mimic | ccac2b64933948bf66c31c3cd54e6af63f78d91e07d4e9cd6154172fd40dfe09

Resubmissions

05/11/2026, 14:26

261105-rr57qaxt2m10

05/11/2026, 14:19

261105-rnbtps1sf110

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
48s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/11/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry.exe
Size 2.1MB
Sample261105-rr57qaxt2m
SHA256 ccac2b64933948bf66c31c3cd54e6af63f78d91e07d4e9cd6154172fd40dfe09
MD5 bed47846d968146a771ba993ced17bf1
SHA1 b766e08ea668c016950a180464d43183faa962d6
SHA512 55cd69d9d5d7058702bd5f563bbfe406ff2d67ae6d12fa7d7ec4b98143abca1b53ecbc427343313baa2d79d36c4df8d2145a58eef5aba1d14135a9fe097eedc0
SSDEEP 49152:wgwRz+OUvWmmDXnj9ULD0QUU5J0jGEAjw4PR+7H:wgwRzGvWx2LD0KJ0jGPw4J+L
TLSH
T1B0A53391BFDB8032F093137548892A6619BD93750B27D0C767C01A26CFAABE4DB3D167
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution mimic persistence ransomware

Malware Config

Signatures

Family: Mimic
Ransomware family was first exploited in the wild in 2022.
ransomware mimic

Detects Mimic ransomware 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000247a0-35.dat	family_mimic

Renames multiple (896) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlwriter.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\axlbridge.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CoreSync.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlservr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	chudo.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry.exe

Executes dropped EXE 8 IoCs

pid	Process
4480	7za.exe
3236	7za.exe
2740	NIKTONEPOMOZHETKROMENAS.exe
5216	chudo.exe
3676	chudo.exe
4204	Everything.exe
756	chudo.exe
3056	chudo.exe

Loads dropped DLL 5 IoCs

pid	Process
2740	NIKTONEPOMOZHETKROMENAS.exe
5216	chudo.exe
3676	chudo.exe
756	chudo.exe
3056	chudo.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	NIKTONEPOMOZHETKROMENAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	chudo.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open\command	chudo.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open\command	NIKTONEPOMOZHETKROMENAS.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell	NIKTONEPOMOZHETKROMENAS.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	chudo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	chudo.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	NIKTONEPOMOZHETKROMENAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	NIKTONEPOMOZHETKROMENAS.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open	NIKTONEPOMOZHETKROMENAS.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chudo = "\"C:\\Users\\Admin\\AppData\\Local\\52DAA538-D1F0-D9B8-7C37-2FEACA148206\\chudo.exe\" "	NIKTONEPOMOZHETKROMENAS.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe

Power Settings 1 TTPs 15 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
728	powercfg.exe
5832	powercfg.exe
3996	powercfg.exe
2932	powercfg.exe
3672	powercfg.exe
5336	powercfg.exe
5464	powercfg.exe
3656	powercfg.exe
3044	powercfg.exe
1056	powercfg.exe
452	powercfg.exe
5180	powercfg.exe
1340	powercfg.exe
116	powercfg.exe
3060	powercfg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\GrantCopy.mpeg.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\jvmti.h.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\css\main.css.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\main.css.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\plugin.js.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\[email protected]_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\jconsole.jar.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nb\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bg\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\UseNew.potx.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\plugins.dat.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiItalic.ttf.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-high-contrast.css.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\StepSet.xltm.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\CompressDebug.pub.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\cmm\PYCC.pf.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-Bold.otf.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\localedata.jar.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-fr_fr.gif.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightItalic.ttf.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-en_us_2x.gif.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-rdr-es_es.gif.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-variant2.gif.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\plugin.js.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\resources.jar.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightItalic.ttf	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\wa\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\MCIMPP.mpp.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\javaws.jar.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\zipfs.jar.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\InstallPush.svgz.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\ct.sym.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pa\LC_MESSAGES\vlc.mo.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\DataMatrix.pmp.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4080	powershell.exe
3808	powershell.exe
5984	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4624	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chudo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chudo.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chudo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Everything.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chudo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chudo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NIKTONEPOMOZHETKROMENAS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chudo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	NIKTONEPOMOZHETKROMENAS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\KAK_OPLATIT_CHITAI.txt\""	chudo.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open\command	NIKTONEPOMOZHETKROMENAS.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile	NIKTONEPOMOZHETKROMENAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	chudo.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open	NIKTONEPOMOZHETKROMENAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	NIKTONEPOMOZHETKROMENAS.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open\command	chudo.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs	chudo.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell	NIKTONEPOMOZHETKROMENAS.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	chudo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*"	chudo.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	chudo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs\ = "mimicfile"	chudo.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	NIKTONEPOMOZHETKROMENAS.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4932	notepad.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
5216	chudo.exe
756	chudo.exe
756	chudo.exe
3056	chudo.exe
3056	chudo.exe
3808	powershell.exe
3808	powershell.exe
5984	powershell.exe
5984	powershell.exe
4080	powershell.exe
5984	powershell.exe
3808	powershell.exe
4080	powershell.exe
4080	powershell.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe
756	chudo.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4480	7za.exe
Token: 35	4480	7za.exe
Token: SeRestorePrivilege	3236	7za.exe
Token: 35	3236	7za.exe
Token: SeSecurityPrivilege	3236	7za.exe
Token: SeSecurityPrivilege	3236	7za.exe
Token: SeIncreaseQuotaPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeSecurityPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeTakeOwnershipPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeLoadDriverPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeSystemProfilePrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeSystemtimePrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeProfSingleProcessPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeIncBasePriorityPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeCreatePagefilePrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeBackupPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeRestorePrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeShutdownPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeDebugPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeSystemEnvironmentPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeChangeNotifyPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeRemoteShutdownPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeUndockPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeManageVolumePrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeImpersonatePrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeCreateGlobalPrivilege	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: 33	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: 34	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: 35	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: 36	2740	NIKTONEPOMOZHETKROMENAS.exe
Token: SeIncreaseQuotaPrivilege	5216	chudo.exe
Token: SeSecurityPrivilege	5216	chudo.exe
Token: SeTakeOwnershipPrivilege	5216	chudo.exe
Token: SeLoadDriverPrivilege	5216	chudo.exe
Token: SeSystemProfilePrivilege	5216	chudo.exe
Token: SeSystemtimePrivilege	5216	chudo.exe
Token: SeProfSingleProcessPrivilege	5216	chudo.exe
Token: SeIncBasePriorityPrivilege	5216	chudo.exe
Token: SeCreatePagefilePrivilege	5216	chudo.exe
Token: SeBackupPrivilege	5216	chudo.exe
Token: SeRestorePrivilege	5216	chudo.exe
Token: SeShutdownPrivilege	5216	chudo.exe
Token: SeDebugPrivilege	5216	chudo.exe
Token: SeSystemEnvironmentPrivilege	5216	chudo.exe
Token: SeChangeNotifyPrivilege	5216	chudo.exe
Token: SeRemoteShutdownPrivilege	5216	chudo.exe
Token: SeUndockPrivilege	5216	chudo.exe
Token: SeManageVolumePrivilege	5216	chudo.exe
Token: SeImpersonatePrivilege	5216	chudo.exe
Token: SeCreateGlobalPrivilege	5216	chudo.exe
Token: 33	5216	chudo.exe
Token: 34	5216	chudo.exe
Token: 35	5216	chudo.exe
Token: 36	5216	chudo.exe
Token: SeIncreaseQuotaPrivilege	3056	chudo.exe
Token: SeSecurityPrivilege	3056	chudo.exe
Token: SeTakeOwnershipPrivilege	3056	chudo.exe
Token: SeLoadDriverPrivilege	3056	chudo.exe
Token: SeSystemProfilePrivilege	3056	chudo.exe
Token: SeSystemtimePrivilege	3056	chudo.exe
Token: SeProfSingleProcessPrivilege	3056	chudo.exe
Token: SeIncBasePriorityPrivilege	3056	chudo.exe
Token: SeCreatePagefilePrivilege	3056	chudo.exe
Token: SeBackupPrivilege	3056	chudo.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4204	Everything.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 4480	3884	2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry.exe	87
PID 3884 wrote to memory of 3236	3884	2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry.exe	89
PID 3884 wrote to memory of 2740	3884	2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry.exe	91
PID 2740 wrote to memory of 5216	2740	NIKTONEPOMOZHETKROMENAS.exe	92
PID 5216 wrote to memory of 3676	5216	chudo.exe	95
PID 5216 wrote to memory of 756	5216	chudo.exe	96
PID 5216 wrote to memory of 3056	5216	chudo.exe	98
PID 5216 wrote to memory of 4204	5216	chudo.exe	97
PID 5216 wrote to memory of 116	5216	chudo.exe	100
PID 5216 wrote to memory of 1340	5216	chudo.exe	101
PID 5216 wrote to memory of 5336	5216	chudo.exe	102
PID 5216 wrote to memory of 5464	5216	chudo.exe	103
PID 5216 wrote to memory of 2932	5216	chudo.exe	104
PID 5216 wrote to memory of 3060	5216	chudo.exe	105
PID 5216 wrote to memory of 3656	5216	chudo.exe	106
PID 5216 wrote to memory of 5832	5216	chudo.exe	107
PID 5216 wrote to memory of 3044	5216	chudo.exe	108
PID 5216 wrote to memory of 3672	5216	chudo.exe	109
PID 5216 wrote to memory of 1056	5216	chudo.exe	110
PID 5216 wrote to memory of 452	5216	chudo.exe	111
PID 5216 wrote to memory of 5180	5216	chudo.exe	112
PID 5216 wrote to memory of 728	5216	chudo.exe	113
PID 5216 wrote to memory of 3996	5216	chudo.exe	114
PID 5216 wrote to memory of 4080	5216	chudo.exe	115
PID 5216 wrote to memory of 3808	5216	chudo.exe	116
PID 5216 wrote to memory of 5984	5216	chudo.exe	117
PID 3884 wrote to memory of 4624	3884	2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry.exe	145

System policy modification 1 TTPs 6 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	chudo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	chudo.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	chudo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	chudo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	chudo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	chudo.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_bed47846d968146a771ba993ced17bf1_elex_mimic_pay2key_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4480
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p32634253722958628754 Everything64.dll
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NIKTONEPOMOZHETKROMENAS.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NIKTONEPOMOZHETKROMENAS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\chudo.exe
    "C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\chudo.exe"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Drops file in Program Files directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:5216
  - - C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\chudo.exe
      "C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\chudo.exe" -e watch -pid 5216 -!
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3676
  - - C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\chudo.exe
      "C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\chudo.exe" -e ul1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:756
  - - C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\Everything.exe
      "C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4204
  - - C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\chudo.exe
      "C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\chudo.exe" -e ul2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3056
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -H off
      4⤵
      Power Settings
      PID:116
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      Power Settings
      PID:1340
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      Power Settings
      PID:5336
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      Power Settings
      PID:5464
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      Power Settings
      PID:2932
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      Power Settings
      PID:3060
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      Power Settings
      PID:3656
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      Power Settings
      PID:5832
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      Power Settings
      PID:3044
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      Power Settings
      PID:3672
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      Power Settings
      PID:1056
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      Power Settings
      PID:452
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      Power Settings
      PID:5180
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      Power Settings
      PID:728
  - - C:\Windows\SYSTEM32\powercfg.exe
      powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      Power Settings
      PID:3996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4624

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5956

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5172

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4160

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5188

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1304

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:3700

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4436

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:396

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4048

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5952

C:\Windows\system32\notepad.exe
"notepad.exe" "C:\Users\Admin\AppData\Local\KAK_OPLATIT_CHITAI.txt"
1⤵
- Opens file in notepad (likely ransom note)
PID:4932

C:\Windows\System32\Systray.exe
C:\Windows\System32\Systray.exe "C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:4220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Everything.ini

Path C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\Everything.ini
Size 548B
SHA256 2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
MD5 742c2400f2de964d0cce4a8dabadd708
SHA1 c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
SHA512 63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
TLSH
T181F03020DB7D985C75B2DE74E4A2791002E623BCAE302494038D0EC77CCEACBA52B0DD
MD5 SHA1 SHA512 TLSH

Submit Download

Everything2.ini

Path C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\Everything2.ini
Size 550B
SHA256 89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
MD5 51014c0c06acdd80f9ae4469e7d30a9e
SHA1 204e6a57c44242fad874377851b13099dfe60176
SHA512 79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
TLSH
T11DF03620D77D945C35B2DE74E492751002D653BCAE302494038D0EC77DCDACB952B0DD
MD5 SHA1 SHA512 TLSH

Submit Download

xdel.exe

Path C:\Users\Admin\AppData\Local\52DAA538-D1F0-D9B8-7C37-2FEACA148206\xdel.exe
Size 350KB
SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
MD5 803df907d936e08fbbd06020c411be93
SHA1 4aa4b498ae037a2b0479659374a5c3af5f6b8d97
SHA512 5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
SSDEEP 6144:OBgL/kqXQangs2iKn5yvfj7wZxPzzLHrNJT7V:QgL5ga0iKn5GfPwZRT5
TLSH
T1EF745B10BAC08071D2B33D304BB9E6725DBE78311E359A8F53A819795F74690EA35B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KAK_OPLATIT_CHITAI.txt

Path C:\Users\Admin\AppData\Local\KAK_OPLATIT_CHITAI.txt
Size 1KB
SHA256 6613c884e894cef59a38580d5638299e547ec914085235a4d62a0898505f7090
MD5 ef5be62a579f0c2bdf463be92da0a20a
SHA1 60283372e84a22a797cb78965e234986653e7b34
SHA512 4ee425e9da43452c92aaeb670b5d27a81544b26df42481cd4553111786d586dee2b43425bc57195b9f7e4fc47a01ff6d036c4dbe4c7cee30823924cf3a7056d1
TLSH
T18931582006DE64AE6504F817CC48B94E79E341FFBFAE53A508E06C7F31E2174826E51A
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
TLSH
T10D91EF313275E1D5C8663F031A2D19D093AF4396EA54AF48B25C625EED2604BDB122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e6a96ea9f4b7531633a73e2a14303661f4b176d2abbdb31dbac5960819e4bfd3
MD5 486b3e8abd9f89d0c2918266c2b7e2d7
SHA1 c76480b717968077bd5ec27b5bd9de6496d5d2ed
SHA512 d0e50e9681f2f8481ffbff530d77a1d0f94a626d6e825be49c7a6bfd3c4788534d0f52f4fe7cde046b840ab534f4a2b8969802e631ddfc62f60e6eda22657702
TLSH
T182218627F3DC8A21CC86123A109D9C10767683C7809ECF9F6BC4D614A0BF988CB31290
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ec28a0f1f563cc0a56bbdebac390dd8058812d38121b6632ad6dc5a27036bca2
MD5 fa727cc8f2a0dc005c5bff3ddbfa1790
SHA1 54a7c95792faa6c2c69ca95ca54a7d733c1acb60
SHA512 232520b1cf8fcd5e995195d7253cac6b524d3f7f4dbd50940467f193c752480ca039493633b62c14c7f9437eb873aadaf637337d10e8838b29d8344edb88c70a
TLSH
T14E216527B3DDC921DC9A123A509D9C1076B682C7809ECF9F6BC4D62590BF6C9CB21194
MD5 SHA1 SHA512 TLSH

Submit Download

7ZSfx000.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
Size 314B
SHA256 08c4cc328bf9fd3dcc0cfeddb68363a24b4f21b96c0dfbecaf845d1099a6148c
MD5 2f4c7b76c92c69ed6ecc661c4029bd83
SHA1 c55a39e42ca9a73cff27e72dfcf632366d89766e
SHA512 82aaba2bf7e666d093b5ea66d4ca0e03cc9e1ef963cc2b17eda340ba9082b94a04ccf5b326a93be9f27c5695e1cd431e728eb289963e5046cbc36ee5a097617d
TLSH
T107E08611C1EA8A5672A9A41705F52DDFC06069A42F5E27587320CC8D6054C6DB8D3643
MD5 SHA1 SHA512 TLSH

Submit Download

7za.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
Size 772KB
SHA256 ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
MD5 b93eb0a48c91a53bda6a1a074a4b431e
SHA1 ac693a14c697b1a8ee80318e260e817b8ee2aa86
SHA512 732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
SSDEEP 24576:DFhjj7f4K+ao308d0ORMz27R0iIdclDJiD:JlwpP90OFWxD
TLSH
T1D3F48D227AE5D0BBC2521131CA1C7BF691F5E3190B2448C363908F6EAB359D5DA3BE1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
Size 1.7MB
SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
MD5 c44487ce1827ce26ac4699432d15b42a
SHA1 8434080fad778057a50607364fee8b481f0feef8
SHA512 a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
SSDEEP 49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH
TLSH
T13D857C42A7D344B1FD8A6637212F6713573AAB0D4313E5DF96902C70AC712F32A7E296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything32.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
Size 84KB
SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
MD5 3b03324537327811bbbaff4aafa4d75b
SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
TLSH
T179834B15295348B3F24A1831E6C642C27FBF6D433BD2A4FFFB5705854A903C5BA792A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Everything64.dll

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
Size 1.1MB
SHA256 dff553567f531cd89f98d884157ccb6f08f267f7a28a0d826e85a39e27be4a90
MD5 490b1c682425ad167b609fe9369d7486
SHA1 90003465ab3a394ea5ca864c916dc0802fb3c5ea
SHA512 53e61065ae03d04bf9dde69672d28673af1cb2ba5f90819288719c48b83d2f4c24d42a6a120f6f0d8788501a16838d460d10ee46518bc51140cd9497b43b4186
SSDEEP 24576:7cowk82uOWO2oIbXhblz+g1xaqm/pH0RSR+wUe:ooX82iog1N+gXExlR+wb
TLSH
T1023533C1DC5B8803F47692471C8C55B52D2507A8DD62E0C62381A9B9EBAFBB4FB4C937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NIKTONEPOMOZHETKROMENAS.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\NIKTONEPOMOZHETKROMENAS.exe
Size 2.2MB
SHA256 3c91e091737b9752f2e5344bbd763194bdeaa2ec9f4cbd3d8d2459763a4043f8
MD5 3ba5789a5c2344eea76ca5e358326c27
SHA1 b20c13f26fb3928f9900c13972a24df4e3c16fb0
SHA512 406074c3545c86000fda2cb6de7fa53ff422e81fc59405a3afc5196313cf3217b93b64ebc025baaaec9520feda33d6704897de2f52ecfc376fb7acd90c3659a3
SSDEEP 49152:4lhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCrvf1Gsx9k484:4lhRuiVhG/o80ny2CnZGaHCAs
TLSH
T189B5D002FBC28172E193467491B6A77F893ABA249734C5C797D01D7989313C36A3F3A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cgtb3xyf.saa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cgtb3xyf.saa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

AddConvertFrom.xht.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs

Path C:\Users\Admin\Downloads\AddConvertFrom.xht.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs
Size 478KB
SHA256 e27510b34f51c20128f3e18e2dd2ce91f794540407c289f9ea843e23633c30e4
MD5 c42581222430665df9e890fd91ca6da6
SHA1 5d4df623fde061f74d8e3987867c4d41b9504447
SHA512 6b1f795adcab33aee3aa4dddbe451951659a0dd7c883c3da2434a683b7b41d1a5b36d9895dc0c94edda55d0791c98408bda04f5a7b3a38eb6b3188934554b185
SSDEEP 12288:c9s4nVmJMiS4CtJk5Bpm1DOTabm1AG2P8Dvw+:SXnMJMD4CtO/s1xS2Pe
TLSH
T1A2A4233CA5F01BF45563CC0A36A6693786D07DD7B9DEEB83E12C508F5208F1A0296DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConfirmHide.potx.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs

Path C:\Users\Admin\Downloads\ConfirmHide.potx.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs
Size 424KB
SHA256 5c711817cf286df658a3d4b4767846f6e8cb53e7212c6bd056935006bc85dea3
MD5 220adc0e14a223ca2de4207235a319e8
SHA1 939328567f9c397e107aa9376099558963ad122b
SHA512 caf69f997f7462fff0e32e71e2c2afa3b2e9cf3d6b3894f5a5e6bff98e0e90262fa2b31df7b351f42255bd3d625d51dfe1ed503cc8d449a1581cfdd7664ddf6a
SSDEEP 12288:ABMInai9xrq+75xI362BOJpKuXaUdg1HNecX:ABMIaCZq+aNupK+dcHNt
TLSH
T1EC94233487C88136F9775D9D8AC23B18451B2790AB276C2708F98F6953781EA0DF5BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertImport.ods.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs

Path C:\Users\Admin\Downloads\ConvertImport.ods.NIKTONEPOMOZHETKROMENAS-B_Hv_mRovel1_UG4Q6ulE_5ncOnRqCgCuoRDsns0iRs
Size 666KB
SHA256 5d934be46c972d8656d13f7bed63a4eb59c89542ee4fb036c1d7d8f2b12c013d
MD5 44016dad2a3568637b604ecad67d2106
SHA1 d41c4cd62749edb76a4dd8aa279a195f5fe8d771
SHA512 e99e6e857a7b1a58ad3cec8c29e7edba793f66ccaa85f3d28d021afeb3808e0419bfc439594eae9fa7ec41ab2e3f039ad35895d53c0bc8fed95c189a28bd6909
SSDEEP 12288:CXvMO9/UiDQV5gHSB3MxkQB+dfssoWaP1jr3Yzba6DvfxdwyH7h/tNSPKMIcNa:CXvDdLDQ0HSBUDB+Cso51P3YzbXvfxHl
TLSH
T10BE433527A551C6815EB232DD2E4166F305A8EAD304C2E8FF71C3AB68BCBAD9E100D75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

session.tmp

Path C:\temp\session.tmp
Size 32B
SHA256 9a2b4926e0d415615f05fd112a49449e39d64aba896fdfa49c2428b408756f28
MD5 c2519bb6742f04457939accb495b4729
SHA1 bce3c191903d96b69bedf4c897a42268d03123c0
SHA512 8b9d2c03099580d04dfd8dfbdef4130ef91d5d7358229370b3c3d3c020b8a19dfd3627257a8e3ab7f7f969ede56a52242a5070386448cefa5865712c88dc86a7
MD5 SHA1 SHA512

Submit Download

memory/3808-136-0x0000018B4A4B0000-0x0000018B4A4CA000-memory.dmp

Download

memory/3808-139-0x0000018B4A4A0000-0x0000018B4A4AA000-memory.dmp

Download

memory/3808-138-0x0000018B4A490000-0x0000018B4A496000-memory.dmp

Download

memory/3808-134-0x0000018B4A470000-0x0000018B4A48C000-memory.dmp

Download

memory/3808-133-0x0000018B4A440000-0x0000018B4A44A000-memory.dmp

Download

memory/4080-137-0x00000262202B0000-0x00000262202B8000-memory.dmp

Download

memory/5984-135-0x0000014CDE920000-0x0000014CDE92A000-memory.dmp

Download

memory/5984-117-0x0000014CDE6F0000-0x0000014CDE70C000-memory.dmp

Download

memory/5984-118-0x0000014CDE710000-0x0000014CDE7C5000-memory.dmp

Download

memory/5984-102-0x0000014CDE440000-0x0000014CDE462000-memory.dmp

Download