Overview

overview

10

Static

static

3

1.exe

windows7-x64

10

1.exe

windows10-2004-x64

10

2.exe

windows7-x64

10

2.exe

windows10-2004-x64

10

3.exe

windows7-x64

10

3.exe

windows10-2004-x64

10

4.exe

windows7-x64

10

4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 19:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1.exe

  • Size

    2.5MB

  • MD5

    b6871cef458a765d51e3b0a1ae324e60

  • SHA1

    b62dda6efcc41ef4fdf6b3990b64ff54f08f2e56

  • SHA256

    a5182257daef1abde3a971ed1c3d9c3bee6d74fa3d4b0bcb379e5a9dd57340ea

  • SHA512

    b11376ecfba8c3b03afc03ac001619769b6e3284518b199413b0f0403a7e71a977337a11d2c5afd0f023141bf609df22b8a7dd3f91f7c198aba91387c4e76d7f

  • SSDEEP

    49152:QgwRqifu1DBgutBPNeSGIB10SvOGbRrPas8L5pBWBm7dziiM:QgwRqvguPPCbSzris8LfBWBPp

Score
10/10
mimicdiscoveryevasionexecutionpersistenceransomwaretrojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt

Ransom Note
Greetings, There was a serious security breach in your systems and this was detected during our scans. We encrypt your data that you see important in your system by processing twice. As encryption is done as SHA256 and AES256, we would like to remind you that you can not restore your data with known data recovery methods. If you want to use data recovery companies or programs on your side, please do not worry about your actual files, process and / or make copies of them. Corruption of the original files may cause irretrievable damage to your data. If you wish, you can contact us via the following communication to resolve this issue. YOUR REFERENCE CODE dSrpj5gFWMP-ll0U7Vt6Joc3PAlyDzpjngpVXxmV0UA*[email protected] [email protected] [email protected]
Emails

dSrpj5gFWMP-ll0U7Vt6Joc3PAlyDzpjngpVXxmV0UA*[email protected]

[email protected]

[email protected]

Signatures

  • Detects Mimic ransomware 2 IoCs
  • Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic
  • Mimic family
    mimic
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (5803) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 18 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 15 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 19 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 13 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\1.exe
    "C:\Users\Admin\AppData\Local\Temp\1.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2064
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p1794523514629813379 Everything64.dll
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2824
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2392
      • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe
        "C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe"
        3⤵
        • UAC bypass
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Enumerates connected drives
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1112
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c DC.exe /D
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:556
          • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\DC.exe
            DC.exe /D
            5⤵
            • Modifies security service
            • Executes dropped EXE
            • Windows security modification
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1824
        • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe
          "C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe" -e watch -pid 1112 -!
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2208
        • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe
          "C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe" -e ul1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1092
        • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe
          "C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\BLUE.exe" -e ul2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2136
        • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.exe
          "C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2148
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -H off
          4⤵
          • Power Settings
          PID:492
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1808
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:1636
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1344
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1652
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:2904
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1944
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1720
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:1704
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:900
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:2440
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:1928
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:2108
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
          4⤵
          • Power Settings
          PID:2156
        • C:\Windows\system32\powercfg.exe
          powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
          4⤵
          • Power Settings
          PID:2104
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2320
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2476
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1728
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1060
        • C:\Windows\system32\bcdedit.exe
          bcdedit.exe /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2696
        • C:\Windows\system32\wbadmin.exe
          wbadmin.exe DELETE SYSTEMSTATEBACKUP
          4⤵
          • Deletes System State backups
          • Drops file in Windows directory
          PID:2416
        • C:\Windows\system32\wbadmin.exe
          wbadmin.exe delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:2180
        • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.exe
          "C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2172
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe "C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt"
          4⤵
          • System Location Discovery: System Language Discovery
          • Opens file in notepad (likely ransom note)
          PID:1788
        • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe
          "C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe" -accepteula -p 1 -c C:\
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1340
        • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe
          "C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe" -accepteula -p 1 -c F:\
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1244
        • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe
          "C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\xdel.exe" -accepteula -p 1 -c Z:\
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1980
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2044
  • C:\Windows\system32\gpscript.exe
    gpscript.exe /RefreshSystemParam
    1⤵
      PID:3016
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
        PID:464
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
          PID:680
        • C:\Windows\System32\vdsldr.exe
          C:\Windows\System32\vdsldr.exe -Embedding
          1⤵
            PID:1836
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
              PID:2276

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            3
            T1059

            PowerShell

            1
            T1059.001

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Change Default File Association

            1
            T1546.001

            Image File Execution Options Injection

            1
            T1546.012

            Power Settings

            1
            T1653

            Privilege Escalation

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            2
            T1546

            Change Default File Association

            1
            T1546.001

            Image File Execution Options Injection

            1
            T1546.012

            Defense Evasion

            Abuse Elevation Control Mechanism

            1
            T1548

            Bypass User Account Control

            1
            T1548.002

            Impair Defenses

            2
            T1562

            Disable or Modify Tools

            2
            T1562.001

            Indicator Removal

            2
            T1070

            File Deletion

            2
            T1070.004

            Modify Registry

            6
            T1112

            Credential Access

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            2
            T1012

            System Information Discovery

            3
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Inhibit System Recovery

            3
            T1490

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\IMPORTANT_NOTICE.txt
              Filesize

              798B

              MD5

              ecce8b36183da17049294aa2167f88b4

              SHA1

              bc3afdabd1b0ee3258c14afb08c7d4d576411019

              SHA256

              72c4c54b7684e6d9382e93260c2088a5cc2adc9159f007b1bf685f86cca4b768

              SHA512

              8610d6ce1becc3c4e02e05b8b515bfdcefa6a533d7aa3377e797214330c34b62681bdd1f3165b9b8e0308e2dc6c4c6e8189ae089c3b1f533c3dfbdfc67a65825

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
              Filesize

              174B

              MD5

              2c4e5549e3cbece5a449986ff5503211

              SHA1

              2489537b3afc0218e6ac4ae9c38001bc5847ad65

              SHA256

              a496df7140670dc7eb643762486405a29e00bcb1bb470049109562da701ef70e

              SHA512

              ef55de3b65f6b41833a1c7d9d3bd0e90154029d6a9e921fb84de4df5670be40b87362e35187aa2a34f6e07fdc7bc34839c0ea5e1bea1754e4c1e069def894d6a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe
              Filesize

              802KB

              MD5

              ac34ba84a5054cd701efad5dd14645c9

              SHA1

              dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

              SHA256

              c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

              SHA512

              df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
              Filesize

              1.7MB

              MD5

              c44487ce1827ce26ac4699432d15b42a

              SHA1

              8434080fad778057a50607364fee8b481f0feef8

              SHA256

              4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

              SHA512

              a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini
              Filesize

              548B

              MD5

              742c2400f2de964d0cce4a8dabadd708

              SHA1

              c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

              SHA256

              2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

              SHA512

              63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini
              Filesize

              550B

              MD5

              51014c0c06acdd80f9ae4469e7d30a9e

              SHA1

              204e6a57c44242fad874377851b13099dfe60176

              SHA256

              89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

              SHA512

              79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
              Filesize

              84KB

              MD5

              3b03324537327811bbbaff4aafa4d75b

              SHA1

              1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

              SHA256

              8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

              SHA512

              ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
              Filesize

              1.5MB

              MD5

              01327fcd52053ba0b9e753de88195637

              SHA1

              3c197ff9a594753293a13f82a58d5f4c2b12ed50

              SHA256

              53143309b4f29789d8316c8a424b35b14340b01679d8d53ef65200945f772391

              SHA512

              9d067184978fd2399842b3ed2e3082a46be763d305fd2154eaf0151ce2b7252eafb949f67b0a27ab09f493476b4125db676681361fe5812d83eb39c14da2e5a0

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\TEQ.exe
              Filesize

              2.0MB

              MD5

              cfdb19345dec70e33fb559514d0c951b

              SHA1

              5b511c7a216105e0d52efddef53f336e36e7c8c4

              SHA256

              d7fe920929797c83862c796b9b1c5bb00445af2bef761fef2fed71a72dc91665

              SHA512

              157beaffd3e916badf389c6e0bff709f347352ffe10a9645f2a1837888901dd64ac248f5fc74e9c4c0689506dcc9050214dc73594a683965b31bb92694969426

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\encrypt.exe
              Filesize

              2.1MB

              MD5

              7ca770cc5f649256a18623245348f39f

              SHA1

              81398374ba4751a61a0d9949cc1fe75f18960741

              SHA256

              07631e96b95b1f01bdc591699ae6bc2e6787387cbe865bc11004bd34c0f9c3a4

              SHA512

              bd70b65f1ef54f1eed3e48013c0332d82370caacd67304e20497c5c8f6d6fd5ef2d838ecc9c4e80dca4e4a107676942495cce4c2526281b32fcad2ee12b33cdc

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xdel.exe
              Filesize

              350KB

              MD5

              803df907d936e08fbbd06020c411be93

              SHA1

              4aa4b498ae037a2b0479659374a5c3af5f6b8d97

              SHA256

              e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

              SHA512

              5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

              Download Submit

            • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.db
              Filesize

              9.2MB

              MD5

              f37e1bde08a041dad30e873e13d95511

              SHA1

              70d10df476bdcd1d7c2bb40c3d9e14da90e9b077

              SHA256

              998c576eb8f27dd220345ba8a147f1f7dc4413f2d288e7b5f3f63999fe6c7a1f

              SHA512

              2f0f66567c187bf935db27a48966a3cfdcc4247de9cf86f3cc4faf33902097f37c97c5e9977518b0fc709149439567d7187500f9caf523747cbc6ab01df1648b

              Download Submit

            • C:\Users\Admin\AppData\Local\{1C8FBF78-CEA9-289F-D10F-BCAD2CFEE8BF}\Everything.ini
              Filesize

              20KB

              MD5

              d7366e0c1628959b30b4d059d7714268

              SHA1

              4b96ae7c0afcb1c8728e9053bb2e128f86f6e0ef

              SHA256

              29633470e097862ed5532a2abe7099ac4da357cc00a381d84dd14f9816fdee18

              SHA512

              e4670b5ae0d4b3209185847d54b4ff70d44c99b8896ade1abc4013216c81330f982c862798f921f92ce2d3aab0169afa4341a4195cef2ef93a6e11c9c2a3730c

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
              Filesize

              7KB

              MD5

              a3a308b9500b3beb0903a473b7af0b14

              SHA1

              939c7fc747aadd9ec115bc03b546b4fede0c6dba

              SHA256

              1884180b9c728e34c42c7e6f5b8706f3df4b5d5b9f0f9b2ce8e1810fc9a654a3

              SHA512

              14a49beef5a7efb3999d8c4d8b016497932536add15592722c3f44df66cb59dc86feba9382b81882aed65d620d9826304963c41acd595e9f5a1d3fdd8aca9b61

              Download Submit

            • C:\Windows\System32\GroupPolicy\gpt.ini
              Filesize

              233B

              MD5

              cd4326a6fd01cd3ca77cfd8d0f53821b

              SHA1

              a1030414d1f8e5d5a6e89d5a309921b8920856f9

              SHA256

              1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c

              SHA512

              29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67

              Download Submit

            • C:\temp\MIMIC_LOG.txt
              Filesize

              6KB

              MD5

              0f7c60d3de2054cb056e1ce0bab65af2

              SHA1

              58e4500a6836726cbd422cc09d435bcc4219135b

              SHA256

              a52a5731cefeab29052a21e1f9823c88bef96c5ebf9f42243b457faa2145bd76

              SHA512

              4e6375c1e4a520d8702833ac2f966effb9fb3c4c8aa5eae7fbe2ed21f7aab4786f26019c3d7e41c0f6b7e2a372bea3be03f49baa80b445bf4d638e3ab30f32f5

              Download Submit

            • C:\temp\session.tmp
              Filesize

              32B

              MD5

              f27a49dfabb6c20af7cf25b8ccdfc1fb

              SHA1

              f6e93e9ef1aeb5be68adf2896d51e58559d48043

              SHA256

              9d9cf3b8c3d3b14fa20f12418a9513fe6894e6f18cf4592d3a0573c0a176eee2

              SHA512

              6ea76569666e07d081cb73c6b8574be1f572cbffe6797b5ddcc50734e955379caf65c01c3e2af57f39c435ca626ce41e7d15ec5207f549130656603a5c3a81ec

              Download Submit

            • \Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
              Filesize

              772KB

              MD5

              b93eb0a48c91a53bda6a1a074a4b431e

              SHA1

              ac693a14c697b1a8ee80318e260e817b8ee2aa86

              SHA256

              ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

              SHA512

              732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

              Download Submit

            • memory/1728-136-0x0000000002240000-0x0000000002248000-memory.dmp

              Filesize

              32KB

              Download

            • memory/1728-135-0x000000001B7B0000-0x000000001BA92000-memory.dmp

              Filesize

              2.9MB

              Download