe Token: SeSecurityPrivilege 4272 PIDAR.exe Token: SeTakeOwnershipPrivilege 4272 PIDAR.exe Token: SeLoadDriverPrivilege 4272 PIDAR.exe Token: SeSystemProfilePrivilege 4272 PIDAR.exe Token: SeSystemtimePrivilege 4272 PIDAR.exe Token: SeProfSingleProcessPrivilege 4272 PIDAR.exe Token: SeIncBasePriorityPrivilege 4272 PIDAR.exe Token: SeCreatePagefilePrivilege 4272 PIDAR.exe Token: SeBackupPrivilege 4272 PIDAR.exe Token: SeRestorePrivilege 4272 PIDAR.exe Token: SeShutdownPrivilege 4272 PIDAR.exe Token: SeDebugPrivilege 4272 PIDAR.exe Token: SeSystemEnvironmentPrivilege 4272 PIDAR.exe Token: SeChangeNotifyPrivilege 4272 PIDAR.exe Token: SeRemoteShutdownPrivilege 4272 PIDAR.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3324 Everything.exe 2660 Everything.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2628 wrote to memory of 764 2628 sub_3a0ab5c065a2.exe 90 PID 764 wrote to memory of 1216 764 PIDAR.exe 97 PID 764 wrote to memory of 3324 764 PIDAR.exe 96 PID 764 wrote to memory of 4872 764 PIDAR.exe 98 PID 764 wrote to memory of 4272 764 PIDAR.exe 99 PID 764 wrote to memory of 4268 764 PIDAR.exe 100 PID 764 wrote to memory of 260 764 PIDAR.exe 105 PID 764 wrote to memory of 4692 764 PIDAR.exe 150 PID 764 wrote to memory of 4856 764 PIDAR.exe 107 PID 764 wrote to memory of 3648 764 PIDAR.exe 108 PID 764 wrote to memory of 2568 764 PIDAR.exe 109 PID 764 wrote to memory of 4188 764 PIDAR.exe 110 PID 764 wrote to memory of 4836 764 PIDAR.exe 111 PID 764 wrote to memory of 1840 764 PIDAR.exe 112 PID 764 wrote to memory of 1772 764 PIDAR.exe 113 PID 764 wrote to memory of 2500 764 PIDAR.exe 114 PID 764 wrote to memory of 1776 764 PIDAR.exe 115 PID 764 wrote to memory of 1860 764 PIDAR.exe 116 PID 764 wrote to memory of 652 764 PIDAR.exe 117 PID 764 wrote to memory of 2016 764 PIDAR.exe 118 PID 764 wrote to memory of 3428 764 PIDAR.exe 119 PID 764 wrote to memory of 4336 764 PIDAR.exe 120 PID 764 wrote to memory of 2712 764 PIDAR.exe 121 PID 764 wrote to memory of 844 764 PIDAR.exe 122 PID 1216 wrote to memory of 2504 1216 cmd.exe 140 PID 764 wrote to memory of 5052 764 PIDAR.exe 167 PID 764 wrote to memory of 1176 764 PIDAR.exe 168 PID 764 wrote to memory of 5092 764 PIDAR.exe 169 PID 764 wrote to memory of 2096 764 PIDAR.exe 170 PID 764 wrote to memory of 2660 764 PIDAR.exe 178 - System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System PIDAR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" PIDAR.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection PIDAR.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" PIDAR.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer PIDAR.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sub_3a0ab5c065a2.exe"C:\Users\Admin\AppData\Local\Temp\sub_3a0ab5c065a2.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe"C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:764 -
C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Everything.exe"C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Everything.exe" -startup3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3324
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\DC.exeDC.exe /D4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2504
-
-
-
C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe"C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe" -e watch -pid 764 -!3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:4872
-
-
C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe"C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe" -e ul13⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe"C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe" -e ul23⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off3⤵
- Power Settings
PID:260
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:4692
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:4856
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:3648
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:2568
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:4188
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:4836
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:1840
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:1772
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:2500
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:1776
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:1860
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:652
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Power Settings
PID:2016
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb613⤵
- Power Settings
PID:3428
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4336
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2712
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:844
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:5052
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:1176
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP3⤵
- Deletes System State backups
- Drops file in Windows directory
PID:5092
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2096
-
-
C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Everything.exe"C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Everything.exe" -startup3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2660
-
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:628
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1712
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:344
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4692
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4728
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2660
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4848
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3432
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1820
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2680
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:2708
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3744
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:2748
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Indicator Removal
2File Deletion
2Modify Registry
3Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\18e190413af045db88dfbd29609eb877.db
- Size 4KB
- SHA256 8897d1620cb8b00c24e474b46805d44f4777f14815503e353cb8ea747567f6fd
- MD5 2979633305f0ecec71f190bd4d149289
- SHA1 63710d9ff7849a3aa47d8416720a86e09bcc6501
- SHA512 158d0697271a535d69e6022c0380e0ffaf422dd69fa273e197b540c8b5aa04800f6168a27ce56874ec8dbc40bcf0c86e07c3384d21d3e18eac2d6e693e527b33
- TLSH T18B810244434444E3D05407B254D123081B5AD1A497430B03150102018C427480C60A44
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\18e190413af045db88dfbd29609eb877.db-shm
- Size 32KB
- SHA256 a928ab1b4108fe2fee44a85577dbf855cc101f9f042a183e38aa802425b86b15
- MD5 9bd9db9cace479a173be31d89a0f0fd7
- SHA1 c6fe7ef1fa3ed23abe1ab82e1f9c433e31cf5820
- SHA512 1c8a539ec8e8111bf7fc50360cb7d69e30ac666a0dc5e903ad142a6be0a79a0b6c8cf6ae4660701ba94c176dbc6e104f934897fd122ebb56219ddcc62129ae04
- SSDEEP 6:GWvzD+lTvzD+9t589XXPH4l94xAl6lRvXs:5vzDwvzDQ5sAOAArc
- TLSH T1E7E2C91FA7FCEE22D54C4336989B03506533ED445BC207032538B6152CB12D85748646
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\18e190413af045db88dfbd29609eb877.db-wal
- Size 76KB
- SHA256 5ab8eb2af928d99ed2005a7130599c86dde25fe787733186bd2cb47734d9f3b9
- MD5 f1f261ffd02875b8e43d4bca1b0669f8
- SHA1 3c61431484e16d3971ebea0be09793ea061e69f6
- SHA512 497fa2f62bc1cbd5ebd8013e73296639c4bd6241477854f914ef3df1debfb4ece8e682ea92746c3cf094e2459e922959cf753344b1c058724524ac449800d5e6
- SSDEEP 192:pgBVycE4X4QWk+O9k+DzJWk+bkk+L9k+DEXk+DzLkk+L9k+D8Xk+DzXx:GEKeq3YYF63IFS3Xx
- TLSH T11473E64823300351E0ABA5F5D9FF5FB2A36DC8A8D1A206DDB5B89440EC501C3D92EFE6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\18e190413af045db88dfbd29609eb877.db.session64
- Size 64KB
- SHA256 ebc17ca640044a751ebe510e59755a61d98dfb630994291e3beba04a8c22d8be
- MD5 7be36cf11f1c06d447c175ccf92e0388
- SHA1 ddc4499a5cd9617c7017da328cc9b3df8c72ed60
- SHA512 64bc7a8e594877000b4f174e07460d5519254a0e81427186aaecae2b1556b0ad70d5427ba5d9fed7169cab3bf4cd7a937c8a48911631dfafb12477212d53201d
- SSDEEP 6:ujmt/B5gtXT//3l99v+gsVXT//lDJeVVCld:r1B5gtXBn2jVXhJaVi
- TLSH T1595322E7B80A8934C4D9E438192D808D13B29D18BC2C2AA23886390C1BEA3700244322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\9c8aeea6-71f7-41ee-937f-6f04dd468aa4.tmp
- Size 147KB
- SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
- MD5 9c670f04d98ab7404f16423f6ee6cdfa
- SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
- SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
- SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
- TLSH T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\AdobeSFX.log
- Size 1KB
- SHA256 34fd661c692130a7bdabe6eccfa81610dcc8e80b016d6dd93394c94456fd48be
- MD5 3b412dc29ea3fadf36c2bbb0444196e0
- SHA1 6878a7904421c9b649034654720746a48dd9e411
- SHA512 209e8b6f4809aae78ba2574a60395b68938248847043ead480c5cbdbd9bb47657bc37c023e03ee2480f0c158e067370119b81c0ecacffc0b8141e6ecc9441555
- TLSH T1D3418A471AFE85BB2F014285B3686FFACD51FB1F3EC5D960634591283506D389AC770A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\EPSYDAFZ-20260514-0032.log
- Size 55KB
- SHA256 5f4d93aa89ffac9a2497e3d0bc7ff11564de06bf0ffe67804a5ac1a165cd6c3e
- MD5 955ff2e5f0391eba4095ff2d26c6c66d
- SHA1 614d825b344400f5f24284cb02938c10bb4c6237
- SHA512 4fb41f7051f3fcaf2452fe0c764be156b575532f75aff9386a47e3ac4a83945428876bb2f8f4dba8561975f309c7360e86a7313c764ba9d390084e390b18556f
- SSDEEP 1536:qRjIjj3u1N5aWKA2XbEgZgItcQRkPh7tB+CE/QDU1AH3SWu806yy1JSrLDHXmz6a:kqyNFcCh7tBDH
- TLSH T16C433A2D5AE90646F3F78B8699F640669AB2BE577C34DD4E60910F0E0827E417C60F3B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\EPSYDAFZ-20260514-0032a.log
- Size 180KB
- SHA256 0e76df615db388898873b6fbcaf488a3631ad31aaa187fa29ede711d78e13f98
- MD5 e64e543d22bac57ec80975c107f8a951
- SHA1 a0e985434c7331b1eafc694a558b0007c81f3047
- SHA512 732275de337e89f7216f3360e340c16e666504dc6e968824358b7bd726476e1d1e136b74d53c7076d0a62c77ef81973674321c19d3d751c05236c8ed2b26b1ef
- SSDEEP 1536:U5pj9XBOENV4+qfB8TDBHjpvpcfYHQPXVrWeBWiBzsHJKuylISQagq9zBrOBfB71:c7OiJKuylISQagd/h/Mv/3U
- TLSH T12504792D69F90256B1B2DA8A9AF24023EB72BD276935CD1E50D14F0F0517D42BCA1F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\JavaDeployReg.log
- Size 13KB
- SHA256 ed74c7ddffb6dae5fb785207e2970c202192c11e6a7736740819c2869a72db94
- MD5 e19b73b7568c25dd10dfb05cc62c7573
- SHA1 e404052bbf357e69af53bc81d4ceb1621559d8d7
- SHA512 ef62e3ec04bb5a5574f6b5d916f36c87e6b5502ed50b1ebd3ee05969381be2b2a9df12aafdb5e84b3f86cdf3e08c4c6ed91f51c1130442c5104682e90eb6313f
- SSDEEP 384:Nb/QJSfimlQJSfimVaEPWANNNNNFiv+b6+Y:Nb/QJSfimlQJSfimVaEPWANNNNNC
- TLSH T1E75269F144AD49F778D101E9A7023FE0D995A28FB3CA4C0477C5DE64F806E405AA36ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft .NET Framework 4.7.2 Setup_20260514_002715992.html
- Size 93KB
- SHA256 f882a937a18912cde6d24a7b72bba7ab3766c16a38410f7b2ac3820a84de2dfa
- MD5 6cc62451bf41650f4527fce0ec0e18e6
- SHA1 952fb19be43706a8a9353be9f9311cff23af5a36
- SHA512 470d3b7a05c3c1b464d997c21fe98dbbd6323d6855466a7507a69130c90e0eaf7fad019bb2161296fca91359cc3cbd683cd3e6ea80125470652521cef070ce2a
- SSDEEP 768:fdsOTLyUFJFEWUxFzv8k/SQ4BOprZZbw6:fdsWyUr+WUxpv8k/SQy6
- TLSH T1F593B31377D80155A8F3BF4DEDB710260AB8BD855C34D92C13A58A5D0E92E24ECB2FB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002740.log
- Size 15KB
- SHA256 159a6eb86a3ac9e40cce8f0bc4f9b6f2d26569e599d186905b38a5a4dcf84fdb
- MD5 8b6a2e9b82632e0042a9f4e84e9abfff
- SHA1 cde4eb370c9b0bf27d2884334edc1b03ec9fb406
- SHA512 7aaa914384c47f03946063bec00b67af982323241851f2c01a82451b1087d76f3d7515a649e7447b3bd0b0629ed824dd39c3dc5634765169255e52735097cc6a
- SSDEEP 384:cp3NVH3o3Z3x3K3M3JO3wxO3w6VBalV3VMPV8K2+C3O3M3l3Jx3wh03F3q3+x3wT:cpavxvMBabFMNk1KeKT
- TLSH T1216201873DFA53821CF179E6E3E67BE59F4774130A5016F82E83031EC9C2A14E7A9A14
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002740_000_dotnet_runtime_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002740_000_dotnet_runtime_6.0.27_win_x64.msi.log
- Size 551KB
- SHA256 3d7a5fda60003e3d158e723f8257f8ffec99cd034419dd43433a52a77b745de5
- MD5 3bb3939bbcc00d1fb9f8fc6df5ca38b1
- SHA1 aa54e7a58708b6794200a02eaca95fac3c17ea2e
- SHA512 157825068024b4eda207bfe13873e9c86bae3643326a444c2021f73e2dc75c07bdf2888788d4611547398374e6733c9c60312afe485c646ebc2adebd175c8ded
- SSDEEP 3072:Kkx7jG0cqXSCdRzakt90E7l2vowUxKccb7PrfoBbWaAloYAt/S8LxcKv3K0toK7H:xjrDZ
- TLSH T1D2C43929ABF80259B2B3CF47EEF344179576BC35AD39D90C1182434D0571E05E8ABBBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002740_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002740_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
- Size 95KB
- SHA256 4ff86d3cbc3f97dcc55fc13151ead3486ca48cc9ce5d884e73cf2a60822eb098
- MD5 8b39a488f2e5c783592ac58087ae2d34
- SHA1 ccbdd4774d2f631ae223a72fce0d146ee5f926c9
- SHA512 59f115e59a901c34c58f17456963828edf12b522785af269c2c7ec6cc63a813813b9c8f9430cb06dba4edc70c5089967622e79e76c939b9ab6ba2d95457706a9
- SSDEEP 1536:9dVKPA7SPD9XCnor+x7lN35x1p6taAYIGugm/WllUzBhCzcju+KgIqf:9S/ju+KgIa
- TLSH T1EBA3176E2FF8010AB2B3DA478FF704274673B92A9975DD0D22C1930D05A2D05F56A7EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002740_002_dotnet_host_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002740_002_dotnet_host_6.0.27_win_x64.msi.log
- Size 105KB
- SHA256 e91305ae444830e4db164416f3050d36b7420b69059beb59603d737fddec8182
- MD5 9b074b296cbf2407fcc89f51e95f4ad6
- SHA1 37b478d07ff3258ba95c667e24da6de07ba49941
- SHA512 ab6a9c930e28a5da589ae0f9b11f3e19e447619f291374bdf2e1cbb30b0976489ebd41ecd815a991f98bacd0dce4a7177d7efcdd63c689008ea51341e5898285
- SSDEEP 1536:PQAd332HaOMvg3PzG+SuuIK5OJaJmU8caFWWxVUYJpx8kjoQJEC5kTu7qDXg:PJejoQJEC5kTu7qDw
- TLSH T1A4B327696FF4004EB2B3DA879EF704174673FD2A5935D90D32C1970E01B1908E9AA7EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002740_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514002740_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
- Size 847KB
- SHA256 414a1daa632128bfb26b67e4589d9643540d38a5344a2858bfb79283d343ec2e
- MD5 3f3b0ddd68f83aba8d1fb909212900d7
- SHA1 1850a262594544acf20ae471fc3d62aa5d46dceb
- SHA512 2d29725418b36bf14ed5b333611370b490430aa5c315e1e41e7a6fb60cc5397810e1c13987c700b3a8b37bad2d4ae38d85aaa63c192315fb0b3925005296b55b
- SSDEEP 3072:2Rc3jjhHv2+JCt3DBccyt040L2uvv/e8+XgsgIAHiBkG7yGS1SDsxLUbSLmNHlRX:tj5qkms
- TLSH T1A6052825ABF8061AB3B3CF47DEF74416A436BC35AC39D50C5196824D09B1F04D8B6BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002806.log
- Size 15KB
- SHA256 c456107da32a5a29c05f79532668791b3131bfabb4deae6e05721116369d2d95
- MD5 1dc7056e9749089b30f00b403fc8db7e
- SHA1 5c4536bf0e58cf49411539ede299f99f9ed553cc
- SHA512 5dda6fbde04769dba9672d41078a41ce55ce9fecf383e69348f3ab7305f3f774d782b06ff88e0484fcd64dff91e6e01bbfd52516feaa61e40ce6ae15e6898a82
- SSDEEP 384:zCaKVvavaaayalaZa5PaPOPaPOVQjnVPVkCV7QshuaYaxamaB2aPngawaday2aPn:zM9gOgAQjVNkktwr1rn
- TLSH T1BB62EF456DBD61860CF075A6D33E6FE5DB17B0875A002DF06BC30A2ED95AC10934DAA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002806_000_dotnet_runtime_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002806_000_dotnet_runtime_7.0.16_win_x64.msi.log
- Size 470KB
- SHA256 4f4bad08addb9f22d413af197090f2d6793a06eb72c4944628535c69266c5a3a
- MD5 f9eec264b029500ec76f83a3d4fa5538
- SHA1 b1c6781aa857580c242f1f589f920c68dee0bb38
- SHA512 373a90c0f6122217ed85828edbc2e1c4ede182ca6797f3be734ec49aa4861578756b46555d69de4bad92bc0c0c410c5596a14dc371725d055708f7e04cbc7a32
- SSDEEP 3072:oMK9jo3Uzz77NBenvCQn/cfc1nL3q/fFsTLgWVbGVcTRfDEKgl8mfxkjFOf4pOn+:2jE1
- TLSH T155A44A24AFF80215B2B39E47EEF384175476BD33AC38D51C6182434E0576E06ED6AB7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002806_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002806_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
- Size 95KB
- SHA256 5b11bb41697dbe682db4b6c50730bf52c6abf0be47f5b873b99d5200070fd3ef
- MD5 14f012bdc4cecbdd3dffc5e77b7c2037
- SHA1 b73512be3adfe9cb8d2573b6748dadc55be77e06
- SHA512 dfa4949f138ac0ec9a0ec4cdd1f84b17c77ff7874f8d42d249ab1f4924b6da5273cb99474a3ce3fb49e8bd82becf9adc072d632ece65934a5a7723ac3220cf5c
- SSDEEP 1536:ZHQZH0qTmyItJ3Bjmv2sUK1pCp19Kwo42eQW/WVT0gNtk9AjDvC4DRYJ:ZZ2jDvC4DaJ
- TLSH T12CA313292FF80115B2B39A47CEF34463467379976A35D90D62C2834D01B3906EA6DBFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002806_002_dotnet_host_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002806_002_dotnet_host_7.0.16_win_x64.msi.log
- Size 109KB
- SHA256 363e3c6a1f99bf046e9553d27c2fd2676bda3acd9ffb1108f0b5834dd3f2f516
- MD5 a6610ce9f93cd72440ccaa252c864e0e
- SHA1 8b7dc8d646fd34f470dd972681d19e21b1cca1f7
- SHA512 c523a57615231d7d192d436cc2efadc3d16792d8a622b2984d16105166e0ec050bc87d4efa5f5cddfd04f91078bf75d3d967dd963276a3f3696a6d59737293cd
- SSDEEP 1536:TGFm3N2XK+stIfyL+/0bYmH5GZaxesUUSt+GxqElgAEGDQjr/6eayWn6LT7K1:TuT8jr/6eayWn6LT7U
- TLSH T15BB3151A6FF80115B2B3AA07DEF3441755337E925939D80D62C2831D06B2E06EA6D7FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002806_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514002806_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
- Size 852KB
- SHA256 4c65f987785093a1367951039b796a08165cc3737f30fdbff65300337e2e899b
- MD5 29f67b74a34e32d1ad2b51cac7e62d49
- SHA1 8014690e98e24c7d6728c7774f2d8a45478565e8
- SHA512 2e87cd8df246867c1d44c2b5a6bacebd46854f2bd2004368e24b4ab23d85976c8b8d8ab5f2e644aad57805e3c56520ddd602931c7e116c0afe2f9cef17f58aca
- SSDEEP 3072:x3EKjbGP1rKJ/LcbbH3uXo0YMDHJNK5GxTrYxMMGRgZD6fQa2f3sWqkiLH99+Mce:PjCBy
- TLSH T1A805D8246BF80615B3B39F47EEF34416A436B932AC34D50C6196834E09B2E09DD6A77F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002832.log
- Size 15KB
- SHA256 67e45ef4b4dd8ba2d882a83238bc0b0e1a055a41b79fb422fbdf9deef4602cc6
- MD5 6b10ee73d2c7acf0510f2962b9347865
- SHA1 cbbeecbffbf71a12d3a0ce79f4d954f5e252521e
- SHA512 7c410aad751e70d2f470b276ffddd41742e04db2f363442f53434278e60463878f3a3c8be9c6853b591292dba954c3dd7357edb648653b4d0015e2f452bd0c41
- SSDEEP 384:sog1V8gOgFgng8gUgKNgEMNgEKVjg8559uN0KVvVf9IV/irFVXxgKgngagXQgEVM:sHSvMv8V9OtlqQBYNYb
- TLSH T16C72F2453FB491C60CF5B166A32E5FE4AB2336475B1025F4ADA2022ECE9BC38E3CD655
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002832_000_dotnet_runtime_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002832_000_dotnet_runtime_8.0.15_win_x64.msi.log
- Size 470KB
- SHA256 c3bbcf31e2ba7f5d1d39a82a6340812558db6360db7163d0a2da3cefa940d4e5
- MD5 e4268311ff4b90917cf291d41bffdd64
- SHA1 e9035266b15e0ef76db7d041c098586f79d5bfa8
- SHA512 3cd949877d6b51857be318dd7cc44942fd16019bb62706f9cc9f2ec369bfd7d891ca8be0fd5116c02d138b8c6712b1f20d3b349621be2fe03580d4183b2d679a
- SSDEEP 3072:+56o5ib1sxCmLCUolv9i82gaTFjoKbVzuWazjPTRYG3Ts0D9e7qsnGUGYHHvHbsj:wjtL1e
- TLSH T152A43A14ABF80216A3F38E87DEF38416A476FC72AC39D91C2192425D0572E05DD7AB7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002832_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002832_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
- Size 95KB
- SHA256 1c2db84bb740bb60b169501fdf146a61e4ff57d2c6ca617a1cbc18bc4c963a15
- MD5 1257906816885057722d9085c2e247ae
- SHA1 75f683c0d9957bef7e05071cf50fec71d9aa7bf3
- SHA512 bdb23efa5f9d3148081c7716b4feb3d1ba0afe7d29e1c43fd02062800a58b084aa56a87e1ed6c64a641d5d6a30f7ec6e176fc193a33ac1bc38901f51a988d328
- SSDEEP 1536:6q02tIawSYUH+AtUICwZHPz2LmmesSiRV5iatjLzJBDpEeahUr0UUUHrRLpHiGm2:6q02tIawSQY3MrRLpHipjsSbhZnBaC/a
- TLSH T13CA3E31A2FE40116B3F3DA879EF344269573FDE26939D91D31C2830D01A2905E979BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002832_002_dotnet_host_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002832_002_dotnet_host_8.0.15_win_x64.msi.log
- Size 109KB
- SHA256 90944813954e196a4a5e80f92804069ba1536d5542d1b97ea77269075025f466
- MD5 8b3fb8f677db99f1d44a0ac100122f8a
- SHA1 992081e160756cf7d74fbd1e11f202c4dc27c2dd
- SHA512 9dbbde6e4874091b5ba3337359d8f2ea5bdf443e72014ac2c327a721fc7e1bd896a7617ab888f712f5e274c4dce9fc2f0963a1a208b75aa46cca7224e620e139
- SSDEEP 3072:BlvdG3b9lFfGUXNMT4jZ0r48IGIlDrpFjWNI2k:+jJ
- TLSH T1C9B315152FF90155B2B39A879EF304279533BDE25A39D81D3182836D01A2E05D93EBEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002832_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514002832_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
- Size 849KB
- SHA256 a33d570d0f46ff46a934b39acd50650c1788f7f5010a0a29d80e3c755860d16d
- MD5 f37abe270131c1bbfbd27b44cb498fcd
- SHA1 a7460ab880ea57982e8f4ae9152564339f9604b5
- SHA512 5b2ce03c58152f2e4763566a592dbf6fd566318f19f04e0217454ddca5fe69f0510b65672db98b3c5c359dc649f7449da2daf1399579c4ab8e92a251cdfe50b9
- SSDEEP 3072:AVyoLA4aoM5BZbbdysq75cY0RjJ2fdrlm2dj9EjUXel4QgUSB6eS6BztBLTAS3Ks:yjy8
- TLSH T106050724ABF80715B3B38F47DEF344169437BD62AC39D91C2156834D09B2E06D87AB6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe
- Size 6.2MB
- SHA256 3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
- MD5 a6f124515524bab5cabd4e749df9770f
- SHA1 b1929abb6f538c636bf4210a173678bde64614c7
- SHA512 e8c48ba0087460ccf5da71bdbec440c3dd2b260913552a332ef3c3c22a5e294672b3b1cb4f77db612b97e96d5f27e16f8e7190571c96db4efbacdf3256e3043f
- SSDEEP 98304:vk5b0H4+DGmnxx8g8Noib+Ug1E4fKcHzLBsbGsLlyndn8S1ad3dWpELfxl6:vNHJx8Wib1gY+zuPLMdb143dWObv6
- TLSH T1496633A294CA6E65F24D3CB24E321E17A550DCA0878761BF92EF004D651B2CD2BFE74D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\aria-debug-4472.log
- Size 72B
- SHA256 0bd6ec89bfb4085aa958fa8df92d560c37aeb02cdf6699aa7793985423c42ccd
- MD5 c9cf1715393c680b0cb14187e6e770bf
- SHA1 0bd91219e257d0231c7f3e03a0818f8f9ff33c1e
- SHA512 50758105f15f8e3530f6017e0aab5f06b7ea9e275d8991a08b77ccf0bf094295533dc423b18faa25e2b6fe1e1d2ba46ec96acd2de8c84dc03df66d205a5dda56
- TLSH T10CA0222082CF8B0EC220C2830230C08CC0FB0C0E2FC0F3080F02882C830223ABAA3200
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\b1bdbe6d-fc7d-4bf6-afca-efdcbec9a12f.tmp
- Size 10KB
- SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
- MD5 78e47dda17341bed7be45dccfd89ac87
- SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
- SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
- SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
- TLSH T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\cv_debug.log
- Size 353B
- SHA256 a35a79e0f855bf7519c1e36582ad3fdb49ea30066a3895f69984fc7e6b6f4ffe
- MD5 b0a91fb878ad77430a848b705f08804b
- SHA1 8c30b1fc3ba3704df98a54dd7fa62b4ace997757
- SHA512 89f9201d7d43e68d8f82607f436ebeb017abb647fb46772c3a2cb8f82260a74b8f55b50448b25a60f60c26f28247297dd35abca4c7acb7e15cf78ed4259352f6
- TLSH T1C0E0D8903525A3AB7F928BD490210CD06660F059833E5B0CEE9A4434FD5CAB1B71DB85
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
- Size 1KB
- SHA256 28331acfe261eea8c4256f53a9431b568e8781c47d7df672f1c17222c9e8d7ec
- MD5 ab3e66a48ef74e0eeee42d42609cc220
- SHA1 8c67a98e26c6f8f75b62c477d80608e004d3eff3
- SHA512 56025d71e45a140d8c52dc9e5d341a11f082e18000d31cb8f178e8f83cfbb91ae25fde1475bd74003e01d243dfb2d72eec348ccb95b539f7b46442c3f2ba7a41
- TLSH T1161168CB22EDD061B4D0A0C1D71EAEE3C0E6006572D581FB7FA0795CA44225DBE958E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_vcredistMSI5FC2.txt
- Size 426KB
- SHA256 9370b119a9dbc4a9406619994ed1116ec85fe7300a464d893b2cf5412b783984
- MD5 ca6e3877197df3090475498dfc96c1b4
- SHA1 a5b988b0be0455a36428c95556eed7e83538d089
- SHA512 22b31470dee7c6ee5e3fa06f1c10e1e7778890c0bf9b1e3c1ff496a985d1312b09d9f1ef58cc13f14da7ccbcdaba4f92463d29ed1a4e0e84db7406681f586fd1
- SSDEEP 1536:ukH33QfLxliKeHeqS9bD2MeIYV4c4jf/d5WQ7lXUk0InPs+KRpN6JTfs+WWYdgmW:uknyjDuwrF0LtPo
- TLSH T1A5947C296FF50255B2B3DB43DDF305239933BD72A939D90C6281830D0662E06D969FAF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_vcredistMSI5FE9.txt
- Size 415KB
- SHA256 c7c4bccea9df1dbbe974f29c912e8b3b8b61497cd549b5cd3ec9510feb700c68
- MD5 2c1fd043919a7061e7d3b9022d335c2a
- SHA1 1577be4ffac6d62ced92cb455e9ff01ba0717fdc
- SHA512 6a7274c7f600a56c3d0bb960716085f008488c15bac231a887a00ea975591c5f6b1eb25f4def0b44fda0c4a5d53b17a004de3690ff394bea2c757eeafd617fc8
- SSDEEP 1536:Sf5/TefA2atlMs5kC3ALujXgoxacjfDT8UjJn+boXQcDr4yGF9pd5+SVrzLR0Jvp:SfjTj7JUx+f1BrzVD
- TLSH T128945B195FF90216B2B3DB47EDF7842368337D96B935D90D2290830D06A1E05E929BBF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_vcredistUI5FC2.txt
- Size 11KB
- SHA256 ab7329502a671faf6872e96ffb3ddf7289cdb1e5a2e05f7004cb83702f570892
- MD5 eacb09238fa3acdc8d4b2630de16403a
- SHA1 51464d056c1a1dfc0907dc02ed82dbfa34859407
- SHA512 c4afe176c2045c715f66f9cab11a5d8be006decbbff12094472d2d1d18b03a1d6c58c9b4ed6464851be7b82102832dbe144ca539208580a6a184082edd90abc5
- SSDEEP 192:uf+Nx7AkJuuEP0aEoJKSDqb2WfNbPAE1N2da6pBdkklc/8UX6Y6B6e86M2kw4f4e:y19+lKJYIXRpPpLM+vpXS+Sv
- TLSH T14832FF1AA7A45085B8F6DB4EDCF35017FFB2B861597DD50E02F7234A09A2500F4A27AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_vcredistUI5FE9.txt
- Size 11KB
- SHA256 324f20c8d1855034efdfb22a8c723f0bccabddad89c7622574efb31c9b64d7b2
- MD5 40616751311ff2cf5daa6eed069a4e85
- SHA1 c261e7c408d8925c02f3bf53889cd9f26147a8cd
- SHA512 d04605795158b3b08565ae58481a6a75555fe7d78117cdd999e486dcf204f2a190d50959c6a0d830a7eacfefaa16982cd4c916be20e0fb9b8fedfa4700f122fe
- SSDEEP 192:TTDq71FOl0ojlndnjHndnnMq7nvnSFiV8jhrj8dP:Dq71FOl0ojld7dnMq7vDGidP
- TLSH T15F32545AEBE40845B8F2DE4FECF39013BFB6B9416978DA0D06F5234A05A5504F4A13AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\jawshtml.html
- Size 13B
- SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
- MD5 b2a4bc176e9f29b0c439ef9a53a62a1a
- SHA1 1ae520cbbf7e14af867232784194366b3d1c3f34
- SHA512 e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\jusched.log
- Size 163KB
- SHA256 9b1b57d7d82f73ab8ffe3f34821ec46df2357d64fe00cb890960ea48aded855e
- MD5 cc87f64adda5ce06799db70a16eda262
- SHA1 d1d246260be94480d92b283d73f263f6170cc086
- SHA512 83935813bdf6cabcfd88e08f1a97f4f5de4499b0508163ddcd75fee5ac4143e90bc23a31be2b1dd20af27d8a090aca4132cebf9b39bc36ac3e0323c410b44b7b
- SSDEEP 3072:fIKR98706GS4I81lVxZOrdTNeaIbbp1kEPBpPitClPE:Nl7O
- TLSH T133F311D6C52D48BA38634AD7D3796D5485931A0F93DE4A1C32CFD2EEB041D03892E9EE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\mapping.csv
- Size 120KB
- SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
- MD5 d3186aada63877a1fe1c2ed4b2e2b77d
- SHA1 f66d9307be6cbbb22941c724d2cf6954b41d7bb0
- SHA512 c94e8aa368a44f1df9f0318ca266f5a6a9140945d55a579dee2fd10aff3d4704a72a216718b35e44429012d68c2bb30a92d5179fbc9fb4b222456a017d8981c0
- SSDEEP 768:oauu63GP/3Go+73GEVF3GL2QkUQ1HqfEe0/+dg5iwFeCo6QOATLJ1R4pbfyQw+t0:gu63GP/3Go+73GEVF3GGUn
- TLSH T11DC35121D2F6619CF5F3AF941AB41AA91E73FC16AD2DED9C0250620D0466E61DE31F33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\msedge_installer.log
- Size 3KB
- SHA256 d025c657bab698faa62b594a470cc135b7933a5f2aa2f502560d9f7a1563ea88
- MD5 589c26a42b86fc584513a107c475a265
- SHA1 8a6a0e7baac0b3430d9d170902368dc964114ab8
- SHA512 215000feb772763720a9508bc6130ff5327fe99841f890a79c028fa4c6686bf1de82e74ea112a92589dd5f8a95203b20eba9525bbfddbaec5373214cba24953f
- TLSH T16D61268312B682F80BBD567235D9B70B40F976D5CAC132B454F8C4D0B491EDA513F99E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\offline
- Size 4KB
- SHA256 e8e8b5fea35323025175ede4d1b56688850ae41ce8e05b161f5374721f7816a0
- MD5 10c1cdf8fc740716726baf7d61751e63
- SHA1 cdf828240cb0a82ee59af595a468bea26776b02e
- SHA512 628d353eca429b8eadec1737a2cb935176c0d11a515f611992d88e1dfbb614664b9da0d6cda76aa2a7879fa8d97d3599be7e68d303a006d4e65a889b5fea168d
- TLSH T149810240434440E3D05507B254D113481B16D1A497430B03150102018C417484C60A44
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\offline-shm
- Size 32KB
- SHA256 29637e8946a7af264e3cbb1f8631c22b22842439882f810ede743928f314da9c
- MD5 a9fba250bf5efe927ef4baf26d4a9f01
- SHA1 b8fe7bc5ac6695197edf763dc988cd1a53f3a5b5
- SHA512 03b2a70e85c2ccb303106029d1feddc228ef6d407bf5527f31b4f4b5e4435752561a7ffb7184bec30391ff610eb3685f182ba33c3082fcb054860b6567a7725f
- SSDEEP 3:GtlE+5NSk6tlE+5NSkIl8a9//Xlvlll1lllwlvlllglbdl6ll4llBLtllPXtl+l:GVKJVKTL9XXPH4l94xAlR
- TLSH T140E2023B6FEDDDB6D83853794CA38754E632DC4996C24B171189B2152C73BD44AA19C0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\offline-wal
- Size 68KB
- SHA256 4895d64f64d0b5acf4e5dfa3332415caed61668c08e64fca1ebe4b8ae3f23d7f
- MD5 562ead0570a5a2707d11ea462022d8f7
- SHA1 a3bf07ed97e9713aff4d56557cd9c9d73f67981d
- SHA512 6816eaefa28d855b4ae6645f1cdd6492366c12d2687fe2a6d03aef85ff5b9c4079864fbfd26a0d4765a0aca6fba5eeb7ce9f109a31e75fdbf52530c44403a306
- SSDEEP 192:tyG4vqN4q9kzltBSISkzltBSySkzltBSY:jmEUkykYkY
- TLSH T10763C80A3BE48255C066A1F284FF9E197BBAC45801B207EEE9758592DC801C7E43D5FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\offline.session64
- Size 64KB
- SHA256 1112c97576f4561c13ee2ed56a52262b836a31465a22589b07d82695a8d0a3c9
- MD5 b9a21935988eeaf2ab0234903bebd3ea
- SHA1 74ea380ebebe73e63893a330e4297576537f79b2
- SHA512 01479c0bee1b430195236de69c81311f2553645d34c9226ecefa6d8c204e617c368b4f6d639b6a5a248f464dcd32917347e216b64121c7b93f9a6bb5fc37047b
- SSDEEP 3:ujmtll/lHlLliag/lzM/T/X3fIAXl1dUc9fnDagM/pM/T/5wMpll/3FGtX0mRel4:ujmt/B5gmT//3X9fGgseT//lNa0mRFXn
- TLSH T18E5322C37801C9B0C5E6C830485E801D2BE15D2C2D2C2233280A770C5E7A661990C1B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\session.tmp
- Size 32B
- SHA256 7799cea14d60a0bfd534aa362b17d573030b619b99bc5a56312f34e8000cc5ea
- MD5 ebc71e3473c4a2e860af5f1d506d598b
- SHA1 bca41608845f79f35bcd6af56bd634b4fc042a5b
- SHA512 342c5d90be4912c5c281c2cbeac1531176d55ac6f75abe73b908cdc686909fcb02f5396bad527dc7baea9b3022d2169dd8f2dddf746dba173935079b4303d45e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\wct9352.tmp
- Size 63KB
- SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
- MD5 e516a60bc980095e8d156b1a99ab5eee
- SHA1 238e243ffc12d4e012fd020c9822703109b987f6
- SHA512 9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58
- SSDEEP 384:poaSLGTSy3S0XuMU9mCzHS7vpvpJGV6Hu/i49Pji7iJI5TZCP56vS1xDR+dBUFvT:WryF7U9mCzHS7vu/xV2iP56vcDR+P0T
- TLSH T18A53DD9E2108B66FE215AD5A7EABA9861C31746E3842CFCDF1CDC26C5F40DC4334A5A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\wctEABD.tmp
- Size 40.2MB
- SHA256 e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9
- MD5 fb4aa59c92c9b3263eb07e07b91568b5
- SHA1 6071a3e3c4338b90d892a8416b6a92fbfe25bb67
- SHA512 60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace
- SSDEEP 786432:YMwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59w:YpQcWxDMPnN+dk65gGUjku4vNjLjw
- TLSH T170972212ABD88075F2B79270697A63B5867ABD703F36C5CF62843A5E1B30DC19931723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\wmsetup.log
- Size 697B
- SHA256 7779fcbeedb447377d16f90919049eb3d6762c9fc05eb43ef28b50d83b227e0a
- MD5 a193326019345c6cd62314e23dde3f2f
- SHA1 cce62a5e10e735db88ed02d4553edc4d8f7afde4
- SHA512 8da71200543e6bfbccc295516b3e399d45627c569dfb81d2b1d2cc05beb30455e7532c94a5150e845f16eb8f9829c3446f13548022b42ad5290cacb16727643f
- TLSH T13601FC971B4DD8709DD01B976DECCE25737BD3CF83A1E066A348D025450A52D6B3E05D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\~DF6B90E08CF175419E.TMP
- Size 16KB
- SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
- MD5 679672a5004e0af50529f33db5469699
- SHA1 427a4ec3281c9c4faeb47a22ffbe7ca3e928afb0
- SHA512 f8615c5e5cf768a94e06961c7c8bef99beb43e004a882a4e384f5dd56e047ca59b963a59971f78dcf4c35d1bb92d3a9bc7055bfa3a0d597635de1a9ce06a3476
- SSDEEP 3:YmsalTlLPltl2N81HRQjlORGt7RQ//W1XR9//3R9//3R9//:rl912N0xs+CFQXCB9Xh9Xh9X
- TLSH T19B7202427234D665D54809368D41D5CC9776BD00DE14D14375DA775F0A314E04454652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\README.txt
- Size 1KB
- SHA256 fb44c27f85da3f113a4593375900c18617c8e1a4778b28c0598c8402663f2361
- MD5 a3abbef27c2c5d7e12ec9ebc087125b0
- SHA1 5dce76ecc569685258504fbf762123d098491bd6
- SHA512 b6c2446d56c7dbab507e0c14b0cc871b2d94f510a2061e7f6de2efa38e9eb6e0e6a491c6014d2c6dd3d591461eb4505458ad06f22e0d544de25ba2dd58bd645d
- TLSH T1B641982FEA0E425215D293D1B7AE9490BF08F61C365D03C69C2C40183374BA4B2BBBB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DC.exe
- Size 802KB
- SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
- MD5 ac34ba84a5054cd701efad5dd14645c9
- SHA1 dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
- SHA512 df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
- SSDEEP 12288:NaWzgMg7v3qnCiPErQohh0F4uCJ8lnyIQJ9QudhzYOekDXiGt8PSmQ:MaHMv6CrrjSnyIQ8+ekGA8PSmQ
- TLSH T1B605CF12B3D680B6D99338B1297BE32BEB3565194327C4C7A7F02E739F211509B3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Everything.exe
- Size 1.7MB
- SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
- MD5 c44487ce1827ce26ac4699432d15b42a
- SHA1 8434080fad778057a50607364fee8b481f0feef8
- SHA512 a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
- SSDEEP 49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH
- TLSH T13D857C42A7D344B1FD8A6637212F6713573AAB0D4313E5DF96902C70AC712F32A7E296
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Everything.ini
- Size 548B
- SHA256 2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
- MD5 742c2400f2de964d0cce4a8dabadd708
- SHA1 c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
- SHA512 63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
- TLSH T181F03020DB7D985C75B2DE74E4A2791002E623BCAE302494038D0EC77CCEACBA52B0DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Everything2.ini
- Size 550B
- SHA256 89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
- MD5 51014c0c06acdd80f9ae4469e7d30a9e
- SHA1 204e6a57c44242fad874377851b13099dfe60176
- SHA512 79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
- TLSH T11DF03620D77D945C35B2DE74E492751002D653BCAE302494038D0EC77DCDACB952B0DD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Everything32.dll
- Size 84KB
- SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- MD5 3b03324537327811bbbaff4aafa4d75b
- SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
- TLSH T179834B15295348B3F24A1831E6C642C27FBF6D433BD2A4FFFB5705854A903C5BA792A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rqhbnbfg.stj.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\xdel.exe
- Size 350KB
- SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
- MD5 803df907d936e08fbbd06020c411be93
- SHA1 4aa4b498ae037a2b0479659374a5c3af5f6b8d97
- SHA512 5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
- SSDEEP 6144:OBgL/kqXQangs2iKn5yvfj7wZxPzzLHrNJT7V:QgL5ga0iKn5GfPwZRT5
- TLSH T1EF745B10BAC08071D2B33D304BB9E6725DBE78311E359A8F53A819795F74690EA35B3B
- MD5 SHA1 SHA512 SSDEEP TLSH