Overview

overview

10

Static

static

7

sub_3a0ab5c065a2.exe

windows10-2004-x64

10

sub_3a0ab5c065a2.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    4s
  • max time network
    157s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    24/05/2026, 01:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    sub_3a0ab5c065a2.exe
  • Size 6.2MB
  • Sample260524-b53ezset7j
  • SHA256 3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionmimicpersistenceransomwarethemidatrojan

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\README.txt

Ransom Note
  • Hello my dear friend (Do not scan the files with antivirus in any case. In case of data loss, the consequences are yours) Your data is encrypted Your personal ID: QElJGyDcgaft4CvtH3fyAVWh07AEv7Uj3mbW3HsCOTU*[email protected] Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted The only method of recovering files is to purchase decrypt tool and unique key for you. If you want to recover your files, write us to this e-mail: [email protected] In case of no answer in 24 hours write us to this backup e-mail: [email protected] Contact us soon, because those who don't have their data leaked in our press release blog and the price they'll have to pay will go up significantly. Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software - it may cause permanent data loss. We are always ready to cooperate and find the best way to solve your problem. The faster you write - the more favorable conditions will be for you. Our company values its reputation. We give all guarantees of your files decryption. What are your recommendations? - Never change the name of the files, if you want to manipulate the files, be sure to back them up. If there are any problems with the files, we are not responsible for them. - Never work with intermediary companies because they charge you more money.Don't be afraid of us, just email us. Sensitive data on your system was DOWNLOADED. If you DON'T WANT your sensitive data to be PUBLISHED you have to act quickly. Data includes: - Employees personal data, CVs, DL, SSN. - Complete network map including credentials for local and remote services. - Private financial information including: clients data, bills, budgets, annual reports, bank statements. - Manufacturing documents including: datagrams, schemas, drawings in solidworks format - And more...
Emails

Signatures

  • Family: Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic
  • Detects Mimic ransomware 58 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    defense_evasion
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Themida packer 64 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Power Settings 1 TTPs 15 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sub_3a0ab5c065a2.exe
    "C:\Users\Admin\AppData\Local\Temp\sub_3a0ab5c065a2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3408
    • C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe
      "C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:652
      • C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Everything.exe
        "C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Everything.exe" -startup
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1744
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c DC.exe /D
        3⤵
          PID:5968
          • C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\DC.exe
            DC.exe /D
            4⤵
              PID:560
          • C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe
            "C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe" -e watch -pid 652 -!
            3⤵
              PID:4956
            • C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe
              "C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe" -e ul1
              3⤵
                PID:4948
              • C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe
                "C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe" -e ul2
                3⤵
                  PID:4444
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -H off
                  3⤵
                  • Power Settings
                  PID:3632
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
                  3⤵
                  • Power Settings
                  PID:408
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
                  3⤵
                  • Power Settings
                  PID:3464
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
                  3⤵
                  • Power Settings
                  PID:3264
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
                  3⤵
                  • Power Settings
                  PID:3452
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
                  3⤵
                  • Power Settings
                  PID:2808
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
                  3⤵
                  • Power Settings
                  PID:1820
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
                  3⤵
                  • Power Settings
                  PID:3024
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
                  3⤵
                  • Power Settings
                  PID:4788
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
                  3⤵
                  • Power Settings
                  PID:8
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
                  3⤵
                  • Power Settings
                  PID:4012
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
                  3⤵
                  • Power Settings
                  PID:1884
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
                  3⤵
                  • Power Settings
                  PID:2796
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
                  3⤵
                  • Power Settings
                  PID:1440
                • C:\Windows\SYSTEM32\powercfg.exe
                  powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
                  3⤵
                  • Power Settings
                  PID:2844
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3292
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5480
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3584
                • C:\Windows\SYSTEM32\bcdedit.exe
                  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:3536
                • C:\Windows\SYSTEM32\bcdedit.exe
                  bcdedit.exe /set {default} recoveryenabled no
                  3⤵
                  • Modifies boot configuration data using bcdedit
                  PID:5212
                • C:\Windows\SYSTEM32\wbadmin.exe
                  wbadmin.exe DELETE SYSTEMSTATEBACKUP
                  3⤵
                  • Deletes System State backups
                  PID:4188
                • C:\Windows\SYSTEM32\wbadmin.exe
                  wbadmin.exe delete catalog -quiet
                  3⤵
                  • Deletes backup catalog
                  PID:232
                • C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Everything.exe
                  "C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Everything.exe" -startup
                  3⤵
                    PID:5608
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                  PID:3980
                • C:\Windows\system32\wbengine.exe
                  "C:\Windows\system32\wbengine.exe"
                  1⤵
                    PID:3440
                  • C:\Windows\System32\vdsldr.exe
                    C:\Windows\System32\vdsldr.exe -Embedding
                    1⤵
                      PID:4180
                    • C:\Windows\System32\vds.exe
                      C:\Windows\System32\vds.exe
                      1⤵
                        PID:4772

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            3
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Change Default File Association

                            1
                            T1546.001

                            Power Settings

                            1
                            T1653

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            1
                            T1546

                            Change Default File Association

                            1
                            T1546.001

                            Defense Evasion

                            Indicator Removal

                            2
                            T1070

                            File Deletion

                            2
                            T1070.004

                            Modify Registry

                            2
                            T1112

                            Virtualization/Sandbox Evasion

                            1
                            T1497

                            Credential Access

                            Discovery

                            Query Registry

                            2
                            T1012

                            System Information Discovery

                            2
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Virtualization/Sandbox Evasion

                            1
                            T1497

                            Lateral Movement

                            Collection

                            Command and Control

                            Exfiltration

                            Impact

                            Inhibit System Recovery

                            3
                            T1490

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            727d60e6-0709-4bd0-b2e2-d6313545e121.tmp
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\727d60e6-0709-4bd0-b2e2-d6313545e121.tmp
                            • Size 10KB
                            • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            77e392ec-f42d-4ed9-bb10-511ddefc8339.tmp
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\77e392ec-f42d-4ed9-bb10-511ddefc8339.tmp
                            • Size 147KB
                            • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            AdobeSFX.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\AdobeSFX.log
                            • Size 1KB
                            • SHA256 bc2269e707ea04dd54d1d2f1406402f2c4a49dd015d2d1e809ae3501bb39bc38
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            DC.exe
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\DC.exe
                            • Size 64KB
                            • SHA256 825f39f8ed29f95034f200e0cfbffaedb7784f166b30dc41a49b887948a38bf1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            DefaultApps.xml
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\DefaultApps.xml
                            • Size 1KB
                            • SHA256 e512d5149170e01023f8489b1c0ef18cc6e8ac8c0dbae6df4ca9a843e283a215
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            DefaultAppsNew.xml
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\DefaultAppsNew.xml
                            • Size 5KB
                            • SHA256 5c37cd8e574cd0cde1736c60a15c180fcd5779bfb167d5e90e32eef97ec45f83
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            IOHDBSLO-20260514-0335.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\IOHDBSLO-20260514-0335.log
                            • Size 55KB
                            • SHA256 fe7cc0d7bceced98ad03877049bb3c211278d1825a23dc6ed53a34158224312b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            IOHDBSLO-20260514-0335a.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\IOHDBSLO-20260514-0335a.log
                            • Size 159KB
                            • SHA256 5c9e79bf38d87c51bacaab37c02c2fe4138b9facc513fcd39cad9ebefaceb77f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            JavaDeployReg.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\JavaDeployReg.log
                            • Size 13KB
                            • SHA256 9ce65345dd3d775617840684dd30cb1b5a488ac73867562a3c63cc9424956815
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft .NET Framework 4.7.2 Setup_20260514_033126883.html
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft .NET Framework 4.7.2 Setup_20260514_033126883.html
                            • Size 93KB
                            • SHA256 b5c0d9294d2dddf2a7bf7ef7db7701d1785942a580900e23825a1ae2616759d8
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146.log
                            • Size 15KB
                            • SHA256 d171ada79b64df34f882b7818a83443500a94f45d8e04ddd4c803aea2ca2fda4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_000_dotnet_runtime_6.0.27_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_000_dotnet_runtime_6.0.27_win_x64.msi.log
                            • Size 551KB
                            • SHA256 64c60011d03ea507e659f51e9c0459c432fe7233be26b46ba0319a34c31a0d44
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_001_dotnet_hostfxr_6.0.27_win_x64.msi.log
                            • Size 95KB
                            • SHA256 ca6fa0fb8a602a69b121055effd550ddebc86cd422a4f10cf6ba5d96c9c2ff0b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_002_dotnet_host_6.0.27_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_002_dotnet_host_6.0.27_win_x64.msi.log
                            • Size 105KB
                            • SHA256 ce3f47e791945c8073e6be65c0cf89e3e57031b9ed93ec4aec970f9f425633a7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20260514033146_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log
                            • Size 847KB
                            • SHA256 89f5b23cb0aaa41756261db4363e28a6e5f5efe85fa22c3b155481e624350cb6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207.log
                            • Size 15KB
                            • SHA256 1870cf0bb3bd4e59e24cd7bd2cf735304dcbb03721e57cbcf3fa4a028e29c48d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_000_dotnet_runtime_7.0.16_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_000_dotnet_runtime_7.0.16_win_x64.msi.log
                            • Size 470KB
                            • SHA256 af9bcbbd081a382c90f28d375663c4172709242775c84fa7ef7b4411758b9950
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_001_dotnet_hostfxr_7.0.16_win_x64.msi.log
                            • Size 95KB
                            • SHA256 4c52d2f37bfd313169b2266451c0ce7629f662afe8f7a427e770eb6b6a3c8968
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_002_dotnet_host_7.0.16_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_002_dotnet_host_7.0.16_win_x64.msi.log
                            • Size 109KB
                            • SHA256 8427bce231ac29e58858871e4d810b0d084edd825ec3d338b79bb42ebf9592f1
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20260514033207_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log
                            • Size 852KB
                            • SHA256 f130ffe8f07da6393994a6dc6038d604269dc745360ebd404a9b4f744bad22e3
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227.log
                            • Size 15KB
                            • SHA256 d49f9e0527bb89b565b10fd3d1f35fb3a7ced51179609d18dd7c67f2fca71449
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_000_dotnet_runtime_8.0.15_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_000_dotnet_runtime_8.0.15_win_x64.msi.log
                            • Size 470KB
                            • SHA256 ade31272c8d9019393394c82e1696a6479b2ba38781ad0c12129fe3eb7b0ad0d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_001_dotnet_hostfxr_8.0.15_win_x64.msi.log
                            • Size 95KB
                            • SHA256 edb6c7c75282e2a5350c30e1aa65094add3bac4227da2ad7bc03884b9360e3c2
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_002_dotnet_host_8.0.15_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_002_dotnet_host_8.0.15_win_x64.msi.log
                            • Size 109KB
                            • SHA256 8d8e1f0fcd54e1b47f7942b1fe4c362cb5f77dc7243447855b603d4044b12a12
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\Microsoft_Windows_Desktop_Runtime_-_8.0.15_(x64)_20260514033227_003_windowsdesktop_runtime_8.0.15_win_x64.msi.log
                            • Size 849KB
                            • SHA256 84a7795642d20de438adebce969ed3355ee2e01ddc62d0529d6f777440e80efa
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            PIDAR.exe
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\PIDAR.exe
                            • Size 6.2MB
                            • SHA256 3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            aria-debug-1152.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\aria-debug-1152.log
                            • Size 470B
                            • SHA256 98567337876ab1633de44f69159b85ccd2662c53a35d51b55508d0d876abe3f6
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            cv_debug.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\cv_debug.log
                            • Size 2KB
                            • SHA256 bb537a982229a4feb710dbcfe63811c4c567f8d1c840157da502f61128fdcdca
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
                            • Size 1KB
                            • SHA256 0073e131d1818c5c8efeedc18eea79a942fac0684b462568c3db9c4a575dd397
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            dd_vcredistMSI6CF5.txt
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_vcredistMSI6CF5.txt
                            • Size 426KB
                            • SHA256 f7b75f3cbc32fba4c2e1326dee3703b5d5716a89cd752df4b4c887d3cde3c476
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dd_vcredistMSI6D0F.txt
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_vcredistMSI6D0F.txt
                            • Size 414KB
                            • SHA256 c6e023a6e396e524f65a73174e01a4bda8d623a9e13b8f966342c46f1279aed6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dd_vcredistUI6CF5.txt
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_vcredistUI6CF5.txt
                            • Size 11KB
                            • SHA256 c8f450b4aacefa5707841609648b6ae53595ef8b14c59173ef0d6afe2be479d6
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            dd_vcredistUI6D0F.txt
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\dd_vcredistUI6D0F.txt
                            • Size 11KB
                            • SHA256 9dc1066fd2fb85b21d651d4931febf42e0f6f2e005fe28b1a28269321105e082
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            jawshtml.html
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\jawshtml.html
                            • Size 13B
                            • SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
                            • MD5 SHA1 SHA512
                            Submit Download

                            jusched.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\jusched.log
                            • Size 163KB
                            • SHA256 f1ce4a852ed4c7903bcb50d023c6839e287496bc3ac279faac85651eb72c4a5f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            mapping.csv
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\mapping.csv
                            • Size 120KB
                            • SHA256 2684d360ec473113d922a2738c5c6f6702975e6ac7ee4023258a12ed26c9fefe
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            msedge_installer.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\msedge_installer.log
                            • Size 2KB
                            • SHA256 f0a126711b745f855ccbef55dd2e750f9294b49dcf9d34434526ae39a80f112e
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            session.tmp
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\session.tmp
                            • Size 32B
                            • SHA256 deeb4515fc8eebdf959b71fa1c93e2148c9f365a66852299875d70dc0170e946
                            • MD5 SHA1 SHA512
                            Submit Download

                            wctE5E6.tmp
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\wctE5E6.tmp
                            • Size 63KB
                            • SHA256 543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            wmsetup.log
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\wmsetup.log
                            • Size 693B
                            • SHA256 cb7d4f1c0c57d6bff0c8df25c73813653a46e2dab00803205dd877a4eff88b3b
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ~DF2295E2963C0CB5C5.TMP
                            • Path C:\Users\Admin\AppData\Local\4B4D602C-A265-4002-905B-FF9B27D786BD\~DF2295E2963C0CB5C5.TMP
                            • Size 16KB
                            • SHA256 205d000aa762f3a96ac3ad4b25d791b5f7fc8efb9056b78f299f671a02b9fd21
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            README.txt
                            • Path C:\Users\Admin\AppData\Local\README.txt
                            • Size 1KB
                            • SHA256 aee15983befce85728c047a37769884a0bd34e5b7f2f2bad498083b355617242
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            DC.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\DC.exe
                            • Size 802KB
                            • SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Everything.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\Everything.exe
                            • Size 1.7MB
                            • SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Everything.ini
                            • Path C:\Users\Admin\AppData\Local\Temp\Everything.ini
                            • Size 548B
                            • SHA256 2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Everything2.ini
                            • Path C:\Users\Admin\AppData\Local\Temp\Everything2.ini
                            • Size 550B
                            • SHA256 89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Everything32.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\Everything32.dll
                            • Size 84KB
                            • SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            __PSScriptPolicyTest_4zfedrn3.doe.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4zfedrn3.doe.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            xdel.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\xdel.exe
                            • Size 350KB
                            • SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/652-169-0x0000000000843000-0x0000000000844000-memory.dmp
                            Download

                            memory/652-422-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-170-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-167-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-168-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-166-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-165-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-158-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-6822-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-6819-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-6817-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-5647-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-1994-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-356-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-164-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-160-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-325-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-410-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-401-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-397-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-389-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-159-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-138-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/652-157-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/3292-293-0x000001F6D2CD0000-0x000001F6D2CF2000-memory.dmp
                            Download

                            memory/3408-25-0x00000000005B3000-0x00000000005B4000-memory.dmp
                            Download

                            memory/3408-16-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-13-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-282-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-26-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-23-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-24-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-316-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-22-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-21-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-20-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-14-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-15-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3408-0-0x00000000003C0000-0x0000000001329000-memory.dmp
                            Download

                            memory/3584-341-0x000001B56F670000-0x000001B56F67A000-memory.dmp
                            Download

                            memory/3584-324-0x000001B56F380000-0x000001B56F433000-memory.dmp
                            Download

                            memory/3584-332-0x000001B56F440000-0x000001B56F44A000-memory.dmp
                            Download

                            memory/3584-323-0x000001B56F360000-0x000001B56F37C000-memory.dmp
                            Download

                            memory/3584-339-0x000001B56F8D0000-0x000001B56F8EC000-memory.dmp
                            Download

                            memory/3584-340-0x000001B56F660000-0x000001B56F66A000-memory.dmp
                            Download

                            memory/4444-263-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-417-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-413-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-309-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-311-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-310-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-312-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-314-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-355-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-315-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-313-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4444-308-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-270-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-416-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-354-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-247-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-269-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-272-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-273-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-279-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-280-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-281-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-265-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4948-388-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-267-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-264-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-260-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-259-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-271-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-411-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-261-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-246-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-262-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-266-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/4956-353-0x0000000000650000-0x00000000015B9000-memory.dmp
                            Download

                            memory/5480-342-0x0000018D43310000-0x0000018D4332A000-memory.dmp
                            Download

                            memory/5480-343-0x0000018D432C0000-0x0000018D432C8000-memory.dmp
                            Download

                            memory/5480-345-0x0000018D43300000-0x0000018D4330A000-memory.dmp
                            Download

                            memory/5480-344-0x0000018D432F0000-0x0000018D432F6000-memory.dmp
                            Download