Overview

overview

10

Static

static

3

279dbb1984...e9.exe

windows7-x64

10

279dbb1984...e9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2024, 02:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    279dbb1984d32a99caf4a0b82a1519e1bacabed43af723398c631a7d17352fe9.exe

  • Size

    2.5MB

  • MD5

    6e5c33671c42d3c85f7b629a50ae7d9b

  • SHA1

    0bb791b555684804334bcf75a5013d9625b9edb6

  • SHA256

    279dbb1984d32a99caf4a0b82a1519e1bacabed43af723398c631a7d17352fe9

  • SHA512

    015c1ccf3c3a3f0b3749fc9d7e9e26bbc63f92f5b5613293a19594fd785792f10f37a628e4c40deb601913fde67b89f84536e96331dc2863dabec7dd454928d7

  • SSDEEP

    49152:wgwRVifu1DBgutBPNkByRxgX6kzTbcPIMpD+fTVR8u:wgwRVvguPPm0RDuXfTVRl

Score
10/10
mimicdiscoveryevasionexecutionpersistenceransomwaretrojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\CONTACT.txt

Ransom Note
I encrypted your system with a vulnerability in your system. If you want your information, you must pay us. The ransomware project I use on your system is a completely private project. it cannot be broken. unsolvable. People who say they can help you often come to us and they ask us for help on your behalf . In this case, you have to pay more than what you normally pay. If you contact us directly, the fee you will pay will be lower. You may not trust us . but we are trying our best to help you. We can direct you to a company whose data we opened and helped within 48 hours. We want you to know that we have references all over the world. We do not work in a specific region or country. The company we will direct you to can be from any part of the world. We may also share various images and videos with you. We will open the encrypted data. this is our job. We get paid and we help. We cover your vulnerabilities. We ensure your safety and give advice. It is not just your data that you will buy from us. also your safety Our aim is to return the hacked systems back to you. But we want to be rewarded for our services. The most important thing we want from you. be quick . Respond quickly when communicating and quickly conclude the case. We don't want to waste time. We can prove to you that we can open encrypted data. You can send the sample file you want with .png ,jpg,avi,pdf file extensions that are not important to you. We will send the file back to you in working condition. Our file limit is 3 . we can't open more for you for free. You can send us your database files. After we have your database file working, we can send you a screenshot of the table you want. If you want to talk to us instantly, you can contact us via qtox. qtox program address: https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe My qtox address is: E12919AB09D54CB3F6903091580F0C4AADFB6396B1E6C7B8520D878275F56E7803D963E639AE Email address: [email protected] Dcrypter ID : 7gd10gdVwbxVPw1p8Npn_ZHaOJNyVK2TGmFa7n5Of0E*EncryptedDATA ONE When you contact us, share your contact number with us.
URLs

https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe

Signatures

  • Detects Mimic ransomware 1 IoCs
  • Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic
  • Mimic family
    mimic
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (193) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 15 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 11 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\279dbb1984d32a99caf4a0b82a1519e1bacabed43af723398c631a7d17352fe9.exe
    "C:\Users\Admin\AppData\Local\Temp\279dbb1984d32a99caf4a0b82a1519e1bacabed43af723398c631a7d17352fe9.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4244
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p3198034431885414182 Everything64.dll
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4760
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2024x100.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2024x100.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3540
      • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\soyezpruden.exe
        "C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\soyezpruden.exe"
        3⤵
        • UAC bypass
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Checks whether UAC is enabled
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2432
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c DC.exe /D
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2968
          • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\DC.exe
            DC.exe /D
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1684
        • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\soyezpruden.exe
          "C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\soyezpruden.exe" -e watch -pid 2432 -!
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1308
        • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\soyezpruden.exe
          "C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\soyezpruden.exe" -e ul1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1116
        • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\soyezpruden.exe
          "C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\soyezpruden.exe" -e ul2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2244
        • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\Everything.exe
          "C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2344
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -H off
          4⤵
          • Power Settings
          PID:992
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1936
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:2616
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1368
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1456
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:1560
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1016
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:4256
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:2136
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:2072
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1836
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:1812
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1264
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
          4⤵
          • Power Settings
          PID:1932
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
          4⤵
          • Power Settings
          PID:228
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3488
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3988
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3464
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1728
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:3384
        • C:\Windows\SYSTEM32\wbadmin.exe
          wbadmin.exe DELETE SYSTEMSTATEBACKUP
          4⤵
          • Deletes System State backups
          PID:4776
        • C:\Windows\SYSTEM32\wbadmin.exe
          wbadmin.exe delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:4204
        • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\Everything.exe
          "C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4804
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4268
  • C:\Windows\System32\Systray.exe
    C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:2304
    • C:\Windows\System32\Systray.exe
      C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:2396
      • C:\Windows\System32\Systray.exe
        C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3740
        • C:\Windows\System32\Systray.exe
          C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:1624
          • C:\Windows\System32\Systray.exe
            C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4296
            • C:\Windows\System32\Systray.exe
              C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:3020
              • C:\Windows\System32\Systray.exe
                C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:2892
                • C:\Windows\System32\Systray.exe
                  C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3672
                  • C:\Windows\System32\Systray.exe
                    C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:3496
                    • C:\Windows\System32\Systray.exe
                      C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:2588
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                          PID:228
                        • C:\Windows\system32\wbengine.exe
                          "C:\Windows\system32\wbengine.exe"
                          1⤵
                            PID:2892
                          • C:\Windows\System32\vdsldr.exe
                            C:\Windows\System32\vdsldr.exe -Embedding
                            1⤵
                              PID:1060
                            • C:\Windows\System32\vds.exe
                              C:\Windows\System32\vds.exe
                              1⤵
                              • Checks SCSI registry key(s)
                              PID:3452

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            3
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            2
                            T1546

                            Change Default File Association

                            1
                            T1546.001

                            Image File Execution Options Injection

                            1
                            T1546.012

                            Power Settings

                            1
                            T1653

                            Privilege Escalation

                            Abuse Elevation Control Mechanism

                            1
                            T1548

                            Bypass User Account Control

                            1
                            T1548.002

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            2
                            T1546

                            Change Default File Association

                            1
                            T1546.001

                            Image File Execution Options Injection

                            1
                            T1546.012

                            Defense Evasion

                            Abuse Elevation Control Mechanism

                            1
                            T1548

                            Bypass User Account Control

                            1
                            T1548.002

                            Impair Defenses

                            1
                            T1562

                            Disable or Modify Tools

                            1
                            T1562.001

                            Indicator Removal

                            2
                            T1070

                            File Deletion

                            2
                            T1070.004

                            Modify Registry

                            4
                            T1112

                            Credential Access

                            Discovery

                            Peripheral Device Discovery

                            2
                            T1120

                            Query Registry

                            4
                            T1012

                            System Information Discovery

                            5
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Lateral Movement

                            Collection

                            Command and Control

                            Exfiltration

                            Impact

                            Inhibit System Recovery

                            3
                            T1490

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\CONTACT.txt
                              Filesize

                              2KB

                              MD5

                              fe8cdfe2ac25e82a8a4510129bd50081

                              SHA1

                              5e6996bbbd72c0d165006f8fa9b2f6d55c23e566

                              SHA256

                              582516d824f151ae505747c2d2787695226a562c1f85a9b189657b79c268b514

                              SHA512

                              4c494ca3b3497a6c588c253cb26c4b08ac396089da94dfefb06f55ec89caf038d8dfde64f14dba1c56d3f1e90807ad12e3a9c16007fe5181bc46c2cba10d6ee8

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              d85ba6ff808d9e5444a4b369f5bc2730

                              SHA1

                              31aa9d96590fff6981b315e0b391b575e4c0804a

                              SHA256

                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                              SHA512

                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              6d42b6da621e8df5674e26b799c8e2aa

                              SHA1

                              ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

                              SHA256

                              5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

                              SHA512

                              53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              64B

                              MD5

                              1fd34e0a1222026355b887f390af8f3c

                              SHA1

                              2fbf787353476e66a539f0a01fc0b19aec16463e

                              SHA256

                              3a99aabfc8f11260f3d7fd04555c013353353f7edeb1ed09498e7d460098531f

                              SHA512

                              264f15bae0a555779e4a96b87365e7c6cab95b60657746f5e3aba3f2e827d7066ff03a4340b06f1e27d86191f83ff00e89d066370a86833ec63c7dc9aa1bb3f1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
                              Filesize

                              300B

                              MD5

                              8b94712ac2de46946128d950642939f6

                              SHA1

                              cee8561e7ca51da7d0542de9a4881ec7a586121f

                              SHA256

                              bc0a6f1d29f6a261001f529443dc7d7a6d185fc47051747b4756e13eee2e06c0

                              SHA512

                              d1bd9079e545c5e4a673cfd3cca0a408ff0cc3612ff05d0784687c914d7fd35b9881f5faa9725833feeed26bc88aa6a7f5210a352b2ffd941de3bf167274c150

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2024x100.exe
                              Filesize

                              2.0MB

                              MD5

                              998f5066a7f8786a3060f4d8fc12bcb7

                              SHA1

                              9e647e1f7b8f5750711fec983e8054ad9e648e49

                              SHA256

                              a657c69bf3969600caabda76ccdb943900c0a8645bb5bac4de4f62d27b83d758

                              SHA512

                              7d2e2c998247b3683a0ed674a6f09118aded4d43a1219b9c45571a752f0406a62a1b63799ee1660b6ef037a4957a77e711486a46eb2b68285d509b716595b1be

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
                              Filesize

                              772KB

                              MD5

                              b93eb0a48c91a53bda6a1a074a4b431e

                              SHA1

                              ac693a14c697b1a8ee80318e260e817b8ee2aa86

                              SHA256

                              ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

                              SHA512

                              732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe
                              Filesize

                              802KB

                              MD5

                              ac34ba84a5054cd701efad5dd14645c9

                              SHA1

                              dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

                              SHA256

                              c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

                              SHA512

                              df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
                              Filesize

                              1.7MB

                              MD5

                              c44487ce1827ce26ac4699432d15b42a

                              SHA1

                              8434080fad778057a50607364fee8b481f0feef8

                              SHA256

                              4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

                              SHA512

                              a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini
                              Filesize

                              548B

                              MD5

                              742c2400f2de964d0cce4a8dabadd708

                              SHA1

                              c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

                              SHA256

                              2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

                              SHA512

                              63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini
                              Filesize

                              550B

                              MD5

                              51014c0c06acdd80f9ae4469e7d30a9e

                              SHA1

                              204e6a57c44242fad874377851b13099dfe60176

                              SHA256

                              89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

                              SHA512

                              79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
                              Filesize

                              84KB

                              MD5

                              3b03324537327811bbbaff4aafa4d75b

                              SHA1

                              1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

                              SHA256

                              8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

                              SHA512

                              ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
                              Filesize

                              1.5MB

                              MD5

                              e563623045abcd13bfbb038d44427e6f

                              SHA1

                              62d7a3647f86fe10ce5e505bd18f2c73cda59881

                              SHA256

                              dd01fd9d72360dba150c48e30a598673b9b60edbad01ad65d1aba66fe42fd41d

                              SHA512

                              9aea7f0666a76cb3163a9d97140b7aea529a7cc518c62e19f6e4f53ce7138c9cf2676bf778932687855236b7e7a9e6551691a9b73e57fe61fd73e7376f6c99dd

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel.exe
                              Filesize

                              350KB

                              MD5

                              803df907d936e08fbbd06020c411be93

                              SHA1

                              4aa4b498ae037a2b0479659374a5c3af5f6b8d97

                              SHA256

                              e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

                              SHA512

                              5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel64.exe
                              Filesize

                              448KB

                              MD5

                              e2114b1627889b250c7fd0425ba1bd54

                              SHA1

                              97412dba3cbeb0125c71b7b2ab194ea2fdff51b2

                              SHA256

                              5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60

                              SHA512

                              76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_exfoyptp.f5u.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\Everything.db
                              Filesize

                              13.2MB

                              MD5

                              3ea59c8c474258572db42439367e6ee0

                              SHA1

                              de89d5c386b8aee0f3f20df5355a886cd1f9db73

                              SHA256

                              29f09ffe3b9e682ab843acff6d3faaefbbe0294da95e332cecba53199ef22a2e

                              SHA512

                              094ca1bb4d1a36a52f067d9f4e6fed1a04c8553b388e11d77342507c0c2b3155dfefee958f550e008a036b80f0fc508ec4c6f9c714d6072d54d9e3a813b2b53d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\Everything.ini
                              Filesize

                              20KB

                              MD5

                              77d5dae1892f8f7b527794c8e3bbd6b7

                              SHA1

                              c4843392c107d8c1c1340a94365b6b71943698b0

                              SHA256

                              2de2990650adddb34f8a26920b78ecc7d12336cedc785e3e2f26df04d479c512

                              SHA512

                              b78951aaf9c9ab92c48202797a2379d110c485fc6a4fa82bfba1a521e91b21895590215afb48ebd263036d6708de84230ad55a09cc4a41bfeb71e32bf8993ba1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\{CAF0D3AB-74BF-C734-32F8-FF5729CAE91D}\session.tmp
                              Filesize

                              32B

                              MD5

                              6a7132ee3f45f24f0a954a3735e76390

                              SHA1

                              ce21a90899c4f284d12421cad636390c7ca8264b

                              SHA256

                              a32f4d2956aadbc0fee73f2ae75df11863a0fd11d1228fc2cb015f428eaf69a1

                              SHA512

                              2b6b31cb693b26f1ce276c6682fac087ea2466c21a21603d4143538f9fb2bc4d393a648e46873cc7d728462fd970d4a2a8bcc836a01dd6aee4e80d47c0b7be32

                              Download Submit

                            • memory/3988-123-0x000001F5E5C10000-0x000001F5E5C32000-memory.dmp

                              Filesize

                              136KB

                              Download