Overview

overview

10

Static

static

10

samples.zip

windows7-x64

1

samples.zip

windows10-2004-x64

1

samples/$I30

windows7-x64

1

samples/$I30

windows10-2004-x64

1

samples/Everything.db

windows7-x64

3

samples/Everything.db

windows10-2004-x64

3

samples/Ev...eslack

windows7-x64

3

samples/Ev...eslack

windows10-2004-x64

3

samples/Ev...ng.exe

windows7-x64

6

samples/Ev...ng.exe

windows10-2004-x64

6

samples/Ev...ng.ini

windows7-x64

1

samples/Ev...ng.ini

windows10-2004-x64

1

samples/Ev...eslack

windows7-x64

3

samples/Ev...eslack

windows10-2004-x64

3

samples/Ev...32.dll

windows7-x64

3

samples/Ev...32.dll

windows10-2004-x64

3

samples/Ev...eslack

windows7-x64

3

samples/Ev...eslack

windows10-2004-x64

3

samples/Ev...g64.7z

windows7-x64

3

samples/Ev...g64.7z

windows10-2004-x64

3

samples/fr...ng.exe

windows7-x64

10

samples/fr...ng.exe

windows10-2004-x64

10

samples/session.tmp

windows7-x64

3

samples/session.tmp

windows10-2004-x64

3

Analysis

  • max time kernel
    676s
  • max time network
    1150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2024 14:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    samples/freeworldencrypting.exe

  • Size

    2.0MB

  • MD5

    22c109d5539b862d629daa01673352cd

  • SHA1

    2eed43bf7f139243d9ef93bf4ed0903ced8a08b5

  • SHA256

    f5a331009d6e46236036c2de3578f2a8414742271ed4b23496859c8b99f5c4de

  • SHA512

    3d251c3c633f24b1ddf7d1f5dcf8a2c8093c892c0a1e5577aec8dc01fcf50aebdc0d481c96f65d83dadd7a7873c2e8013761b16728bd5f6e3621977b2ae46bc2

  • SSDEEP

    49152:wa/RPnb1b+uL5KTu8l6VP/DOdmGtPY4ldP1nKESY:wa/RTd56M9/DmmGmMP

Score
10/10
mimicdiscoveryevasionexecutionpersistenceransomwaretrojan

Malware Config

Signatures

  • Detects Mimic ransomware 1 IoCs
  • Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 15 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in Windows directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 19 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 13 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\samples\freeworldencrypting.exe
    "C:\Users\Admin\AppData\Local\Temp\samples\freeworldencrypting.exe"
    1⤵
    • Modifies system executable filetype association
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
      "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"
      2⤵
      • UAC bypass
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:924
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c DC.exe /D
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3132
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" -e watch -pid 924 -!
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2144
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" -e ul1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3216
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" -e ul2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:3640
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe" -startup
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:892
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -H off
        3⤵
        • Power Settings
        PID:2236
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
        3⤵
        • Power Settings
        PID:116
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
        3⤵
        • Power Settings
        PID:3524
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
        3⤵
        • Power Settings
        PID:3888
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
        3⤵
        • Power Settings
        PID:3768
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
        3⤵
        • Power Settings
        PID:2448
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
        3⤵
        • Power Settings
        PID:5076
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
        3⤵
        • Power Settings
        PID:224
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
        3⤵
        • Power Settings
        PID:1160
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
        3⤵
        • Power Settings
        PID:1412
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
        3⤵
        • Power Settings
        PID:2020
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
        3⤵
        • Power Settings
        PID:1796
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
        3⤵
        • Power Settings
        PID:3480
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
        3⤵
        • Power Settings
        PID:396
      • C:\Windows\SYSTEM32\powercfg.exe
        powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
        3⤵
        • Power Settings
        PID:4676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3616
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4988
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2300
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4144
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:4272
      • C:\Windows\SYSTEM32\wbadmin.exe
        wbadmin.exe DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:4380
      • C:\Windows\SYSTEM32\wbadmin.exe
        wbadmin.exe delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:4812
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe" -startup
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4260
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe "C:\Users\Admin\AppData\Local\HACKLENDINIZ.txt"
        3⤵
        • System Location Discovery: System Language Discovery
        • Opens file in notepad (likely ransom note)
        PID:1004
      • C:\Windows\SysWOW64\wevtutil.exe
        wevtutil.exe cl security
        3⤵
        • Clears Windows event logs
        • System Location Discovery: System Language Discovery
        PID:1300
      • C:\Windows\SysWOW64\wevtutil.exe
        wevtutil.exe cl system
        3⤵
        • Clears Windows event logs
        • System Location Discovery: System Language Discovery
        PID:2068
      • C:\Windows\SysWOW64\wevtutil.exe
        wevtutil.exe cl application
        3⤵
        • Clears Windows event logs
        • System Location Discovery: System Language Discovery
        PID:4420
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" & cd /d "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88" & Del /f /q /a *.exe *.ini *.dll *.bat *.db"
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1844
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.2 -n 5
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4052
        • C:\Windows\SysWOW64\fsutil.exe
          fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3368
  • C:\Windows\System32\Systray.exe
    C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:880
    • C:\Windows\System32\Systray.exe
      C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:4688
      • C:\Windows\System32\Systray.exe
        C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3684
        • C:\Windows\System32\Systray.exe
          C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:4380
          • C:\Windows\System32\Systray.exe
            C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:4332
            • C:\Windows\System32\Systray.exe
              C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4680
              • C:\Windows\System32\Systray.exe
                C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:2252
                • C:\Windows\System32\Systray.exe
                  C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:5104
                  • C:\Windows\System32\Systray.exe
                    C:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:1804
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                        PID:804
                      • C:\Windows\system32\wbengine.exe
                        "C:\Windows\system32\wbengine.exe"
                        1⤵
                          PID:540
                        • C:\Windows\System32\vdsldr.exe
                          C:\Windows\System32\vdsldr.exe -Embedding
                          1⤵
                            PID:5048
                          • C:\Windows\System32\vds.exe
                            C:\Windows\System32\vds.exe
                            1⤵
                            • Checks SCSI registry key(s)
                            PID:4408

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Command and Scripting Interpreter

                          3
                          T1059

                          PowerShell

                          1
                          T1059.001

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Event Triggered Execution

                          2
                          T1546

                          Change Default File Association

                          1
                          T1546.001

                          Image File Execution Options Injection

                          1
                          T1546.012

                          Power Settings

                          1
                          T1653

                          Privilege Escalation

                          Abuse Elevation Control Mechanism

                          1
                          T1548

                          Bypass User Account Control

                          1
                          T1548.002

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Event Triggered Execution

                          2
                          T1546

                          Change Default File Association

                          1
                          T1546.001

                          Image File Execution Options Injection

                          1
                          T1546.012

                          Defense Evasion

                          Abuse Elevation Control Mechanism

                          1
                          T1548

                          Bypass User Account Control

                          1
                          T1548.002

                          Impair Defenses

                          1
                          T1562

                          Disable or Modify Tools

                          1
                          T1562.001

                          Indicator Removal

                          3
                          T1070

                          Clear Windows Event Logs

                          1
                          T1070.001

                          File Deletion

                          2
                          T1070.004

                          Modify Registry

                          4
                          T1112

                          Credential Access

                          Discovery

                          Peripheral Device Discovery

                          2
                          T1120

                          Query Registry

                          3
                          T1012

                          Remote System Discovery

                          1
                          T1018

                          System Information Discovery

                          4
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          System Network Configuration Discovery

                          1
                          T1016

                          Internet Connection Discovery

                          1
                          T1016.001

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Inhibit System Recovery

                          3
                          T1490

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\$I30
                            Filesize

                            4KB

                            MD5

                            6e4a12d35893ed1115749b48393b5200

                            SHA1

                            fbd8f6e92ecaf2e50dc3d0f53d21815059b1b6ba

                            SHA256

                            0b3f8ab04d1c18025a671424df02b55805ae7fbc7eeefd7bdc5801264d287aa4

                            SHA512

                            40c0fde7ca92b50c7664abf6d959592e7a26a8054b0f0c3d6273ffc63e1dc64a6e8c2c3af6791aa365a7ca64dd6905bd9d6670b6f68c33e59cd4adf608e6db38

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.db
                            Filesize

                            13.1MB

                            MD5

                            64b193695471270af85a73047f87ec36

                            SHA1

                            de6353ce14dc5b5482d261c4f8afdeb2117c27e5

                            SHA256

                            b4d0b9f369c6b49ba522c51545fcb7d2d0133321c6eedc617441c80cefd4f1f3

                            SHA512

                            edbfeced7100749869e9cc934a4cf81f05ad347dc58cdf0c1c159e018041f58b18a1962d36fe90b1c33323ce3d65607a46fe95bbfa28884a35799a6cbdcefa2e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.db
                            Filesize

                            27.1MB

                            MD5

                            29bbcfc4cf4da12cd403deeb806691cf

                            SHA1

                            4414c6fb81b3f3501934fe2c81db563b5dee5334

                            SHA256

                            9f323e6284dec51c09ffe8d2ade136b78c30e00a06783d4ca296e2fec3a49fab

                            SHA512

                            971265f344fd6ecefbbdc82fee8a22d7debf84c3132ac2a52bc542e96dfe2b70536f0c187a38bdff827a65fdb11e09a85136938744fdc721f9e0085e5f375487

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.db.FileSlack
                            Filesize

                            3KB

                            MD5

                            3f0813615deaad7b64e2e31bb5cd1aa2

                            SHA1

                            0aa7d06ccf31b480eb4ed00708b2ea429a8efe57

                            SHA256

                            af6225e4b8d9987a20a07cc26125a9e6151d5ef3b6a1dccd6e5f395f1cd23861

                            SHA512

                            bbe6c451bb64a6c4a1f30235c0dc982601b307c6f706f9d16507a2f8a8a321c24c79b9d649f09b5da9e3ac6eaa318ff92e17305d8916f7806ace11a2667e1fa9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.db.tmp
                            Filesize

                            13.1MB

                            MD5

                            98af8d0d2591840fab2465d690dba3f3

                            SHA1

                            27cf9c367652093433547c77be1340ca34fbaebe

                            SHA256

                            72156118bb1c501782cedfc96d1688b2a4065ec28dfa358d23120258446a312f

                            SHA512

                            491750184afa8b9e9fc17c299923b3fb6de34d605e71b16f8a4e936c32f2fbda6d9689acf377060e2f53b0f82f98f0e07fd26adb9be3c8679c9ef894585a4c2e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe
                            Filesize

                            1.7MB

                            MD5

                            c44487ce1827ce26ac4699432d15b42a

                            SHA1

                            8434080fad778057a50607364fee8b481f0feef8

                            SHA256

                            4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

                            SHA512

                            a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.ini
                            Filesize

                            20KB

                            MD5

                            472ee5a9b076aede5574eb747412cc8a

                            SHA1

                            cb1541d2aad53309e82c44cb99c220e02bc219d2

                            SHA256

                            7854d3d94db23ed7e453f30e4a5e302bea209b2ebb60b5554dbc78ac1caefe4d

                            SHA512

                            22407550d8c602fc2f6c70a671ec948770f8df494e2613d66efb8625f75adaea8047d35931e97c6a841b786fca9b2922e805799f149b58f34c881e5605b8f86a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.ini
                            Filesize

                            20KB

                            MD5

                            15cc18a2ba3954652ac3e38e3d931f24

                            SHA1

                            01ec8de3ffe4c1dd6dcfaee560edfaf27265a564

                            SHA256

                            4d2259a4b31be766713d7fc31d417fc6de0b060887e34a1d34a3ff26954ee1b8

                            SHA512

                            df536c011704e0aca4395bb4be168e643d562908041d054ff063924bc69e1b9a2ab8e5889967affd6ed7135d6b7bca905bdcbd3a120ecef18dc606283f35b13f

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.ini.FileSlack
                            Filesize

                            3KB

                            MD5

                            fd4589304a588a420da7dd0b56784130

                            SHA1

                            3a8267d2459cef2d9ea4d782eef8ec2876fbecaa

                            SHA256

                            a3041b2a3f207ad2e467085b36ca51eae3a5d60f899251c9d5c4c9b248c60482

                            SHA512

                            28aa740ab94e8643af5339e6cbc4af38cf68c58f76b163e4b2fc0875802889abb2689507e4bd15eab62c095c5d852ab54c200324179c0f804e8158c8c71c1a67

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything32.dll
                            Filesize

                            84KB

                            MD5

                            3b03324537327811bbbaff4aafa4d75b

                            SHA1

                            1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

                            SHA256

                            8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

                            SHA512

                            ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything32.dll.FileSlack
                            Filesize

                            3KB

                            MD5

                            392c3b27af6755b705128fc738d77348

                            SHA1

                            1c23542f187fcff5aca60532fe6d30517e84c57d

                            SHA256

                            ea920d619c25a834bdf2fe7c82d36be2150a530ec1f5215cda741b23d29823cb

                            SHA512

                            901fe1a3ca757b2a883c49776ecda903b0fa521d584466416bcaa97ea83c2319692d399212cf9bf3c794df2e51ea8c452b120d944e6af139022097a800e3b072

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything64.dll
                            Filesize

                            2.2MB

                            MD5

                            696682f1a9d5efcd5cfe72adf2649efb

                            SHA1

                            63ac46cd91decfe85d57c4d3fba0cbb7124edb83

                            SHA256

                            bfc7bd83edc3aacf0130900b63f2f2ee2ffeb961cf749719f09b68660381a2f0

                            SHA512

                            d2b33184d1bfe2a050bf0050af24a5c28408b856dd73214d058ca23ddbf75b2edd44ed677d22c548768df897152c7cca5359ad8526e0a60c811221cb156c0529

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
                            Filesize

                            2.0MB

                            MD5

                            22c109d5539b862d629daa01673352cd

                            SHA1

                            2eed43bf7f139243d9ef93bf4ed0903ced8a08b5

                            SHA256

                            f5a331009d6e46236036c2de3578f2a8414742271ed4b23496859c8b99f5c4de

                            SHA512

                            3d251c3c633f24b1ddf7d1f5dcf8a2c8093c892c0a1e5577aec8dc01fcf50aebdc0d481c96f65d83dadd7a7873c2e8013761b16728bd5f6e3621977b2ae46bc2

                            Download Submit

                          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\session.tmp
                            Filesize

                            32B

                            MD5

                            c241eda7e1143981d8cf780be372d33a

                            SHA1

                            9ed5184329f8f6c41740b69c5f7404ce4294dd35

                            SHA256

                            b5b4a55f7a189862bcb90aeab4abf005a472598f79914b28d1e5a0cda0441b6f

                            SHA512

                            19db4988951005449ee72e41646c21b9ffa3a9ab9b6ca8b51a624ffcb668a9456a0747bb5bb7360eeaf85110ede13b263d3e49e0341f0b9a48ed005fff255872

                            Download Submit

                          • C:\Users\Admin\AppData\Local\HACKLENDINIZ.txt
                            Filesize

                            1KB

                            MD5

                            30797274eff2ec1a2df9e81fa85b0047

                            SHA1

                            d42a4b1c3d34f0de8003f61fc0a8ce893deee230

                            SHA256

                            ca9c94e4dcc26ae2f596590fa7297bb2a4b74811ae88f57dadba8c9ffc79bb51

                            SHA512

                            11a12c1f1048b65653e8cdfa4e96caf594dd18b89e8dcb34965ede7d14124f2296ac3a706b3d0e5ee1131b9cdfbe120e34f7938e12a84a4b2f7272deb62643f1

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                            Filesize

                            2KB

                            MD5

                            d85ba6ff808d9e5444a4b369f5bc2730

                            SHA1

                            31aa9d96590fff6981b315e0b391b575e4c0804a

                            SHA256

                            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                            SHA512

                            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            944B

                            MD5

                            d28a889fd956d5cb3accfbaf1143eb6f

                            SHA1

                            157ba54b365341f8ff06707d996b3635da8446f7

                            SHA256

                            21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

                            SHA512

                            0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            Filesize

                            1KB

                            MD5

                            963146083fe374ae23a67448d63bc620

                            SHA1

                            2448befee1fb7057308afafdf9265610acbc42b9

                            SHA256

                            d1e2940cd2225f75a66bb66005945bbae7403bb979212b673d9e188d383ab0ca

                            SHA512

                            6109ce143104d222d58aedc548793a69bcbb177cc768c831e1176cf69221a7dcbad56e8b5007d2215f41e020b1f9880eb5fc01cc2f934d68c04aa730a7cc7aba

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0di3rby0.gkb.ps1
                            Filesize

                            60B

                            MD5

                            d17fe0a3f47be24a6453e9ef58c94641

                            SHA1

                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                            SHA256

                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                            SHA512

                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                            Download Submit

                          • memory/2300-53-0x0000015FC0520000-0x0000015FC0542000-memory.dmp

                            Filesize

                            136KB

                            Download