36767d7940ef4bc1d70366d7c5cb8074990b64fa8207fe17c349c44562f9f72a

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_2d7276168a49419c4c96372b8cccbdc5_amadey_elex_mimic_pay2key_wannacry.exe
Size 10.8MB
Sample260714-b2j48sct3m
SHA256 36767d7940ef4bc1d70366d7c5cb8074990b64fa8207fe17c349c44562f9f72a
MD5 2d7276168a49419c4c96372b8cccbdc5
SHA1 6558715e6746cb0f51139ffdfaadca4edb354285
SHA512 db5611215c9821d4fc5031bb5c22a55f9705775eb1cb81957ef060ebbeb9be9f36eca442cc2cfc7337611f0c9e196b70daef8532c359e0dd746aaadb298551ea
SSDEEP 196608:c+h++oswWlDwpv2xg1AysDHig0lOKdA8PhfnD6DgZ2dUI:c+h9tDqF1XsDHYlR+8ZnD0gId1
TLSH
T1C4B633442326CD35D9E55F742CE40BE75B60B8AB06074BDB12CCCC96F260BE7566E28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6076	attrib.exe

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a000000	PartAssist.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
4224	PartAssist.exe

Loads dropped DLL 14 IoCs

pid	Process
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
1824	bcdedit.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ampa.sys	cmd.exe
File created	C:\Windows\System32\ampa.sys	cmd.exe
File opened for modification	C:\Windows\System32\ampa.sys	cmd.exe
File created	C:\Windows\SysWOW64\ampa.sys	cmd.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2124	sc.exe
3764	sc.exe
5640	sc.exe
2380	sc.exe
1312	sc.exe
5764	sc.exe
2900	sc.exe
5464	sc.exe
1716	sc.exe
420	sc.exe
3140	sc.exe
4480	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_2d7276168a49419c4c96372b8cccbdc5_amadey_elex_mimic_pay2key_wannacry.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1148	taskkill.exe
2704	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2104	tskill.exe
2104	tskill.exe
4580	tskill.exe
4580	tskill.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
820	Process not Found
820	Process not Found
4224	PartAssist.exe
4224	PartAssist.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4224	PartAssist.exe
Token: SeAuditPrivilege	4224	PartAssist.exe
Token: SeSecurityPrivilege	4224	PartAssist.exe
Token: SeTakeOwnershipPrivilege	4224	PartAssist.exe
Token: SeManageVolumePrivilege	4224	PartAssist.exe
Token: SeRestorePrivilege	4224	PartAssist.exe
Token: SeBackupPrivilege	4224	PartAssist.exe
Token: SeLoadDriverPrivilege	4224	PartAssist.exe
Token: SeLoadDriverPrivilege	4224	PartAssist.exe
Token: SeLoadDriverPrivilege	4224	PartAssist.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4224	PartAssist.exe
4224	PartAssist.exe
4224	PartAssist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2660	1772	2026-07-13_2d7276168a49419c4c96372b8cccbdc5_amadey_elex_mimic_pay2key_wannacry.exe	88
PID 2660 wrote to memory of 4640	2660	cmd.exe	90
PID 2660 wrote to memory of 6076	2660	cmd.exe	91
PID 1772 wrote to memory of 3196	1772	2026-07-13_2d7276168a49419c4c96372b8cccbdc5_amadey_elex_mimic_pay2key_wannacry.exe	92
PID 3196 wrote to memory of 5240	3196	cmd.exe	94
PID 3196 wrote to memory of 5152	3196	cmd.exe	95
PID 3196 wrote to memory of 5764	3196	cmd.exe	96
PID 3196 wrote to memory of 4632	3196	cmd.exe	97
PID 4632 wrote to memory of 1476	4632	net.exe	98
PID 3196 wrote to memory of 3140	3196	cmd.exe	99
PID 3196 wrote to memory of 2900	3196	cmd.exe	100
PID 3196 wrote to memory of 968	3196	cmd.exe	101
PID 3196 wrote to memory of 4784	3196	cmd.exe	102
PID 4784 wrote to memory of 4352	4784	net.exe	103
PID 3196 wrote to memory of 4480	3196	cmd.exe	104
PID 3196 wrote to memory of 2124	3196	cmd.exe	105
PID 3196 wrote to memory of 2036	3196	cmd.exe	106
PID 3196 wrote to memory of 3908	3196	cmd.exe	107
PID 3196 wrote to memory of 3764	3196	cmd.exe	108
PID 3196 wrote to memory of 5116	3196	cmd.exe	109
PID 5116 wrote to memory of 4320	5116	net.exe	110
PID 3196 wrote to memory of 5640	3196	cmd.exe	111
PID 1772 wrote to memory of 4224	1772	2026-07-13_2d7276168a49419c4c96372b8cccbdc5_amadey_elex_mimic_pay2key_wannacry.exe	112
PID 1772 wrote to memory of 4776	1772	2026-07-13_2d7276168a49419c4c96372b8cccbdc5_amadey_elex_mimic_pay2key_wannacry.exe	115
PID 4776 wrote to memory of 3472	4776	cmd.exe	117
PID 4776 wrote to memory of 4568	4776	cmd.exe	118
PID 4776 wrote to memory of 3612	4776	cmd.exe	119
PID 4776 wrote to memory of 5340	4776	cmd.exe	120
PID 4776 wrote to memory of 5464	4776	cmd.exe	121
PID 4776 wrote to memory of 1148	4776	cmd.exe	122
PID 4776 wrote to memory of 2104	4776	cmd.exe	124
PID 4776 wrote to memory of 2704	4776	cmd.exe	125
PID 4776 wrote to memory of 4580	4776	cmd.exe	126
PID 4776 wrote to memory of 4316	4776	cmd.exe	127
PID 4316 wrote to memory of 4612	4316	net.exe	128
PID 4776 wrote to memory of 1716	4776	cmd.exe	129
PID 4776 wrote to memory of 2380	4776	cmd.exe	130
PID 4776 wrote to memory of 4740	4776	cmd.exe	131
PID 4776 wrote to memory of 5344	4776	cmd.exe	132
PID 5344 wrote to memory of 2808	5344	net.exe	133
PID 4776 wrote to memory of 420	4776	cmd.exe	134
PID 4776 wrote to memory of 1312	4776	cmd.exe	135
PID 4776 wrote to memory of 3304	4776	cmd.exe	136
PID 4776 wrote to memory of 1952	4776	cmd.exe	137
PID 4776 wrote to memory of 5456	4776	cmd.exe	138
PID 4776 wrote to memory of 2680	4776	cmd.exe	139
PID 4776 wrote to memory of 4592	4776	cmd.exe	140
PID 4776 wrote to memory of 1848	4776	cmd.exe	141
PID 4776 wrote to memory of 3960	4776	cmd.exe	142
PID 3960 wrote to memory of 2620	3960	cmd.exe	143
PID 4776 wrote to memory of 3396	4776	cmd.exe	144
PID 3396 wrote to memory of 1824	3396	cmd.exe	145
PID 3396 wrote to memory of 4504	3396	cmd.exe	146
PID 4776 wrote to memory of 3824	4776	cmd.exe	147
PID 4776 wrote to memory of 3028	4776	cmd.exe	148
PID 4776 wrote to memory of 5796	4776	cmd.exe	149
PID 4776 wrote to memory of 800	4776	cmd.exe	150
PID 4776 wrote to memory of 8	4776	cmd.exe	151
PID 4776 wrote to memory of 5776	4776	cmd.exe	152
PID 4776 wrote to memory of 6120	4776	cmd.exe	153
PID 4776 wrote to memory of 3064	4776	cmd.exe	154
PID 4776 wrote to memory of 5992	4776	cmd.exe	155
PID 4776 wrote to memory of 5644	4776	cmd.exe	156
PID 4776 wrote to memory of 5736	4776	cmd.exe	157

Views/modifies file attributes 1 TTPs 27 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4516	attrib.exe
6076	attrib.exe
6120	attrib.exe
5392	attrib.exe
1404	attrib.exe
4260	attrib.exe
5240	attrib.exe
5992	attrib.exe
2480	attrib.exe
4120	attrib.exe
2388	attrib.exe
2860	attrib.exe
4552	attrib.exe
4520	attrib.exe
5736	attrib.exe
2796	attrib.exe
5380	attrib.exe
4132	attrib.exe
5852	attrib.exe
1988	attrib.exe
832	attrib.exe
2404	attrib.exe
3824	attrib.exe
5796	attrib.exe
8	attrib.exe
4372	attrib.exe
1184	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-13_2d7276168a49419c4c96372b8cccbdc5_amadey_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_2d7276168a49419c4c96372b8cccbdc5_amadey_elex_mimic_pay2key_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c for /f %i in ('dir /b /o:-d "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.*"') do if not defined top (Set top=1&attrib +s +h "C:\Users\Admin\AppData\Local\Temp\%i")&
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /o:-d "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.*"
    3⤵
    PID:4640
- - C:\Windows\system32\attrib.exe
    attrib +s +h "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000"
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\_Green.bat" OnceGreen "
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Control\MiniNT"
    3⤵
    PID:5240
- - C:\Windows\System32\fltMC.exe
    fltMC
    3⤵
    PID:5152
- - C:\Windows\system32\sc.exe
    sc query
    3⤵
    - Launches sc.exe
    PID:5764
- - C:\Windows\system32\net.exe
    net stop "ampa"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ampa"
      4⤵
      PID:1476
- - C:\Windows\system32\sc.exe
    sc stop "ampa"
    3⤵
    - Launches sc.exe
    PID:3140
- - C:\Windows\system32\sc.exe
    sc delete "ampa"
    3⤵
    - Launches sc.exe
    PID:2900
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ampa" /f
    3⤵
    PID:968
- - C:\Windows\system32\net.exe
    net stop "ddmdrv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4784
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ddmdrv"
      4⤵
      PID:4352
- - C:\Windows\system32\sc.exe
    sc stop "ddmdrv"
    3⤵
    - Launches sc.exe
    PID:4480
- - C:\Windows\system32\sc.exe
    sc delete "ddmdrv"
    3⤵
    - Launches sc.exe
    PID:2124
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ddmdrv" /f
    3⤵
    PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:3908
- - C:\Windows\system32\sc.exe
    sc create ampa start= demand type= kernel binpath= "\??\C:\Windows\System32\ampa.sys" error= ignore displayname= "ampa"
    3⤵
    - Launches sc.exe
    PID:3764
- - C:\Windows\system32\net.exe
    net start ampa
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start ampa
      4⤵
      PID:4320
- - C:\Windows\system32\sc.exe
    sc start ampa
    3⤵
    - Launches sc.exe
    PID:5640
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\PartAssist.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\PartAssist.exe"
  2⤵
  - Uses Session Manager for persistence
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\_Uninsta.bat" UnInsta "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\ControlSet001\Control\MiniNT"
    3⤵
    PID:3472
- - C:\Windows\System32\fltMC.exe
    fltMC
    3⤵
    PID:4568
- - C:\Windows\system32\find.exe
    find /?
    3⤵
    PID:3612
- - C:\Windows\system32\findstr.exe
    findstr /?
    3⤵
    PID:5340
- - C:\Windows\system32\sc.exe
    sc query
    3⤵
    - Launches sc.exe
    PID:5464
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "ampa.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- - C:\Windows\system32\tskill.exe
    tskill "ampa"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2104
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im "ddmmain.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\system32\tskill.exe
    tskill "ddmmain"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4580
- - C:\Windows\system32\net.exe
    net stop "ampa"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ampa"
      4⤵
      PID:4612
- - C:\Windows\system32\sc.exe
    sc stop "ampa"
    3⤵
    - Launches sc.exe
    PID:1716
- - C:\Windows\system32\sc.exe
    sc delete "ampa"
    3⤵
    - Launches sc.exe
    PID:2380
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ampa" /f
    3⤵
    PID:4740
- - C:\Windows\system32\net.exe
    net stop "ddmdrv"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "ddmdrv"
      4⤵
      PID:2808
- - C:\Windows\system32\sc.exe
    sc stop "ddmdrv"
    3⤵
    - Launches sc.exe
    PID:420
- - C:\Windows\system32\sc.exe
    sc delete "ddmdrv"
    3⤵
    - Launches sc.exe
    PID:1312
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\ddmdrv" /f
    3⤵
    PID:3304
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched" /f /v "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\PartAssist.exe"
    3⤵
    PID:1952
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Partition Assistant" /f
    3⤵
    PID:5456
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\SOFTWARE\Sysinternals\LdmDump" /f
    3⤵
    PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver"
    3⤵
    PID:4592
- - C:\Windows\system32\findstr.exe
    findstr /i /c:" 5."
    3⤵
    PID:1848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Sysinternals" /s 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\SOFTWARE\Sysinternals" /s
      4⤵
      PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c BCDEdit /enum {bootmgr}|findstr /i /c:"partition=\Device"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\system32\bcdedit.exe
      BCDEdit /enum {bootmgr}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1824
  - - C:\Windows\system32\findstr.exe
      findstr /i /c:"partition=\Device"
      4⤵
      PID:4504
- - C:\Windows\system32\attrib.exe
    attrib -s -h A:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "A:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:3028
- - C:\Windows\system32\attrib.exe
    attrib -s -h B:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "B:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:800
- - C:\Windows\system32\attrib.exe
    attrib -s -h C:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:8
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "C:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:5776
- - C:\Windows\system32\attrib.exe
    attrib -s -h D:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:6120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "D:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:3064
- - C:\Windows\system32\attrib.exe
    attrib -s -h E:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "E:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:5644
- - C:\Windows\system32\attrib.exe
    attrib -s -h F:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "F:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4648
- - C:\Windows\system32\attrib.exe
    attrib -s -h G:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:2796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "G:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4576
- - C:\Windows\system32\attrib.exe
    attrib -s -h H:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "H:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:5612
- - C:\Windows\system32\attrib.exe
    attrib -s -h I:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:5380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "I:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4292
- - C:\Windows\system32\attrib.exe
    attrib -s -h J:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:2480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "J:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:2604
- - C:\Windows\system32\attrib.exe
    attrib -s -h K:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "K:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:3896
- - C:\Windows\system32\attrib.exe
    attrib -s -h L:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:2388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "L:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4996
- - C:\Windows\system32\attrib.exe
    attrib -s -h M:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:4372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "M:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:1976
- - C:\Windows\system32\attrib.exe
    attrib -s -h N:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "N:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4236
- - C:\Windows\system32\attrib.exe
    attrib -s -h O:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:1184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "O:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:1796
- - C:\Windows\system32\attrib.exe
    attrib -s -h P:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:4552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "P:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4104
- - C:\Windows\system32\attrib.exe
    attrib -s -h Q:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "Q:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:1288
- - C:\Windows\system32\attrib.exe
    attrib -s -h R:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:4520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "R:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4192
- - C:\Windows\system32\attrib.exe
    attrib -s -h S:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:1404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "S:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:1568
- - C:\Windows\system32\attrib.exe
    attrib -s -h T:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "T:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4664
- - C:\Windows\system32\attrib.exe
    attrib -s -h U:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:5852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "U:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4288
- - C:\Windows\system32\attrib.exe
    attrib -s -h V:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "V:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:6076
- - C:\Windows\system32\attrib.exe
    attrib -s -h W:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "W:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:4796
- - C:\Windows\system32\attrib.exe
    attrib -s -h X:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "X:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:2584
- - C:\Windows\system32\attrib.exe
    attrib -s -h Y:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "Y:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:5152
- - C:\Windows\system32\attrib.exe
    attrib -s -h Z:\AMTAG.BIN
    3⤵
    - Views/modifies file attributes
    PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir /b /ad "Z:\AOMEI Partition Assistant Disk Speed Test-*" 2>nul
    3⤵
    PID:5764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Common AppData" 2>nul
    3⤵
    PID:2644
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v "Common AppData"
      4⤵
      PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

INSTAL~1.INI

Path C:\ProgramData\AOMEIPA\INSTAL~1.INI
Size 48B
SHA256 e5e79ee1610130296ebc31ba8e0fe221d48ef626cf9ba0b9580184cd3a0c9334
MD5 9be75a5d7fa52a87089b0fe0ee12b027
SHA1 917a61781df045e6dd7cff9a05cc258558965d40
SHA512 10156e5c25a6ae26806d5f98628965f6504c89dcaba65d893a34ddb3ca1e21dc303c1df5a9559da3c304b7d0945eac53a4b5560c8e4ac0dd3aa92222cbfd5109
MD5 SHA1 SHA512

Submit Download

usercfg.ini

Path C:\ProgramData\AomeiBR\usercfg.ini
Size 59B
SHA256 f60a9b620ecbcfcf7e7fd9ced28679750140d1d2dd16360605cadaf3f3047b4d
MD5 42cd223975abf25a9042f70fa5fd8c33
SHA1 91bd9d73725367d0b50b0a26cdea597e877974b4
SHA512 c92af621178d284a519a7a7e7a91378988e220d69f791e5b807bf28ee23c863407d8956b1d019c2ff02def7e4eb57838fac3cfd19448205a5ed2d3da080a73eb
TLSH
T1FAA002B1549D64690F404D216EB60E88A19BD24AE0551490D0B956C8A44142D891705A
MD5 SHA1 SHA512 TLSH

Submit Download

AmAnacfg.ini

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\AmAnacfg.ini
Size 152B
SHA256 17d4c334bc6d6bbfb1a73904b4f5800c86485624e1c2d00006f9bf0caac9a7c4
MD5 f9f6dc7454b8ec63b26254b8ac0fa5ed
SHA1 fd0adbb1dd292384f558495571664d40aa0820f7
SHA512 69fc5b018b0a8225de0c5b8825b2cd8bdac47139f8a2811ec7369264e2a2eacb3acbf03207885ae4d43e92b755f6db39d6b1adc91009cde8346a64ad46e47004
TLSH
T11FC08C11214323A2A48A62A0364E24B896A3C668AA8C9494E06D871B8A00D902BAF340
MD5 SHA1 SHA512 TLSH

Submit Download

Cfg.ini

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\Cfg.ini
Size 203B
SHA256 eeadb1d957a29164eccdd902f2151436880002cec04a2c804f149625eed72899
MD5 75b830ca6e2c9ee93db70867531fc961
SHA1 21c293c78e26658a3bd2660b041d379599faf127
SHA512 7127314b00dea2f6c60a64e397386cec5b12e584a4147bae3f25b2a85383cbb3d38e13aa53173a65d85e02e362b0f76070218620fb34fae7653bf198c4374066
TLSH
T1EBD0A7E459E0CB6D3860FD29FB1475A03200045902414C748245E5A58B1384D121D522
MD5 SHA1 SHA512 TLSH

Submit Download

Encrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\Encrypt.dll
Size 527KB
SHA256 c5b1083a3f111dfaf9f1cda5a8cdf75a9cb113f1ef287cd32962c2de22074133
MD5 fc64269c0ad6431c4964125b6755d71e
SHA1 2c79d8604bcd181aaaf86fecbd77a63a94ac50b5
SHA512 61c4ee59a86944c8b9408a641c1d3e787219cf45250a457defb92c93f581815711b578c714087b302bd354b84665202e622c0914c61d839008c9a4c37306c393
SSDEEP 12288:aCuDs06pVYqwVKVylihoANlG2q14CzzVuJVl:aHDs0679VylGoANlG2Y4CzzVuJVl
TLSH
T136B47C46776443B9E667D27DCA574B46EAB278064B21A38F03F443BA1F133A05A7F321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cn.txt

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\Lang\cn.txt
Size 194KB
SHA256 bc96802af54dee91adff9377cf7d500b51989642af52992e664c3250a533a115
MD5 697741dc078427438ab758bb4cba7e48
SHA1 9d419c1e4b8448184a499d14731eb51fa13c8d05
SHA512 4d0653afde708dc97d8a923dffa24866d47277c15255bc31b147953c81b11b62096f8e0afeaa56dc8180954f79ba49eb68f986c4eaa9d62777cd86e21eb262d9
SSDEEP 3072:vabGK9D2JFjRrwHY5rxcWfX+NTciU0QqT5l4eHSqjzBR26RorvH3:A9v+X+NTppQqTznZs
TLSH
T1A814733E26AA022692F3CA1CD4D42567B3F53A02752CDD4552EB8B4C51E9E027493BFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\MSVCP140.dll
Size 553KB
SHA256 9fee6f36547d6f6ea7ca0338655555dba6bb0f798bc60334d29b94d1547da4da
MD5 6da7f4530edb350cf9d967d969ccecf8
SHA1 3e2681ea91f60a7a9ef2407399d13c1ca6aa71e9
SHA512 1f77f900215a4966f7f4e5d23b4aaad203136cb8561f4e36f03f13659fe1ff4b81caa75fef557c890e108f28f0484ad2baa825559114c0daa588cf1de6c1afab
SSDEEP 12288:M/Wn7JnU0QUgqtLe1fqSKnqEXG6IOaaal7wC/QaDWxncycIW6zuyLQEKZm+jWodj:yN59IW6zuAQEKZm+jWodEEY1u
TLSH
T1C4C40923B75D05E0E195A3B8A1838305D7F17C4A8312A3C792FB96AD2F673D56B3B190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mfc140u.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\Mfc140u.dll
Size 4.0MB
SHA256 76545959d284b1275cfd9183e01704aae297f723dcf0ec517e56c7861189ef07
MD5 55a0c8702ea0a198a7e0964c85f13d55
SHA1 8737a0e8dd39394ea2d2d70a702490277e55e090
SHA512 e878745fc0172fe647eedc0d07587807a6e41dc91576048e2c6fe69611fc93da62b14a6ac4184f5d5821010c76085b72aac2f51fd869d03bd446ee85f73881bd
SSDEEP 49152:ouBRhyCGULIN0gr+/Yg75T4vLpkCyShWS6YRQGM8BomoPNZudMyuC7+oU:JLc3gEjwX
TLSH
T17C165C46B6AD00A1D665D03AC6178D4FE7B2F8110362A3CF4171879E6F3BBD2893E365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sc64.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\Native\sc64.exe
Size 44KB
SHA256 eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf31
MD5 4ebbc2b0ad7f9075ae9d6835d2a62b6e
SHA1 db1f81f5e209fed6df3255f6c820555cf17a839c
SHA512 20802768bb9c36aab07ebe2b985c05193cde77f5d0a7e41c3766e148278cfaa277558be6f0b2bb978cd90fe505c3c6bf7be93a90f87a6594bf7a1b9d1ac2145c
SSDEEP 768:9XTOH6JcfNOai4B0qWj7RRR3qPPcHB64tUhFb6M0GU9I5u9tp7PZK:ZOH6YNSIoRTmrpq9muF7PZK
TLSH
T169131915E3E805F4F4B6CBB0CAB7A233E97179A21924E64F9654C61A0F32E50AF15B13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ampa.sys

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\Native\wlh\amd64\fre\ampa.sys
Size 37KB
SHA256 01d51df682136cce453bb1da8964073e6bc7297ce4dae7301c753bb618a69469
MD5 d0c50c113fe59c21ad59932e6b9c202f
SHA1 41ff9cf9091fef6da6dfa3279310655a84ed5845
SHA512 61a90f9933252ddc2ca9f5c829b9bac61dab4d309bea61f966da2c48885cb3d49b187b1edf445168f5c6d7bf05ce76ff65570953ac1139bf0b937004565a9d3e
SSDEEP 768:Fu+Mi6BsWRfIs3iyKvyI2rTkYn23+zjAnf0u3DWkM:er7NHvkJ2SZTM
TLSH
T1DA035BC7463C5083EB86CDB8A2E9DA17AD74B7C6AF9544CF0025C5912E46BE1BB3C21D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ampa10.sys

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\Native\wlh\amd64\fre\ampa10.sys
Size 31KB
SHA256 4909945cc832276521a749b196939d7baa66ba9b0fc0a69f8dcd9045d69e9780
MD5 49679a7d51f16fb03653ed33201e6032
SHA1 b99b1ba53cfb7256c0307bf72550a461820c6423
SHA512 5747995a6f87726e50635ab9d690b502ff170985ffd49153f58e034e968ffca25c37e1f18919ff6fac5e903990ce349cc666ac4f702d1e7bc4b048384a3bfb45
SSDEEP 384:Y0gVmCFxapEFv0KihnDbkpwK3p567PuqKzCKjd3gSGBkS8LqDP3h3dLki+R9z1oW:UmMv3itG672qKzCKZik3Lql3dy9zu6x
TLSH
T17BE26B9A16389043DA5BCC38A1C4DA23BD38B6D29BD144CF1126E91C5E477E4BB3C2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ampa.sys

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\Native\wnet\amd64\fre\ampa.sys
Size 35KB
SHA256 fc3eb89dba30987372fc71432b069e402a5cca0747fb22562d195f873e548a05
MD5 c32b795b1f8d6ddd7a4969f9b633c86e
SHA1 87f72c6e21243788b01c1d9435fefbd8f3eea422
SHA512 206cac7096c2ccad59ca0cb8c7a43e62647d5a17db74ae3dd0509838ca02185214df617874dbd1a572a3f44964b1913307e6d03b295834424dec899e09ca59b8
SSDEEP 384:9M8dareLjj/OrLbBKuC3Zd0ZnYPL6x2UHeMrSMQM1K2cKzy9fyQBCU23+tzhjsj8:FarESvBKLp8vBI2rTGn23+zje0u3Dl4
TLSH
T1BBF25A974738A087EF83CCB892D9D963AD74B7C26F9405CF4066C5852E46BE1B73821D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PartAssist.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\PartAssist.exe
Size 18.1MB
SHA256 266554409fc3145854177e097b71368d319c64bf14c34756072551c16082ee8e
MD5 0da20017984b1f0ae8c86c9239fa8c6c
SHA1 3ea81b53b9cb446023a174161edea2b9a7bff13e
SHA512 17653a5991927ee6080b2f09c20aeda049b79c80753d6828244bf6ad6d973be1f3d68dd41005056def8b65c9f8532e73383f60ca313d3604ce2717657981c63e
SSDEEP 393216:IPtsIU9OJDUAv9JwriUteMu6Fn4PITWoq6L6mfFKBFH57vd4WDU1j4KV2HwdMYGo:k+fV4xc
TLSH
T137173883929C0DB2D0EE84FAC11D529FE9A93E51932149EF0155F575AF322C0AEF9B70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScanPartition.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\ScanPartition.dll
Size 1.0MB
SHA256 d4db4947dd0feee6f7107f024caa6ea8973969a38e610d2609dd7d7a3b12c338
MD5 f451e5f1a803d30eff8ea70d8f495e0a
SHA1 ee7385211b8ad0d088f509b65d22b3104cca90e9
SHA512 6dd5c7a15dbbe1f372169a9a261bad9d3ed90a57f6c0ca7178300e949216f798e270c8309268d6e6aa30447647697b74a09e10b77438659ec96b41e1dc4bc100
SSDEEP 12288:DLObl9q0hBcDLeGuNleY4qD9iu59An1QVcRuH/c8iUrH:D49q0rQsWYdD9pjAn6VBH/v9
TLSH
T141359E26A36501BCE4BFD13CC6A75223E6B2740953258ADF13D196656F23BE1393EB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Up.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\Up.dll
Size 657KB
SHA256 adbcc5cf344145d32ce4c76ba9700a1d3c0d7f930ff7489ea2c4d7e385db54f8
MD5 ce29ec77039ad6194d8c92a552bc6557
SHA1 6a4e08a89b4887017009dcde925fd68ee06a951b
SHA512 87f47532af45cb958eaa3451b93ed317c961e7279dbe0f4d3a08b2b07b0f05b671fa0448cf9abbcd95a473a8f3f118b6d2cce634ec22f67009d4de764176c53e
SSDEEP 6144:4N/GoS0InOzQwTuWJUbMI9p/az2TKAVbNJolM62Rzf5TVO4/7xkzx2qNy+dp:2InOzQwKp4zSKAVbhzpI6IMup
TLSH
T1EDE4F80BEA6A12D4E4BAD03DDA63523BF97178549334ABF753414E160F127E6A93EF00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\VCRUNTIME140_1.dll
Size 36KB
SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
MD5 135359d350f72ad4bf716b764d39e749
SHA1 2e59d9bbcce356f0fece56c9c4917a5cacec63d7
SHA512 cf23513d63ab2192c78cae98bd3fea67d933212b630be111fa7e03be3e92af38e247eb2d3804437fd0fda70fdc87916cd24cf1d3911e9f3bfb2cc4ab72b459ba
SSDEEP 384:5hnvMCmWEKhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+Xf0+uncS7IO5WrCKWU/tQ0g:YCm5KhUcwrHY/ntTxT6ov07b4SwY1zl
TLSH
T113F24B9463788492E46B95B0C4A35F2BFB38F9625750938F0BA4815D2F637D0F63E31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRuntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\VCRuntime140.dll
Size 95KB
SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
MD5 f34eb034aa4a9735218686590cba2e8b
SHA1 2bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA512 d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
SSDEEP 1536:ywqHLG4SsAzAvadZw+1Hcx8uIYNUzUoHA4decbK/zJNuw6z5U:ytrfZ+jPYNzoHA4decbK/FNu51U
TLSH
T129A36C5A76A442BBD06BD274C1E34A1AF770B8408B3093CF07B6856A4F67BE05E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\WebView2Loader.dll
Size 156KB
SHA256 dcf3c4f6024313eeb6f775ed343265d73be1ce1d5dde2f92195dbc32310c7fc9
MD5 1ba96800bad54c6019fdb6fe41fca592
SHA1 b443b01719c3046d9107e93d181d5da38e6650aa
SHA512 499764e2c75e9afb25e19941312221d3fce7c058ffac8293db5986a6a9b8dd77c45bf93311858470bec9afbd64dc3068b3d9a26d3e01051b9d51c02b1c2484c2
SSDEEP 3072:5fSjk2nJwnL9/a/vck4L3Ke1+Y6hUR8SAoTCMrEtnczzrND/jY3:y2nL9//dWc6h0Etczs
TLSH
T18EF36C57B3F5007BE1679274C9A34A52E77778110B60ABDF03A482691F237E4AE3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WimGApi.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\WimGApi.dll
Size 497KB
SHA256 e2faaaab8c7254bc281757a19c6c0fed1da171a9f6c8f408cf1687e662a723c6
MD5 6bb403f6c388f87ace8a7450393a2c51
SHA1 790f67879ff62932801da287b81078be3ac59076
SHA512 ad364c1bc08002c587a20e9373f036665782b01d7fe6126024edfb0f67101526456370a4c76e346e974afb5047338b7f6ed87d508f687873daaecc891ded1ac5
SSDEEP 12288:I6w8nL5ek3xyH9s9MicEuAwrinAPf7YWsjwZDWYSn:I6w8nddmPinAn7rsjwZDWYSn
TLSH
T1C7B44C03D2E612EAD1FBD679CA674627EBB174185B349BCF01A085992F13BE09E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WimMgr.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\WimMgr.dll
Size 180KB
SHA256 f00397e2cda326986f9de21d2c3788dcb73c3406958faedc2347668283874196
MD5 2f906422842d4b6a999147683d47be2a
SHA1 85f7825b3dca467535a3d44ad70c97d2b89805e7
SHA512 73cd47296bc0e383d9fc47c4b416f1bf0875c2f9dd566285321465b8304c8a28841a82361984820f711b11f3f89d12d46e87aeeb5c220939ad003a888f76a925
SSDEEP 3072:nsFhoMIeX1qSG0V7TbrwVsKlxqn+oGG5ljV6GlV/:53elqgmsKlxqnJGG5ljV6GlV/
TLSH
T13A044903A66A03FDD1DBE27846DA9D23F2BB780A037059CF039059721F667E1BE79201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinHttp.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\WinHttp.dll
Size 428KB
SHA256 0caa315b0871dd822bbb5e5896e5c2b8f71d2da488951c89e8c37a93204c5223
MD5 4552f2ff1ff3720a65619f92965e1acc
SHA1 66fe9d884a8d493581a3d28b83e3c2bfe69f8f55
SHA512 a55062922aa014c5c96819ac6412d80ef3790528c9e73888566593c430e26a5e91e839f00396f0fdcc9b08cb4252897bf488e848e02c99a94a92a15f6b2a4988
SSDEEP 6144:hQ1MHx7hfdeZx4eHmcIIoZscdGN51UllDS4huIMVamx2P+DEPuXT:PdMr4eHmcIvsfLmldS4huGmx2GIG
TLSH
T1C3946D06F2A045B5D45BC174C5A3C673FBB175B40A24AB5F06A0DF561F23BA0EB3AB06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AMD64_~2.MAN

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\WinSxS\MANIFE~1\AMD64_~2.MAN
Size 804B
SHA256 d128392c5e59d2ed98b265ddad9827376c61f828ccd6f47b18f58001b4100a26
MD5 1d4a72493c677a9e9b185ee7f876a020
SHA1 0646860898abc9b6e65df0804e7d9aac2485d52a
SHA512 33de7b5cfe20a022ca1a3c175f5edd6548c4c9a9f2ed4ead97bf88248154c46a63909cfd794ac53d24183f8b6ce03c8cf064ade7b05286e00a60c6dd0908c901
TLSH
T1CD01BD00E185EE35262109B12B929C088FFD23E3028D565C74FCB6878F234E5C20B17F
MD5 SHA1 SHA512 TLSH

Submit Download

amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2.manifest

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\WinSxS\Manifests\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2.manifest
Size 1KB
SHA256 8fb01997d396c9aaaeb9e821cc936b31a2ced45a96cd10c39bf892d4bbaf6fe2
MD5 33d82d763b876bc33c4b2adfd7927e27
SHA1 63073b26d2a54963cd417644534fe763d09e5960
SHA512 3d25b961a3fa3177eaca6e1e6004b3e19354eac21aa95c0e2be8fb8219e764e6c5ce981f33d991dba2ad2e86fdab72f6f3b72df954399aeb410dd2288fb6eb52
TLSH
T1D921AF40CC857D26E301D5D4BEF1F91970463B63057D4AAE5CE22DFF6D8249986822F6
MD5 SHA1 SHA512 TLSH

Submit Download

msvcp80.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2\msvcp80.dll
Size 1.0MB
SHA256 d3ed3fef0f3fd9d547d7ef60d5f532d6aab5bd45966abcb24bdf61dec60c813e
MD5 c332db81197e6e5d4a67d3789dbeb02a
SHA1 d691130e4808910ed5ca0640150b9badc8124243
SHA512 660462070a3a4d4dff52e1d20c22dff1c6caab48f0d039a43e7f322099068ff0eb80dfc6dbb9bea7a2923e8986b36fbe6048ee147ae44be8696d6d93214cc6b9
SSDEEP 24576:ijUopfAPMaZ0eHSQSoSx2+5W1dV/b0rx1wKQhiPBk09I/GF6BiDWXBrT22396jIx:ijUoIZ0eHSQCx2/1dV/b0rnQhiPBk097
TLSH
T11335F952BB2E06A2D191E3FDA2C38311D3F27C568B2567C30297D7191F672C9A27B760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr80.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.762_none_c905be8887838ff2\msvcr80.dll
Size 778KB
SHA256 2219e15b66aba301909128e6775e0b4f8b28b529b3ec087161edae55e2676c65
MD5 4d89f6191db56cfa659388378f3dd688
SHA1 c5f28857b4d3a9d182b9c25f3d599bb84ccb8acb
SHA512 7a6b735bb80154e913e2d95e9e475cdfdec84cca410f4c05175aa7cc6d84adcb1726072f4b7b69acb88f9178ae67b9bf0c28d341a9a1dae3d32b4a36762eeb53
SSDEEP 24576:zffRUhGdopm8o5d/HJEoxsvaagwHmqo/mWeAgvzQQmhyBg:VUhtplQ/
TLSH
T13B058D86F3F605E8D47BD2398ED7125AE67174180338A7C746A08E652A337F46A3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Green.bat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\_Green.bat
Size 5KB
SHA256 a98420a49a86bf9f26ee4890c0894cb50295d4467ee0023595e2835508dcbd2f
MD5 0ccbc14a33f68210f442b7d0b0ffa23e
SHA1 ea0433df62a72e86713e3b2e53b6ca79068d548e
SHA512 b47be05cda5214a6f7e6da42d6b6f75d3339ba814e4ca3f63c23918ad30c0fbb9ad95132d85a7ff619fe36699f21d9d907ea6399936c6ef62bf66e1c4580d353
SSDEEP 96:+VC2k0KhXlZAZ1ZUZlXZR7y7D7A7b7wX7jMDjAJ2FMv0v5:pHLKMD8JIMcv5
TLSH
T1A9C165111E024D22E4D42C7696AB8767BFFE62433510FBDD27C53196A25738683F42FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Uninsta.bat

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\_Uninsta.bat
Size 3KB
SHA256 8e3fedce7705001b50f41de32d100eb05675148833149e72165f33d2ae7cad4f
MD5 fd399b9962aab71315f3ed296b9abd27
SHA1 86fc53487f7a7a7a37f20c0b7c08e3f54df47542
SHA512 a55377bc4c4fdf56b930d71ef39f309fda204c1fbda5ff022bb753e70e6d96a418bdd275ff8aa5d4595ffae76949693b954d961f837ad27943f8c515431733a1
TLSH
T1AE71542A2E450E1200D6498795CB4B2737E9CC57756178F633CA62BAAA1F33043F65F2
MD5 SHA1 SHA512 TLSH

Submit Download

cfg.ini

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\cfg.ini
Size 203B
SHA256 68f2019ab0128e44631ee50ab9f9cde8bd0a168272864752b12decd44dcc72e6
MD5 e5be5e5e977cbb0103fa6225ad1890bd
SHA1 d3986116d4c83608d4d93143a0647fb4d0fc1ddb
SHA512 e026959e6e983588878e6f6f03db7da575107124cd65e9f465595b9af5d34e23d47c66acd6c91b7e460c666ea0a5324e444fd4bac122e1bad080e76c7fa1fb2f
TLSH
T134D023F459E0CF6D3870FD2DFF1479A03310095903404C748245F5E58B13C4D121D531
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\libcrypto-1_1.dll
Size 1.7MB
SHA256 22620e9f4e64078bb62f991bb6a9ea9f64d3028c8836d082c4b2befc686fab1c
MD5 381c35502b4e976c0787be6f5599e435
SHA1 4409682fac269cdd6f1ba8fcb7fbabb6ad4ec6b6
SHA512 746d2940eb5b654b2679202e1cb210ad23470fb15fc61afecdc5caaca9ced1bc21dd466120e3929d821b14b21fa301fb1455d24a0d8183bc40444ccb5514f139
SSDEEP 49152:QmiJ+EdvH4wJi7i3ARoRRIa/36igy1iAUS1CPwDv3uFciP:QNdvYwJ5fgy1iAH1CPwDv3uFciP
TLSH
T17F858C46A6A804E9D97B9138C553551BD3F2B8212F60EBCF06B14BDE1F23BDA123E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ns.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\PartAssist\ns.dll
Size 91KB
SHA256 22034ac8f62dbdd4e0cd4fdd98a877c0237d59259e02b8bcd2fa5c4260783012
MD5 175c59214553f4dc7f357ca94f99de8e
SHA1 761540d3047a0ae456555f98ba98009fa27bc4ea
SHA512 b6775807adf1e9b9112a458bc8f0b6dfaee5617cca07527fa095e295d0d1cf6067fc36371ab4635a3f43fd4b10d2fb0bb67789d60e6a48a9283913aa5608515b
SSDEEP 1536:I/8BVhUTv148ssTwUl7b3KvKvCJni7J6/Wm67EYvd:o8Ph413s7Ul7mvKaJno6/Wm6Pvd
TLSH
T163937E0B6A9403ACE167803CD2936D03D7B974D987E047DF13A046291F27BE5AEF8E65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download