mimic | 80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4

Analysis

max time kernel
150s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
Size

4.0MB
MD5

d59aa49740acb5e45ecb65da070035e3
SHA1

4086107b3fb71fb02361306da6099a85be97ae1d
SHA256

80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4
SHA512

459805b020b78399fae8ac5e8ed439df1b8852519014029833794d2eaad1b1f2aecc3aaba99ae52a0881cf57987d4a60298acce04a9fa9299e9d21a832a335a5
SSDEEP

98304:4gwRDvguPP+oGPn58kcuf2ilfio/roYs30f2hi:4govYoGPn5/ui8hi

Score

10^/10

mimic evasion persistence ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\FreeWorld-Contact.txt

Ransom Note

I encrypted your system with a vulnerability in your system. If you want your information, you must pay us. The ransomware project I use on your system is a completely private project. it cannot be broken. unsolvable. People who say they can help you often come to us and they ask us for help on your behalf . In this case, you have to pay more than what you normally pay. If you contact us directly, the fee you will pay will be lower. You may not trust us . but we are trying our best to help you. We can direct you to a company whose data we opened and helped within 48 hours. We want you to know that we have references all over the world. We do not work in a specific region or country. The company we will direct you to can be from any part of the world. We may also share various images and videos with you. We will open the encrypted data. this is our job. We get paid and we help. We cover your vulnerabilities. We ensure your safety and give advice. It is not just your data that you will buy from us. also your safety Our aim is to return the hacked systems back to you. But we want to be rewarded for our services. The most important thing we want from you. be quick . Respond quickly when communicating and quickly conclude the case. We don't want to waste time. We can prove to you that we can open encrypted data. You can send the sample file you want with .png ,jpg,avi,pdf file extensions that are not important to you. We will send the file back to you in working condition. Our file limit is 3 . we can't open more for you for free. You can send us your database files. After we have your database file working, we can send you a screenshot of the table you want. If you want to talk to us instantly, you can contact us via qtox. qtox program address: https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe My qtox address is: E12919AB09D54CB3F6903091580F0C4AADFB6396B1E6C7B8520D878275F56E7803D963E639AE Email address: [email protected] Contact number : VxIadcx_w2n-5mUYdIu8BSbQGHIWqQkYxRxN7qLSv0o*FreeWorldEncryption When you contact us, share your contact number with us.

Emails

[email protected]

URLs

https://github.com/qTox/qTox/releases/download/v1.17.6/setup-qtox-x86_64-release.exe

Signatures

Detects Mimic ransomware 10 IoCs

resource	yara_rule
behavioral1/files/0x0009000000016d09-31.dat	family_mimic
behavioral1/files/0x0009000000016d09-33.dat	family_mimic
behavioral1/files/0x0009000000016d09-32.dat	family_mimic
behavioral1/files/0x0006000000016fe8-68.dat	family_mimic
behavioral1/files/0x0006000000016fe8-67.dat	family_mimic
behavioral1/files/0x0006000000016fe8-70.dat	family_mimic
behavioral1/files/0x0006000000016fe8-73.dat	family_mimic
behavioral1/files/0x0006000000016fe8-89.dat	family_mimic
behavioral1/files/0x0006000000016fe8-91.dat	family_mimic
behavioral1/files/0x0006000000016fe8-90.dat	family_mimic

Mimic
Ransomware family was first exploited in the wild in 2022.
ransomware mimic

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "3"	DC.exe

UAC bypass 3 TTPs 4 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	FreeWorld.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopqos.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qbupdate.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine_x86.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EnterpriseClient.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocssd.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_x64.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbguard.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspub.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbsnmp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	FreeWorld.exe

Deletes itself 1 IoCs

pid	Process
1764	cmd.exe

Executes dropped EXE 9 IoCs

pid	Process
1632	7za.exe
1476	7za.exe
2696	50000.exe
2060	FreeWorld.exe
1988	FreeWorld.exe
700	FreeWorld.exe
2484	FreeWorld.exe
2424	Everything.exe
1364	DC.exe

Loads dropped DLL 19 IoCs

pid	Process
2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
2696	50000.exe
2696	50000.exe
2060	FreeWorld.exe
1988	FreeWorld.exe
2484	FreeWorld.exe
700	FreeWorld.exe
2060	FreeWorld.exe
780	cmd.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe

Modifies system executable filetype association 2 TTPs 10 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open\command	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	50000.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open	50000.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	FreeWorld.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	50000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	FreeWorld.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	50000.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open\command	50000.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell	50000.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	DC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FreeWorld = "\"C:\\Users\\Admin\\AppData\\Local\\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\\FreeWorld.exe\" "	50000.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FreeWorld.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\K:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	DC.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	DC.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre7\lib\security\cacerts.FreeWorldEncryption	FreeWorld.exe
File opened for modification	C:\Program Files\Java\jre7\lib\classlist.FreeWorldEncryption	FreeWorld.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile	50000.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	50000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command	FreeWorld.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	50000.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell	50000.exe
Key created	\REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command	FreeWorld.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open\command\ = "\"%1\" %*"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.FreeWorldEncryption\ = "mimicfile"	FreeWorld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	50000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\FreeWorld-Contact.txt\""	FreeWorld.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open	50000.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open\command	FreeWorld.exe
Key created	\REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell	FreeWorld.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.FreeWorldEncryption	FreeWorld.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\exefile\shell\open\command	50000.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2484	FreeWorld.exe
2060	FreeWorld.exe
700	FreeWorld.exe
2060	FreeWorld.exe
1364	DC.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2060	FreeWorld.exe
2024	powershell.exe
112	powershell.exe
1980	powershell.exe
1364	DC.exe
1364	DC.exe
1364	DC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1632	7za.exe
Token: 35	1632	7za.exe
Token: SeRestorePrivilege	1476	7za.exe
Token: 35	1476	7za.exe
Token: SeSecurityPrivilege	1476	7za.exe
Token: SeSecurityPrivilege	1476	7za.exe
Token: SeIncreaseQuotaPrivilege	2696	50000.exe
Token: SeSecurityPrivilege	2696	50000.exe
Token: SeTakeOwnershipPrivilege	2696	50000.exe
Token: SeLoadDriverPrivilege	2696	50000.exe
Token: SeSystemProfilePrivilege	2696	50000.exe
Token: SeSystemtimePrivilege	2696	50000.exe
Token: SeProfSingleProcessPrivilege	2696	50000.exe
Token: SeIncBasePriorityPrivilege	2696	50000.exe
Token: SeCreatePagefilePrivilege	2696	50000.exe
Token: SeBackupPrivilege	2696	50000.exe
Token: SeRestorePrivilege	2696	50000.exe
Token: SeShutdownPrivilege	2696	50000.exe
Token: SeDebugPrivilege	2696	50000.exe
Token: SeSystemEnvironmentPrivilege	2696	50000.exe
Token: SeChangeNotifyPrivilege	2696	50000.exe
Token: SeRemoteShutdownPrivilege	2696	50000.exe
Token: SeUndockPrivilege	2696	50000.exe
Token: SeManageVolumePrivilege	2696	50000.exe
Token: SeImpersonatePrivilege	2696	50000.exe
Token: SeCreateGlobalPrivilege	2696	50000.exe
Token: 33	2696	50000.exe
Token: 34	2696	50000.exe
Token: 35	2696	50000.exe
Token: SeIncreaseQuotaPrivilege	2060	FreeWorld.exe
Token: SeSecurityPrivilege	2060	FreeWorld.exe
Token: SeTakeOwnershipPrivilege	2060	FreeWorld.exe
Token: SeLoadDriverPrivilege	2060	FreeWorld.exe
Token: SeSystemProfilePrivilege	2060	FreeWorld.exe
Token: SeSystemtimePrivilege	2060	FreeWorld.exe
Token: SeProfSingleProcessPrivilege	2060	FreeWorld.exe
Token: SeIncBasePriorityPrivilege	2060	FreeWorld.exe
Token: SeCreatePagefilePrivilege	2060	FreeWorld.exe
Token: SeBackupPrivilege	2060	FreeWorld.exe
Token: SeRestorePrivilege	2060	FreeWorld.exe
Token: SeShutdownPrivilege	2060	FreeWorld.exe
Token: SeDebugPrivilege	2060	FreeWorld.exe
Token: SeSystemEnvironmentPrivilege	2060	FreeWorld.exe
Token: SeChangeNotifyPrivilege	2060	FreeWorld.exe
Token: SeRemoteShutdownPrivilege	2060	FreeWorld.exe
Token: SeUndockPrivilege	2060	FreeWorld.exe
Token: SeManageVolumePrivilege	2060	FreeWorld.exe
Token: SeImpersonatePrivilege	2060	FreeWorld.exe
Token: SeCreateGlobalPrivilege	2060	FreeWorld.exe
Token: 33	2060	FreeWorld.exe
Token: 34	2060	FreeWorld.exe
Token: 35	2060	FreeWorld.exe
Token: SeIncreaseQuotaPrivilege	1988	FreeWorld.exe
Token: SeSecurityPrivilege	1988	FreeWorld.exe
Token: SeTakeOwnershipPrivilege	1988	FreeWorld.exe
Token: SeLoadDriverPrivilege	1988	FreeWorld.exe
Token: SeSystemProfilePrivilege	1988	FreeWorld.exe
Token: SeSystemtimePrivilege	1988	FreeWorld.exe
Token: SeProfSingleProcessPrivilege	1988	FreeWorld.exe
Token: SeIncBasePriorityPrivilege	1988	FreeWorld.exe
Token: SeCreatePagefilePrivilege	1988	FreeWorld.exe
Token: SeBackupPrivilege	1988	FreeWorld.exe
Token: SeRestorePrivilege	1988	FreeWorld.exe
Token: SeShutdownPrivilege	1988	FreeWorld.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2424	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1632	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	28
PID 2068 wrote to memory of 1632	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	28
PID 2068 wrote to memory of 1632	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	28
PID 2068 wrote to memory of 1632	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	28
PID 2068 wrote to memory of 1476	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	31
PID 2068 wrote to memory of 1476	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	31
PID 2068 wrote to memory of 1476	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	31
PID 2068 wrote to memory of 1476	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	31
PID 2068 wrote to memory of 2696	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	32
PID 2068 wrote to memory of 2696	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	32
PID 2068 wrote to memory of 2696	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	32
PID 2068 wrote to memory of 2696	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	32
PID 2696 wrote to memory of 2060	2696	50000.exe	33
PID 2696 wrote to memory of 2060	2696	50000.exe	33
PID 2696 wrote to memory of 2060	2696	50000.exe	33
PID 2696 wrote to memory of 2060	2696	50000.exe	33
PID 2060 wrote to memory of 780	2060	FreeWorld.exe	34
PID 2060 wrote to memory of 780	2060	FreeWorld.exe	34
PID 2060 wrote to memory of 780	2060	FreeWorld.exe	34
PID 2060 wrote to memory of 780	2060	FreeWorld.exe	34
PID 2060 wrote to memory of 1988	2060	FreeWorld.exe	36
PID 2060 wrote to memory of 1988	2060	FreeWorld.exe	36
PID 2060 wrote to memory of 1988	2060	FreeWorld.exe	36
PID 2060 wrote to memory of 1988	2060	FreeWorld.exe	36
PID 2060 wrote to memory of 700	2060	FreeWorld.exe	37
PID 2060 wrote to memory of 700	2060	FreeWorld.exe	37
PID 2060 wrote to memory of 700	2060	FreeWorld.exe	37
PID 2060 wrote to memory of 700	2060	FreeWorld.exe	37
PID 2060 wrote to memory of 2484	2060	FreeWorld.exe	38
PID 2060 wrote to memory of 2484	2060	FreeWorld.exe	38
PID 2060 wrote to memory of 2484	2060	FreeWorld.exe	38
PID 2060 wrote to memory of 2484	2060	FreeWorld.exe	38
PID 2060 wrote to memory of 2424	2060	FreeWorld.exe	39
PID 2060 wrote to memory of 2424	2060	FreeWorld.exe	39
PID 2060 wrote to memory of 2424	2060	FreeWorld.exe	39
PID 2060 wrote to memory of 2424	2060	FreeWorld.exe	39
PID 2068 wrote to memory of 1764	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	43
PID 2068 wrote to memory of 1764	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	43
PID 2068 wrote to memory of 1764	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	43
PID 2068 wrote to memory of 1764	2068	80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe	43
PID 780 wrote to memory of 1364	780	cmd.exe	42
PID 780 wrote to memory of 1364	780	cmd.exe	42
PID 780 wrote to memory of 1364	780	cmd.exe	42
PID 780 wrote to memory of 1364	780	cmd.exe	42
PID 2060 wrote to memory of 1960	2060	FreeWorld.exe	46
PID 2060 wrote to memory of 1960	2060	FreeWorld.exe	46
PID 2060 wrote to memory of 1960	2060	FreeWorld.exe	46
PID 2060 wrote to memory of 1960	2060	FreeWorld.exe	46
PID 2060 wrote to memory of 436	2060	FreeWorld.exe	48
PID 2060 wrote to memory of 436	2060	FreeWorld.exe	48
PID 2060 wrote to memory of 436	2060	FreeWorld.exe	48
PID 2060 wrote to memory of 436	2060	FreeWorld.exe	48
PID 2060 wrote to memory of 2160	2060	FreeWorld.exe	49
PID 2060 wrote to memory of 2160	2060	FreeWorld.exe	49
PID 2060 wrote to memory of 2160	2060	FreeWorld.exe	49
PID 2060 wrote to memory of 2160	2060	FreeWorld.exe	49
PID 2060 wrote to memory of 1728	2060	FreeWorld.exe	51
PID 2060 wrote to memory of 1728	2060	FreeWorld.exe	51
PID 2060 wrote to memory of 1728	2060	FreeWorld.exe	51
PID 2060 wrote to memory of 1728	2060	FreeWorld.exe	51
PID 2060 wrote to memory of 1076	2060	FreeWorld.exe	53
PID 2060 wrote to memory of 1076	2060	FreeWorld.exe	53
PID 2060 wrote to memory of 1076	2060	FreeWorld.exe	53
PID 2060 wrote to memory of 1076	2060	FreeWorld.exe	53

System policy modification 1 TTPs 11 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	FreeWorld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	FreeWorld.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1"	FreeWorld.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	FreeWorld.exe

C:\Users\Admin\AppData\Local\Temp\80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe
"C:\Users\Admin\AppData\Local\Temp\80bf2731a81c113432f061b397d70cac72d907c39102513abe0f2bae079373e4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p105689248955111405 Everything64.dll
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\50000.exe
  "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\50000.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe
    "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe"
    3⤵
    - UAC bypass
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system executable filetype association
    - Checks whether UAC is enabled
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2060
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c DC.exe /D
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:780
    - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\DC.exe
        
        DC.exe /D
        5⤵
        Modifies security service
        Executes dropped EXE
        Windows security modification
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1364
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe" -e watch -pid 2060 -!
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1988
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe" -e ul1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:700
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe" -e ul2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2484
  - - C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe
      "C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe" -startup
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Suspicious use of SetWindowsHookEx
      PID:2424
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -H off
      4⤵
      PID:1960
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:436
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:2160
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1728
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1076
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2024
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
      4⤵
      PID:1948
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
      4⤵
      PID:1976
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1356
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:776
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:960
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
      4⤵
      PID:1972
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:1696
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
      4⤵
      PID:1444
  - - C:\Windows\system32\powercfg.exe
      powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
      4⤵
      PID:2220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
  2⤵
  - Deletes itself
  PID:1764

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\FreeWorld-Contact.txt

Filesize
2KB

MD5
86c086f7e47221c01bf641358659b4fd

SHA1
bca1f9b3726f8370a972cb0914826715a56e6902

SHA256
53a60f63347e5d74c8f901921ac6555d116ebf8bbe5ca4915faf35c33c79e372

SHA512
9dd47f1355ce36526b2a683d7026f5f9235eb17e907b820506e9b8113405f7a7670e01475c7df6f63dc02ac041267a506d4a39fec4508e22b23b15c3fecbda2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
300B

MD5
1f092347239d24d54055fc4162ed1404

SHA1
b48e8e2fdd3bf1f49affdc036d71f49888a2c95b

SHA256
49f4a0c7f862edce8ba313e0da16d0acb0588f6c5143257bc6d201366f805120

SHA512
e81b0d3ba26ecceec925550564fa22d5e9da950e131a44da88014fda0a2406ac421f6e77a4ac73fb8b7a97c8c0aee08c86bae8e77369678c5c456384d56b0318

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

Filesize
300B

MD5
1f092347239d24d54055fc4162ed1404

SHA1
b48e8e2fdd3bf1f49affdc036d71f49888a2c95b

SHA256
49f4a0c7f862edce8ba313e0da16d0acb0588f6c5143257bc6d201366f805120

SHA512
e81b0d3ba26ecceec925550564fa22d5e9da950e131a44da88014fda0a2406ac421f6e77a4ac73fb8b7a97c8c0aee08c86bae8e77369678c5c456384d56b0318

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\50000.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\50000.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini

Filesize
548B

MD5
742c2400f2de964d0cce4a8dabadd708

SHA1
c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

SHA256
2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

SHA512
63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini

Filesize
550B

MD5
51014c0c06acdd80f9ae4469e7d30a9e

SHA1
204e6a57c44242fad874377851b13099dfe60176

SHA256
89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

SHA512
79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll

Filesize
3.0MB

MD5
607e58bd01a843958ca6d890b80412ae

SHA1
ed8b3cb3e47e46479ad20d84675901448788b33c

SHA256
83b3488020127bead102071c6aa0148e78f253fe73cdbc5123a8cbcffdaac2fc

SHA512
8e640b22e6ed34f9c500eb0b2a40e50c036072182e2c7db50094b79cfeb6fdad52a1d5ea6b9b87b7aade45ca357e165f587d352942bdb33c1586e89b94555926

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel.exe

Filesize
350KB

MD5
803df907d936e08fbbd06020c411be93

SHA1
4aa4b498ae037a2b0479659374a5c3af5f6b8d97

SHA256
e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

SHA512
5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel64.exe

Filesize
448KB

MD5
e2114b1627889b250c7fd0425ba1bd54

SHA1
97412dba3cbeb0125c71b7b2ab194ea2fdff51b2

SHA256
5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60

SHA512
76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\session.tmp

Filesize
32B

MD5
8e68e347e6309a59f8f3cddb811a6ebf

SHA1
552062cf8d23f0b558ba93cb94f1ebbc1ac28a05

SHA256
026158a01e8936ae47dd58eb29536da8c1d759205346dc3da641081be2360efb

SHA512
ae09a5d9495b9e38c3239fc52f52bad6b6ced8b2ceef66462798538f6c2b084f16a80c237826705d07b5d20f16105a6fd32dbf8547dfb47572da4f30e6170d38

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.ini

Filesize
548B

MD5
742c2400f2de964d0cce4a8dabadd708

SHA1
c452d8d4c3a82af4bc57ca8a76e4407aaf90deca

SHA256
2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01

SHA512
63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything2.ini

Filesize
550B

MD5
51014c0c06acdd80f9ae4469e7d30a9e

SHA1
204e6a57c44242fad874377851b13099dfe60176

SHA256
89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5

SHA512
79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything64.dll

Filesize
3.0MB

MD5
607e58bd01a843958ca6d890b80412ae

SHA1
ed8b3cb3e47e46479ad20d84675901448788b33c

SHA256
83b3488020127bead102071c6aa0148e78f253fe73cdbc5123a8cbcffdaac2fc

SHA512
8e640b22e6ed34f9c500eb0b2a40e50c036072182e2c7db50094b79cfeb6fdad52a1d5ea6b9b87b7aade45ca357e165f587d352942bdb33c1586e89b94555926

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sdel.exe

Filesize
350KB

MD5
803df907d936e08fbbd06020c411be93

SHA1
4aa4b498ae037a2b0479659374a5c3af5f6b8d97

SHA256
e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c

SHA512
5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\sdel64.exe

Filesize
448KB

MD5
e2114b1627889b250c7fd0425ba1bd54

SHA1
97412dba3cbeb0125c71b7b2ab194ea2fdff51b2

SHA256
5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60

SHA512
76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1

Download Submit
C:\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\session.tmp

Filesize
32B

MD5
8e68e347e6309a59f8f3cddb811a6ebf

SHA1
552062cf8d23f0b558ba93cb94f1ebbc1ac28a05

SHA256
026158a01e8936ae47dd58eb29536da8c1d759205346dc3da641081be2360efb

SHA512
ae09a5d9495b9e38c3239fc52f52bad6b6ced8b2ceef66462798538f6c2b084f16a80c237826705d07b5d20f16105a6fd32dbf8547dfb47572da4f30e6170d38

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
050dbab933d8d9436bea839a070ee703

SHA1
07c71c58e7c9ca9253d0d4304fa1ba90ec9bea89

SHA256
074d7693dc519efcc1b55ef1a69e94cb5a961a74542bc1b4b877410fab2f701b

SHA512
486f2c660f548f9b200cf7d35214dd9631bbcd9e5276182a43c05a887120509ea77344beecacc3507d4586e4115264a9dbf209c1a6b91a897afcfd6d7a7f3498

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
050dbab933d8d9436bea839a070ee703

SHA1
07c71c58e7c9ca9253d0d4304fa1ba90ec9bea89

SHA256
074d7693dc519efcc1b55ef1a69e94cb5a961a74542bc1b4b877410fab2f701b

SHA512
486f2c660f548f9b200cf7d35214dd9631bbcd9e5276182a43c05a887120509ea77344beecacc3507d4586e4115264a9dbf209c1a6b91a897afcfd6d7a7f3498

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EFRT6HYE3ZA927U0DM63.temp

Filesize
7KB

MD5
050dbab933d8d9436bea839a070ee703

SHA1
07c71c58e7c9ca9253d0d4304fa1ba90ec9bea89

SHA256
074d7693dc519efcc1b55ef1a69e94cb5a961a74542bc1b4b877410fab2f701b

SHA512
486f2c660f548f9b200cf7d35214dd9631bbcd9e5276182a43c05a887120509ea77344beecacc3507d4586e4115264a9dbf209c1a6b91a897afcfd6d7a7f3498

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
233B

MD5
cd4326a6fd01cd3ca77cfd8d0f53821b

SHA1
a1030414d1f8e5d5a6e89d5a309921b8920856f9

SHA256
1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c

SHA512
29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67

Download Submit
C:\temp\session.tmp

Filesize
32B

MD5
8e68e347e6309a59f8f3cddb811a6ebf

SHA1
552062cf8d23f0b558ba93cb94f1ebbc1ac28a05

SHA256
026158a01e8936ae47dd58eb29536da8c1d759205346dc3da641081be2360efb

SHA512
ae09a5d9495b9e38c3239fc52f52bad6b6ced8b2ceef66462798538f6c2b084f16a80c237826705d07b5d20f16105a6fd32dbf8547dfb47572da4f30e6170d38

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\50000.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe

Filesize
772KB

MD5
b93eb0a48c91a53bda6a1a074a4b431e

SHA1
ac693a14c697b1a8ee80318e260e817b8ee2aa86

SHA256
ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142

SHA512
732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\DC.exe

Filesize
802KB

MD5
ac34ba84a5054cd701efad5dd14645c9

SHA1
dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b

SHA256
c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e

SHA512
df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything.exe

Filesize
1.7MB

MD5
c44487ce1827ce26ac4699432d15b42a

SHA1
8434080fad778057a50607364fee8b481f0feef8

SHA256
4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

SHA512
a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\Everything32.dll

Filesize
84KB

MD5
3b03324537327811bbbaff4aafa4d75b

SHA1
1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

SHA256
8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

SHA512
ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

Download Submit
\Users\Admin\AppData\Local\{F80F3179-4BBC-94CB-5061-C6804F78FA39}\FreeWorld.exe

Filesize
3.5MB

MD5
dbf9675bd273e982ca5de58ac32de399

SHA1
5e6df45bdc8d4a5f711988672cc43643fb35a876

SHA256
75975b0c890f804dab19f68d7072f8c04c5fe5162d2a4199448fc0e1ad03690b

SHA512
f32ca912f9d5f6a1e1b4615be9ed03b1a823fb961bdd96e5caaaf6beb217dbe8418635c979355c84444ab944cccbef36a606fed8fdd50e42a4786d4930d60631

Download Submit
memory/112-163-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/112-160-0x000007FEF4F70000-0x000007FEF590D000-memory.dmp

Filesize
9.6MB

Download
memory/112-176-0x000007FEF4F70000-0x000007FEF590D000-memory.dmp

Filesize
9.6MB

Download
memory/112-147-0x000007FEF4F70000-0x000007FEF590D000-memory.dmp

Filesize
9.6MB

Download
memory/112-148-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/112-174-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/112-150-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/112-166-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/112-162-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/1980-172-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1980-173-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1980-178-0x000007FEF4F70000-0x000007FEF590D000-memory.dmp

Filesize
9.6MB

Download
memory/1980-157-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1980-158-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1980-156-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1980-171-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1980-168-0x0000000002900000-0x0000000002980000-memory.dmp

Filesize
512KB

Download
memory/1980-167-0x000007FEF4F70000-0x000007FEF590D000-memory.dmp

Filesize
9.6MB

Download
memory/1980-155-0x000007FEF4F70000-0x000007FEF590D000-memory.dmp

Filesize
9.6MB

Download
memory/2024-165-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/2024-164-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/2024-144-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/2024-145-0x000007FEF4F70000-0x000007FEF590D000-memory.dmp

Filesize
9.6MB

Download
memory/2024-149-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/2024-175-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/2024-161-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/2024-177-0x000007FEF4F70000-0x000007FEF590D000-memory.dmp

Filesize
9.6MB

Download
memory/2024-146-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/2024-159-0x000007FEF4F70000-0x000007FEF590D000-memory.dmp

Filesize
9.6MB

Download
memory/2024-143-0x000000001B2F0000-0x000000001B5D2000-memory.dmp

Filesize
2.9MB

Download