Overview

overview

10

Static

static

3

f44ad68fe4...1a.exe

windows7-x64

10

f44ad68fe4...1a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2024, 12:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f44ad68fe484fbff5c0abcdaf063ffbef36d4e43f9d40e61d026c7e51c9bf31a.exe

  • Size

    2.6MB

  • MD5

    b405feb91870f682d15560c84e2eee13

  • SHA1

    02b02649b78f92fba4ffe9ead97be3621d6a9458

  • SHA256

    f44ad68fe484fbff5c0abcdaf063ffbef36d4e43f9d40e61d026c7e51c9bf31a

  • SHA512

    c40ad6fc166f4f7dd7ade49836fb6c96f77574435e07b580e140c9a542ede832674ee27448fddc62011d2502440a3f4bbcf51d7fd2dedf25d925e8e1eb850522

  • SSDEEP

    49152:wgwR3ifu1DBgutBPNozkquwVOYJU66zpXpY2+2rW+Dc2v+f9D+:wgwR3vguPP+oqhZJ/4HY2LW+wvVK

Score
10/10
mimicdiscoveryevasionexecutionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Detects Mimic ransomware 1 IoCs
  • Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (4503) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 15 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 11 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\f44ad68fe484fbff5c0abcdaf063ffbef36d4e43f9d40e61d026c7e51c9bf31a.exe
    "C:\Users\Admin\AppData\Local\Temp\f44ad68fe484fbff5c0abcdaf063ffbef36d4e43f9d40e61d026c7e51c9bf31a.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3932
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p259441286182422003 Everything64.dll
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1628
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\3kn.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\3kn.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\YOURDATA.exe
        "C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\YOURDATA.exe"
        3⤵
        • UAC bypass
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4576
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c DC.exe /D
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4412
          • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\DC.exe
            DC.exe /D
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4740
        • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\YOURDATA.exe
          "C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\YOURDATA.exe" -e watch -pid 4576 -!
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2428
        • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\YOURDATA.exe
          "C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\YOURDATA.exe" -e ul1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2268
        • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\YOURDATA.exe
          "C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\YOURDATA.exe" -e ul2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2848
        • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\Everything.exe
          "C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2260
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -H off
          4⤵
          • Power Settings
          PID:1700
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:452
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:3720
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:3840
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1464
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:2436
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:5024
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:2008
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:1832
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:2744
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:3804
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:2136
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:816
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
          4⤵
          • Power Settings
          PID:2056
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
          4⤵
          • Power Settings
          PID:3184
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3980
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3100
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1676
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2504
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:732
        • C:\Windows\SYSTEM32\wbadmin.exe
          wbadmin.exe DELETE SYSTEMSTATEBACKUP
          4⤵
          • Deletes System State backups
          • Drops file in Windows directory
          PID:2832
        • C:\Windows\SYSTEM32\wbadmin.exe
          wbadmin.exe delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:4588
        • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\Everything.exe
          "C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1476
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5116
  • C:\Windows\System32\Systray.exe
    C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:4716
    • C:\Windows\System32\Systray.exe
      C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:468
      • C:\Windows\System32\Systray.exe
        C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4328
        • C:\Windows\System32\Systray.exe
          C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:3204
          • C:\Windows\System32\Systray.exe
            C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:1036
            • C:\Windows\System32\Systray.exe
              C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3740
              • C:\Windows\System32\Systray.exe
                C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:2556
                • C:\Windows\System32\Systray.exe
                  C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:2620
                  • C:\Windows\System32\Systray.exe
                    C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:2920
                    • C:\Windows\System32\Systray.exe
                      C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:2932
                      • C:\Windows\System32\Systray.exe
                        C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:1784
                        • C:\Windows\System32\Systray.exe
                          C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:3000
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                              PID:2724
                            • C:\Windows\system32\wbengine.exe
                              "C:\Windows\system32\wbengine.exe"
                              1⤵
                                PID:3032
                              • C:\Windows\System32\vdsldr.exe
                                C:\Windows\System32\vdsldr.exe -Embedding
                                1⤵
                                  PID:2164
                                • C:\Windows\System32\vds.exe
                                  C:\Windows\System32\vds.exe
                                  1⤵
                                  • Checks SCSI registry key(s)
                                  PID:2528

                                Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                3
                                T1059

                                PowerShell

                                1
                                T1059.001

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                2
                                T1546

                                Change Default File Association

                                1
                                T1546.001

                                Image File Execution Options Injection

                                1
                                T1546.012

                                Power Settings

                                1
                                T1653

                                Privilege Escalation

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Event Triggered Execution

                                2
                                T1546

                                Change Default File Association

                                1
                                T1546.001

                                Image File Execution Options Injection

                                1
                                T1546.012

                                Defense Evasion

                                Abuse Elevation Control Mechanism

                                1
                                T1548

                                Bypass User Account Control

                                1
                                T1548.002

                                Impair Defenses

                                1
                                T1562

                                Disable or Modify Tools

                                1
                                T1562.001

                                Indicator Removal

                                2
                                T1070

                                File Deletion

                                2
                                T1070.004

                                Modify Registry

                                4
                                T1112

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                1
                                T1552

                                Credentials In Files

                                1
                                T1552.001

                                Discovery

                                Browser Information Discovery

                                1
                                T1217

                                Peripheral Device Discovery

                                2
                                T1120

                                Query Registry

                                4
                                T1012

                                System Information Discovery

                                5
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Lateral Movement

                                Collection

                                Data from Local System

                                1
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Inhibit System Recovery

                                3
                                T1490

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\----Read-Me-----.txt
                                  Filesize

                                  1KB

                                  MD5

                                  7be5e8a05222df0c5d78cdd9e1b7c4ed

                                  SHA1

                                  d05d9fd5f90347cb3fdf2aeb6ecba04b3c5967a7

                                  SHA256

                                  c7f6a55571871300debfa37726c11ff5ca528fedef8865b1cfd268f70bd5407b

                                  SHA512

                                  463e5351e6682c7aa8ad162c6035bd9911077148b3147f2feffac17e9c80787c86c9f14b1aa75e44b1a3b353b77aabbcdf7b368c86399dd30a20098b860b97fb

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                  Filesize

                                  2KB

                                  MD5

                                  d85ba6ff808d9e5444a4b369f5bc2730

                                  SHA1

                                  31aa9d96590fff6981b315e0b391b575e4c0804a

                                  SHA256

                                  84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                  SHA512

                                  8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  944B

                                  MD5

                                  6d42b6da621e8df5674e26b799c8e2aa

                                  SHA1

                                  ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                                  SHA256

                                  5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                                  SHA512

                                  53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                  Filesize

                                  1KB

                                  MD5

                                  fb5eb8486decd5ee26d4a7216c2bab97

                                  SHA1

                                  7cb5457255f1b5135b3a16a93e81f97d40803615

                                  SHA256

                                  88cb58071acf3f407762095429b8ebc25868b9826c29785981585c24ce2cd6e5

                                  SHA512

                                  75e7b968ee81f10844ddd24cc446fe276979cbb6588dacee72f57dd9196abcd822745b6e4d95a7cf45650fb73b73e2ee03576b3d6cf4744a1eb6882b956dc714

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
                                  Filesize

                                  300B

                                  MD5

                                  b544278eabdac52cfc43de42babfd5a1

                                  SHA1

                                  c5188db9b94daff7624dc4b23b08737dea1434bf

                                  SHA256

                                  9cecba59bc812193c90de6bab13ee2ca86f1b3cebeaa994df087010b72e00b86

                                  SHA512

                                  ae9fa11ea4f9c9b6cf1026c1ff339bbcf3716d4b004d6f66487f874bdd288a191d0693939f47cc8977604a3e4880f9cae0567f2c33ccb44f07d3093850d6735f

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\3kn.exe
                                  Filesize

                                  2.3MB

                                  MD5

                                  21db18d71c45b82cc91f2a08f345c1f4

                                  SHA1

                                  d0114a9e5ad6a693f03b08569b00fff984a9609a

                                  SHA256

                                  63a1b530949154dfa7ad62917aca747193a4d4205b4c0a3953a6154b2c14fea1

                                  SHA512

                                  1ef865a4065c96692cfc25093f7e95a7f478667b7befdabae351303626b2b9d9a75799e1c7b18179f6d1a9bd6c46c3f224a85185b525544904bb8c2543cb3c0a

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
                                  Filesize

                                  772KB

                                  MD5

                                  b93eb0a48c91a53bda6a1a074a4b431e

                                  SHA1

                                  ac693a14c697b1a8ee80318e260e817b8ee2aa86

                                  SHA256

                                  ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

                                  SHA512

                                  732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe
                                  Filesize

                                  802KB

                                  MD5

                                  ac34ba84a5054cd701efad5dd14645c9

                                  SHA1

                                  dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

                                  SHA256

                                  c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

                                  SHA512

                                  df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  c44487ce1827ce26ac4699432d15b42a

                                  SHA1

                                  8434080fad778057a50607364fee8b481f0feef8

                                  SHA256

                                  4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

                                  SHA512

                                  a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini
                                  Filesize

                                  548B

                                  MD5

                                  742c2400f2de964d0cce4a8dabadd708

                                  SHA1

                                  c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

                                  SHA256

                                  2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

                                  SHA512

                                  63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini
                                  Filesize

                                  550B

                                  MD5

                                  51014c0c06acdd80f9ae4469e7d30a9e

                                  SHA1

                                  204e6a57c44242fad874377851b13099dfe60176

                                  SHA256

                                  89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

                                  SHA512

                                  79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
                                  Filesize

                                  84KB

                                  MD5

                                  3b03324537327811bbbaff4aafa4d75b

                                  SHA1

                                  1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

                                  SHA256

                                  8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

                                  SHA512

                                  ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
                                  Filesize

                                  1.7MB

                                  MD5

                                  32e57eddfcb3d2bbd1242a892a8744a6

                                  SHA1

                                  554b1e5ff39e64bc494fa4112433cc9358d50bc5

                                  SHA256

                                  11b9e357a8c2e08ed09f4b305a1f8328ed4537382bb62a2d9fb35540976dbe46

                                  SHA512

                                  86da9974ac1cb9d17e916996d6f90fe4a741bc8b95bcf4e2b37c610a797366f86fb5fd380dd93df6dbcb1e6b080820ee5f107a4a3eacd517e9ecc2667462e8fb

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xdel.exe
                                  Filesize

                                  350KB

                                  MD5

                                  803df907d936e08fbbd06020c411be93

                                  SHA1

                                  4aa4b498ae037a2b0479659374a5c3af5f6b8d97

                                  SHA256

                                  e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

                                  SHA512

                                  5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bk3iccwh.xvs.ps1
                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\Everything.db
                                  Filesize

                                  13.3MB

                                  MD5

                                  9c12d4720a31d3d8f2830de47c50bb14

                                  SHA1

                                  7442c4d305423b4a3965a02b18e97b90d2fcdc79

                                  SHA256

                                  acdc65821a9a8289afabbd328950fa62807d45dfcbda799875629609a53529cf

                                  SHA512

                                  3df77ea74803af6a30ecc3a15511a335ab7672bb0ba13ead16793a925b3d74742e94b74eca4210ecf00a081e71b8338c6cc757b54e35609f962d75551ae1db33

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\Everything.ini
                                  Filesize

                                  20KB

                                  MD5

                                  7ee99043293d9dd797a66d016a5672d7

                                  SHA1

                                  a7f1aba19bc0fd71f19ed1991639cccd3d2e69f4

                                  SHA256

                                  4438b2e6bcc67a3550782e38031cb7107105d1d3059dec28a12e39e48a9def98

                                  SHA512

                                  b2380076d6fd1db58707f6f0826dbf87672678dda301efab0e20ee9d879ea66d69ab94ed8ea0ce122afd90d959533f9f359256d8e73163622e0e7eaecb61b4e0

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\{1A0B011B-9A76-83A2-7F27-19CE8AE8BD83}\session.tmp
                                  Filesize

                                  32B

                                  MD5

                                  808642d39d4da3040f34b1fe41103436

                                  SHA1

                                  648024d71ab87a608001d5bee5d722a8efb81cd6

                                  SHA256

                                  6a4eb103234be750bce3853d723c2727f14639f67524f24237312b08421ace81

                                  SHA512

                                  4329060fb9e7432b62ffe265418d813b279f1c3285c1f2c52478d08836a83004de619c6ce5d0efeadc1236cddfc35e344cb281eddb101460ca2fd7b239d73dc0

                                  Download Submit

                                • C:\temp\MIMIC_LOG.txt
                                  Filesize

                                  33KB

                                  MD5

                                  3f2c27a9822ec9cc73dbb4fa10221a16

                                  SHA1

                                  0880d65459a9b56d129071f0be005496514bf27d

                                  SHA256

                                  8a16e661c86670b255ae56d78fb6f31e36546ec2413966f4624a645859b1edd5

                                  SHA512

                                  75f52528c6163765a721f3e1b7de6beaaa56dc96eec09f8ada4929b9ba64e621f7d976c4435eb4763987ad7c7e88e88a61fbc93e17bdc9f085a68ae3ba3d1cc3

                                  Download Submit

                                • C:\temp\MIMIC_LOG.txt
                                  Filesize

                                  32KB

                                  MD5

                                  940d61d04a4ee9e3f6cc6c35e1b1131a

                                  SHA1

                                  1f721d5bb5b133c440d8b58f965ec4839145f3d9

                                  SHA256

                                  ca23be430d554d26ea39ce5d0ff391ecbce1bf1c5d9aa1402aeb7f1bb16b09c3

                                  SHA512

                                  ce67ff44e5e35445a976723289ec96c1351ae1d5110a0e205655893aca53b74f04b32adfa5c278c6fb337ed4f9483d0a0d771f44e9ab87a427e1043ea9bb2110

                                  Download Submit

                                • C:\temp\MIMIC_LOG.txt
                                  Filesize

                                  32KB

                                  MD5

                                  72d8ccadf7134e2f99d51175643d7309

                                  SHA1

                                  b58287bc828b5e5942234ca6d0a625d6f57f9bfe

                                  SHA256

                                  4069177b9d7eccf2262fedfb04fb59b6c3cd74e66237994722bb1796ce870bb2

                                  SHA512

                                  630953dd4d28f4233fdec36c511a933dd4cb70db347a4945c12e52cdad528962944e72b1d57c4ef333db6d232165dcbab18dd739401984c399748f00c228ce77

                                  Download Submit

                                • memory/3100-113-0x0000023BC4A70000-0x0000023BC4A92000-memory.dmp

                                  Filesize

                                  136KB

                                  Download