Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

81423f5454...72.exe

windows7-x64

10

81423f5454...72.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    290s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2025, 22:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72.exe

  • Size

    2.6MB

  • MD5

    4dedefe4431f91c920d9aaaceb99e2ee

  • SHA1

    9a20559fa8a3e670c734837de16fa508d5e25b41

  • SHA256

    81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72

  • SHA512

    cb7d2fe42cd44f7b1c31102961c579d7ba5a6e8f5071dfdb372dade85f56572dd870f54ca32b160faa58536f0f40e4ceb39745ae076fb8d546dd358ebe96f086

  • SSDEEP

    49152:wgwReifu1DBgutBPN4gJEkSBz4aPUAigHrBYlHYw/s5CH5Ie71yAmiESeJKeqy:wgwRevguPPjg946UAFLBEYw/s5CX7tmj

Score
10/10
mimicdiscoveryevasionexecutionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Detects Mimic ransomware 1 IoCs
  • Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic
  • Mimic family
    mimic
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (4518) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 15 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 13 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72.exe
    "C:\Users\Admin\AppData\Local\Temp\81423f5454208e958aa183c2850809620676485c63aab07d91a6f85c1d9b4e72.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4572
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p731121544783912138 Everything64.dll
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4508
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2ks.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2ks.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\YOURDATA.exe
        "C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\YOURDATA.exe"
        3⤵
        • UAC bypass
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:3036
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c DC.exe /D
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2432
          • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\DC.exe
            DC.exe /D
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5112
        • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\YOURDATA.exe
          "C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\YOURDATA.exe" -e watch -pid 3036 -!
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3100
        • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\YOURDATA.exe
          "C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\YOURDATA.exe" -e ul1
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:408
        • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\YOURDATA.exe
          "C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\YOURDATA.exe" -e ul2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4480
        • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\Everything.exe
          "C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3524
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -H off
          4⤵
          • Power Settings
          PID:3508
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1320
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:4436
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1524
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:1788
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:780
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1520
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:4648
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:2940
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:4276
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
          4⤵
          • Power Settings
          PID:3764
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
          4⤵
          • Power Settings
          PID:1940
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
          4⤵
          • Power Settings
          PID:1424
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
          4⤵
          • Power Settings
          PID:4156
        • C:\Windows\SYSTEM32\powercfg.exe
          powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
          4⤵
          • Power Settings
          PID:1660
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3644
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4596
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2296
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:264
        • C:\Windows\SYSTEM32\bcdedit.exe
          bcdedit.exe /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1292
        • C:\Windows\SYSTEM32\wbadmin.exe
          wbadmin.exe DELETE SYSTEMSTATEBACKUP
          4⤵
          • Deletes System State backups
          • Drops file in Windows directory
          PID:3384
        • C:\Windows\SYSTEM32\wbadmin.exe
          wbadmin.exe delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:3040
        • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\Everything.exe
          "C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\Everything.exe" -startup
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4588
        • C:\Windows\SysWOW64\notepad.exe
          notepad.exe "C:\Users\Admin\AppData\Local\----Read-Me-----.txt"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:5400
        • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\xdel.exe
          "C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\xdel.exe" -accepteula -p 1 -c C:\
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5508
        • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\xdel.exe
          "C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\xdel.exe" -accepteula -p 1 -c F:\
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5504
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2236
  • C:\Windows\System32\Systray.exe
    C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:3132
    • C:\Windows\System32\Systray.exe
      C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4440
      • C:\Windows\System32\Systray.exe
        C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:4568
        • C:\Windows\System32\Systray.exe
          C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:2576
          • C:\Windows\System32\Systray.exe
            C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:1184
            • C:\Windows\System32\Systray.exe
              C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:2840
              • C:\Windows\System32\Systray.exe
                C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:4760
                • C:\Windows\System32\Systray.exe
                  C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4152
                  • C:\Windows\System32\Systray.exe
                    C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:5744
                    • C:\Windows\System32\Systray.exe
                      C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:5760
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                          PID:4332
                        • C:\Windows\system32\wbengine.exe
                          "C:\Windows\system32\wbengine.exe"
                          1⤵
                            PID:1424
                          • C:\Windows\System32\vdsldr.exe
                            C:\Windows\System32\vdsldr.exe -Embedding
                            1⤵
                              PID:4180
                            • C:\Windows\System32\vds.exe
                              C:\Windows\System32\vds.exe
                              1⤵
                              • Checks SCSI registry key(s)
                              PID:2888

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            3
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            2
                            T1546

                            Change Default File Association

                            1
                            T1546.001

                            Image File Execution Options Injection

                            1
                            T1546.012

                            Power Settings

                            1
                            T1653

                            Privilege Escalation

                            Abuse Elevation Control Mechanism

                            1
                            T1548

                            Bypass User Account Control

                            1
                            T1548.002

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Event Triggered Execution

                            2
                            T1546

                            Change Default File Association

                            1
                            T1546.001

                            Image File Execution Options Injection

                            1
                            T1546.012

                            Defense Evasion

                            Abuse Elevation Control Mechanism

                            1
                            T1548

                            Bypass User Account Control

                            1
                            T1548.002

                            Impair Defenses

                            1
                            T1562

                            Disable or Modify Tools

                            1
                            T1562.001

                            Indicator Removal

                            2
                            T1070

                            File Deletion

                            2
                            T1070.004

                            Modify Registry

                            4
                            T1112

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Peripheral Device Discovery

                            2
                            T1120

                            Query Registry

                            4
                            T1012

                            System Information Discovery

                            5
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Lateral Movement

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Inhibit System Recovery

                            3
                            T1490

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\----Read-Me-----.txt
                              Filesize

                              1KB

                              MD5

                              631b75b8776da37cae5d1a3ed05270a7

                              SHA1

                              67691d0971847d5e8deba374645a5b2d8ec8b835

                              SHA256

                              68d808d31cf64d005fd3b256b4da95c11bd12ec7ef15edd6377763178800a8af

                              SHA512

                              6bd4ab0210e079c0888ea24aa012dd1e930c0b3306ea4d9cabb07f33de093d0f509983671db5b3f7efa45ae75a0f21e1862d0c811047a9adb8653a1d46523ffb

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              d85ba6ff808d9e5444a4b369f5bc2730

                              SHA1

                              31aa9d96590fff6981b315e0b391b575e4c0804a

                              SHA256

                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                              SHA512

                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              77d622bb1a5b250869a3238b9bc1402b

                              SHA1

                              d47f4003c2554b9dfc4c16f22460b331886b191b

                              SHA256

                              f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                              SHA512

                              d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              1KB

                              MD5

                              963146083fe374ae23a67448d63bc620

                              SHA1

                              2448befee1fb7057308afafdf9265610acbc42b9

                              SHA256

                              d1e2940cd2225f75a66bb66005945bbae7403bb979212b673d9e188d383ab0ca

                              SHA512

                              6109ce143104d222d58aedc548793a69bcbb177cc768c831e1176cf69221a7dcbad56e8b5007d2215f41e020b1f9880eb5fc01cc2f934d68c04aa730a7cc7aba

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
                              Filesize

                              300B

                              MD5

                              9d6037befe362455e476b64d0c7d5585

                              SHA1

                              3a37bd2556c2d2ca8d12517fcdc01053e5f458ab

                              SHA256

                              c934266ef6486e12580bf58b9a7efccce610d40783c98bac3c9949c1e5b4e51e

                              SHA512

                              d94320641e1faefcab53d9c58424604b7f779957f17318aeb68043130ea5dc180886d53dbe53b8ce0097fcf9675922c23c1bae8712ed6047b56a0c7abe15f8bc

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2ks.exe
                              Filesize

                              2.3MB

                              MD5

                              5ff517172297d6e66393e20ad0fe4191

                              SHA1

                              0065dbc18aa32a06af362ac8e44e3f4163aef5d8

                              SHA256

                              0c6e3880040d8f84fc5d05b09da177f7b604296d2ab32c0210df131868ffa30b

                              SHA512

                              9466cd592ed20bc55d01c6cbb2a4714417e67551b6e11be7483e1eb3f605a2b45bca968e5ab0b299c75e057c4d5367a6b9ce9a0a82b32323b9a8aaf2cfc7a98c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
                              Filesize

                              772KB

                              MD5

                              b93eb0a48c91a53bda6a1a074a4b431e

                              SHA1

                              ac693a14c697b1a8ee80318e260e817b8ee2aa86

                              SHA256

                              ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

                              SHA512

                              732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe
                              Filesize

                              802KB

                              MD5

                              ac34ba84a5054cd701efad5dd14645c9

                              SHA1

                              dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

                              SHA256

                              c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

                              SHA512

                              df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
                              Filesize

                              1.7MB

                              MD5

                              c44487ce1827ce26ac4699432d15b42a

                              SHA1

                              8434080fad778057a50607364fee8b481f0feef8

                              SHA256

                              4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

                              SHA512

                              a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini
                              Filesize

                              548B

                              MD5

                              742c2400f2de964d0cce4a8dabadd708

                              SHA1

                              c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

                              SHA256

                              2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

                              SHA512

                              63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini
                              Filesize

                              550B

                              MD5

                              51014c0c06acdd80f9ae4469e7d30a9e

                              SHA1

                              204e6a57c44242fad874377851b13099dfe60176

                              SHA256

                              89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

                              SHA512

                              79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
                              Filesize

                              84KB

                              MD5

                              3b03324537327811bbbaff4aafa4d75b

                              SHA1

                              1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

                              SHA256

                              8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

                              SHA512

                              ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
                              Filesize

                              1.7MB

                              MD5

                              b56a4e1baf2ef1f2ff1da51a0c1efd0d

                              SHA1

                              551d9e7b280b6bb672edce72bcb1e26cd23f64e6

                              SHA256

                              fde69844a23403a75cb1985075c162db22b6dedad8f89149a9d346c5c3db9e82

                              SHA512

                              5c72a19d24bb1832ed8861b829b5cc8b9914ede5ee5212cc6cff4e8af77ec0fa4b9f86f0159239e2388dd73157ef1f17bcb505697cff31fdbf65cccf966fd3fa

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\xdel.exe
                              Filesize

                              350KB

                              MD5

                              803df907d936e08fbbd06020c411be93

                              SHA1

                              4aa4b498ae037a2b0479659374a5c3af5f6b8d97

                              SHA256

                              e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

                              SHA512

                              5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x5lkfaen.3hi.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\Everything.db
                              Filesize

                              13.3MB

                              MD5

                              fbe8278ed88ae6533a37e12491b0a2f8

                              SHA1

                              aef20cae26be6775c690210c7815ccaf8b18e444

                              SHA256

                              1bfc5dac8bfc67f610a7cbd5b794850878b26e1ab214a11ed88d597aa1e3f6e5

                              SHA512

                              3ac3106c10d3fd68788d3df05fe65269f3e7adb8b8229fb6b1cd986f817a40e0c7d54391fd2310b428bc23ea05ad1e9d27542961c756f70ee257cf5e54e995a1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\Everything.ini
                              Filesize

                              20KB

                              MD5

                              1f395da2a7e52f34218540f30a4a4dfd

                              SHA1

                              222caffc4cdd7a64c69fe16fe6ead77850cd3b24

                              SHA256

                              ce5334cda7e49c72742fb9c45026f5c4313b652e58efaf51fe0ef8bcb0e84e04

                              SHA512

                              4568b599bff1011bbaafdd114a0098595e584da78c4940b29f3db3104acc95764a6e004fe71befef64ec663b2b3106e5225c75b3b706a1cb803f33dccbc04d07

                              Download Submit

                            • C:\Users\Admin\AppData\Local\{0ECDC9AB-A6A9-9E08-77E6-7625750CF52C}\session.tmp
                              Filesize

                              32B

                              MD5

                              2254aca6d60fa43684be0dd12e00086e

                              SHA1

                              c753fbc72cfa9d10f5bbd294f71da7f6aa78c515

                              SHA256

                              5aa58301a1378c4eccf0913e83daf3ed798dea4c930f87282db88eecad828f9c

                              SHA512

                              46356a3b305cfd44b4e131fb6e0847636e366195b6801f96f35842f77537b04d944e58f945d32dfcc2d69096896601582420e22df04f2d8c615b5846a31def13

                              Download Submit

                            • C:\temp\MIMIC_LOG.txt
                              Filesize

                              33KB

                              MD5

                              9a5976ae0b74cfdc36dc038464959f2f

                              SHA1

                              498f15b609b52992999bba304ce2a1938bca675a

                              SHA256

                              3af6749fcc82142fd3100312ef49e03df1d3d478a9dbe28afcc3f685ad165876

                              SHA512

                              c528fe7013b676594d5ed68f9e22c1c18c392a56868cd316b4e6859f86972ee7e47ff7f56cc57378a7f60492e5bb09d88531778d599299408b1f213a951e1ac7

                              Download Submit

                            • C:\temp\MIMIC_LOG.txt
                              Filesize

                              32KB

                              MD5

                              0d7ce33d45ba9fd301b6f45563adb18d

                              SHA1

                              ff5f9c1fc8708e6533ded25ef530a97ad8aab551

                              SHA256

                              1bb05d263b02c61dddac174b1ee5404806c7b63cbb2a58a22d5ce5b974d443ae

                              SHA512

                              bb3e36282cc7dd9e9c78da223eca4a4afba95fdfd466efdb3d412f3fc2381cddd7dfdffb7fb0bd64cfcd0e47f600f754392caf1516bd129ed6ded5a286097bd2

                              Download Submit

                            • memory/4596-117-0x00000161E9B30000-0x00000161E9B52000-memory.dmp

                              Filesize

                              136KB

                              Download