Overview

overview

10

Static

static

10

samples.zip

windows7-x64

1

samples.zip

windows10-2004-x64

1

samples/Ev...ng.exe

windows7-x64

6

samples/Ev...ng.exe

windows10-2004-x64

6

samples/Ev...32.dll

windows7-x64

3

samples/Ev...32.dll

windows10-2004-x64

3

samples/fr...ng.exe

windows7-x64

10

samples/fr...ng.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    361s
  • max time network
    362s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21-09-2024 14:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    samples/freeworldencrypting.exe

  • Size

    2.0MB

  • MD5

    22c109d5539b862d629daa01673352cd

  • SHA1

    2eed43bf7f139243d9ef93bf4ed0903ced8a08b5

  • SHA256

    f5a331009d6e46236036c2de3578f2a8414742271ed4b23496859c8b99f5c4de

  • SHA512

    3d251c3c633f24b1ddf7d1f5dcf8a2c8093c892c0a1e5577aec8dc01fcf50aebdc0d481c96f65d83dadd7a7873c2e8013761b16728bd5f6e3621977b2ae46bc2

  • SSDEEP

    49152:wa/RPnb1b+uL5KTu8l6VP/DOdmGtPY4ldP1nKESY:wa/RTd56M9/DmmGmMP

Score
10/10
mimicdiscoveryevasionexecutionpersistenceransomwaretrojan

Malware Config

Signatures

  • Detects Mimic ransomware 1 IoCs
  • Mimic

    Ransomware family was first exploited in the wild in 2022.

    ransomwaremimic
  • UAC bypass 3 TTPs 4 IoCs
    evasiontrojan
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes System State backups 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Modifies system executable filetype association 2 TTPs 10 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 15 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in Windows directory 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 19 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 13 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\samples\freeworldencrypting.exe
    "C:\Users\Admin\AppData\Local\Temp\samples\freeworldencrypting.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
      "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"
      2⤵
      • UAC bypass
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2432
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c DC.exe /D
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2708
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" -e watch -pid 2432 -!
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2684
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" -e ul1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2428
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" -e ul2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -H off
        3⤵
        • Power Settings
        PID:2624
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
        3⤵
        • Power Settings
        PID:2672
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
        3⤵
        • Power Settings
        PID:2980
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
        3⤵
        • Power Settings
        PID:3036
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
        3⤵
        • Power Settings
        PID:1964
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
        3⤵
        • Power Settings
        PID:2996
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
        3⤵
        • Power Settings
        PID:1664
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
        3⤵
        • Power Settings
        PID:1540
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
        3⤵
        • Power Settings
        PID:1112
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
        3⤵
        • Power Settings
        PID:496
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 0
        3⤵
        • Power Settings
        PID:1068
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 0
        3⤵
        • Power Settings
        PID:2004
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 0
        3⤵
        • Power Settings
        PID:2304
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
        3⤵
        • Power Settings
        PID:1600
      • C:\Windows\system32\powercfg.exe
        powercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb61
        3⤵
        • Power Settings
        PID:872
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1884
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1612
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1888
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe" -startup
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1360
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2644
      • C:\Windows\system32\bcdedit.exe
        bcdedit.exe /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3060
      • C:\Windows\system32\wbadmin.exe
        wbadmin.exe DELETE SYSTEMSTATEBACKUP
        3⤵
        • Deletes System State backups
        • Drops file in Windows directory
        PID:2316
      • C:\Windows\system32\wbadmin.exe
        wbadmin.exe delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:2656
      • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe
        "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe" -startup
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1520
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe "C:\Users\Admin\AppData\Local\HACKLENDINIZ.txt"
        3⤵
        • System Location Discovery: System Language Discovery
        • Opens file in notepad (likely ransom note)
        PID:588
      • C:\Windows\SysWOW64\wevtutil.exe
        wevtutil.exe cl security
        3⤵
        • Clears Windows event logs
        • System Location Discovery: System Language Discovery
        PID:1252
      • C:\Windows\SysWOW64\wevtutil.exe
        wevtutil.exe cl system
        3⤵
        • Clears Windows event logs
        • System Location Discovery: System Language Discovery
        PID:2244
      • C:\Windows\SysWOW64\wevtutil.exe
        wevtutil.exe cl application
        3⤵
        • Clears Windows event logs
        • System Location Discovery: System Language Discovery
        PID:2384
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" & cd /d "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88" & Del /f /q /a *.exe *.ini *.dll *.bat *.db"
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1812
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.2 -n 5
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2444
        • C:\Windows\SysWOW64\fsutil.exe
          fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:712
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:2288
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
        PID:2732
      • C:\Windows\System32\vdsldr.exe
        C:\Windows\System32\vdsldr.exe -Embedding
        1⤵
          PID:1780
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
            PID:1088

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          3
          T1059

          PowerShell

          1
          T1059.001

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Change Default File Association

          1
          T1546.001

          Image File Execution Options Injection

          1
          T1546.012

          Power Settings

          1
          T1653

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Event Triggered Execution

          2
          T1546

          Change Default File Association

          1
          T1546.001

          Image File Execution Options Injection

          1
          T1546.012

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Indicator Removal

          3
          T1070

          Clear Windows Event Logs

          1
          T1070.001

          File Deletion

          2
          T1070.004

          Modify Registry

          4
          T1112

          Credential Access

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          Remote System Discovery

          1
          T1018

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          3
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\$I30
            Filesize

            4KB

            MD5

            6e4a12d35893ed1115749b48393b5200

            SHA1

            fbd8f6e92ecaf2e50dc3d0f53d21815059b1b6ba

            SHA256

            0b3f8ab04d1c18025a671424df02b55805ae7fbc7eeefd7bdc5801264d287aa4

            SHA512

            40c0fde7ca92b50c7664abf6d959592e7a26a8054b0f0c3d6273ffc63e1dc64a6e8c2c3af6791aa365a7ca64dd6905bd9d6670b6f68c33e59cd4adf608e6db38

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.db
            Filesize

            27.1MB

            MD5

            29bbcfc4cf4da12cd403deeb806691cf

            SHA1

            4414c6fb81b3f3501934fe2c81db563b5dee5334

            SHA256

            9f323e6284dec51c09ffe8d2ade136b78c30e00a06783d4ca296e2fec3a49fab

            SHA512

            971265f344fd6ecefbbdc82fee8a22d7debf84c3132ac2a52bc542e96dfe2b70536f0c187a38bdff827a65fdb11e09a85136938744fdc721f9e0085e5f375487

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.db
            Filesize

            9.2MB

            MD5

            3d0367a2b457993f0b9b26bc3e56e778

            SHA1

            8979a46b218d6be63bbbf18b3bbe831dcbf07282

            SHA256

            e61f612cff5c5072c9e29f1e7889ce5dfafe48cb80a643152b52fa7fc873824c

            SHA512

            aed6a394d9c216710120b35c850cfe7ae4378ba699c4c2a5066c32b6fd57a41c19e6a9a60e065d6e2b943e7118bbb3c5ba805cbce40382d1862772adf40ec0a2

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.db.FileSlack
            Filesize

            3KB

            MD5

            3f0813615deaad7b64e2e31bb5cd1aa2

            SHA1

            0aa7d06ccf31b480eb4ed00708b2ea429a8efe57

            SHA256

            af6225e4b8d9987a20a07cc26125a9e6151d5ef3b6a1dccd6e5f395f1cd23861

            SHA512

            bbe6c451bb64a6c4a1f30235c0dc982601b307c6f706f9d16507a2f8a8a321c24c79b9d649f09b5da9e3ac6eaa318ff92e17305d8916f7806ace11a2667e1fa9

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.db.tmp
            Filesize

            9.2MB

            MD5

            fee5aeb0ee8aea472e96b8b59c6a51b7

            SHA1

            68aaa38969eea39920c4a8a245ee74b0bc30ee01

            SHA256

            e0f4ce81510ccd1d5e4ea93d984ea301563404415ffdd08bb6c025b885be206b

            SHA512

            aee54283235929cc2333ba678633ec6b584661ea470d2fe6821bf9d3ec4fd9a686a880f665fb4b0b409b890f24764a7b205333e2d3b923cc4f99b361a8f0b582

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe
            Filesize

            1.7MB

            MD5

            c44487ce1827ce26ac4699432d15b42a

            SHA1

            8434080fad778057a50607364fee8b481f0feef8

            SHA256

            4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405

            SHA512

            a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.ini
            Filesize

            20KB

            MD5

            2a93c70f9a6f3d90a48422971556458e

            SHA1

            eef4b64923287bffff0bf5887ab76928603346af

            SHA256

            3825a59c0fea44cbd8dd9f08156fe003eb5daee61d1d6c6fab2ee49040634fa8

            SHA512

            7f1badc109c23a998d376dc46defa17f3e5c001b1ae99ea35636d80056e93dcd906b9c416e2349ebf9062874994946944c70a4ed421e9ef0179b98df7c5cc17e

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.ini
            Filesize

            20KB

            MD5

            472ee5a9b076aede5574eb747412cc8a

            SHA1

            cb1541d2aad53309e82c44cb99c220e02bc219d2

            SHA256

            7854d3d94db23ed7e453f30e4a5e302bea209b2ebb60b5554dbc78ac1caefe4d

            SHA512

            22407550d8c602fc2f6c70a671ec948770f8df494e2613d66efb8625f75adaea8047d35931e97c6a841b786fca9b2922e805799f149b58f34c881e5605b8f86a

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.ini.FileSlack
            Filesize

            3KB

            MD5

            fd4589304a588a420da7dd0b56784130

            SHA1

            3a8267d2459cef2d9ea4d782eef8ec2876fbecaa

            SHA256

            a3041b2a3f207ad2e467085b36ca51eae3a5d60f899251c9d5c4c9b248c60482

            SHA512

            28aa740ab94e8643af5339e6cbc4af38cf68c58f76b163e4b2fc0875802889abb2689507e4bd15eab62c095c5d852ab54c200324179c0f804e8158c8c71c1a67

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything32.dll.FileSlack
            Filesize

            3KB

            MD5

            392c3b27af6755b705128fc738d77348

            SHA1

            1c23542f187fcff5aca60532fe6d30517e84c57d

            SHA256

            ea920d619c25a834bdf2fe7c82d36be2150a530ec1f5215cda741b23d29823cb

            SHA512

            901fe1a3ca757b2a883c49776ecda903b0fa521d584466416bcaa97ea83c2319692d399212cf9bf3c794df2e51ea8c452b120d944e6af139022097a800e3b072

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything64.dll
            Filesize

            2.2MB

            MD5

            696682f1a9d5efcd5cfe72adf2649efb

            SHA1

            63ac46cd91decfe85d57c4d3fba0cbb7124edb83

            SHA256

            bfc7bd83edc3aacf0130900b63f2f2ee2ffeb961cf749719f09b68660381a2f0

            SHA512

            d2b33184d1bfe2a050bf0050af24a5c28408b856dd73214d058ca23ddbf75b2edd44ed677d22c548768df897152c7cca5359ad8526e0a60c811221cb156c0529

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe
            Filesize

            2.0MB

            MD5

            22c109d5539b862d629daa01673352cd

            SHA1

            2eed43bf7f139243d9ef93bf4ed0903ced8a08b5

            SHA256

            f5a331009d6e46236036c2de3578f2a8414742271ed4b23496859c8b99f5c4de

            SHA512

            3d251c3c633f24b1ddf7d1f5dcf8a2c8093c892c0a1e5577aec8dc01fcf50aebdc0d481c96f65d83dadd7a7873c2e8013761b16728bd5f6e3621977b2ae46bc2

            Download Submit

          • C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\session.tmp
            Filesize

            32B

            MD5

            c241eda7e1143981d8cf780be372d33a

            SHA1

            9ed5184329f8f6c41740b69c5f7404ce4294dd35

            SHA256

            b5b4a55f7a189862bcb90aeab4abf005a472598f79914b28d1e5a0cda0441b6f

            SHA512

            19db4988951005449ee72e41646c21b9ffa3a9ab9b6ca8b51a624ffcb668a9456a0747bb5bb7360eeaf85110ede13b263d3e49e0341f0b9a48ed005fff255872

            Download Submit

          • C:\Users\Admin\AppData\Local\HACKLENDINIZ.txt
            Filesize

            1KB

            MD5

            30797274eff2ec1a2df9e81fa85b0047

            SHA1

            d42a4b1c3d34f0de8003f61fc0a8ce893deee230

            SHA256

            ca9c94e4dcc26ae2f596590fa7297bb2a4b74811ae88f57dadba8c9ffc79bb51

            SHA512

            11a12c1f1048b65653e8cdfa4e96caf594dd18b89e8dcb34965ede7d14124f2296ac3a706b3d0e5ee1131b9cdfbe120e34f7938e12a84a4b2f7272deb62643f1

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
            Filesize

            7KB

            MD5

            7fccdb7ff6af906575930b830ee72a7e

            SHA1

            3fd9fb16a2ebe647918b7caee0c27ec1e39eb17f

            SHA256

            4149ce20243cbdb8c6bb809e4258c930e6d89628f262ee834a440ee5b2a845bb

            SHA512

            292a56d0c62a25d1c2e0fb2f0bca24344a9a26814fc7f4cb1410af184ad3ad0a4d3c3c9592e171bcdeea81c918b674d539201dc971b182702bf63b6078e316af

            Download Submit

          • \Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything32.dll
            Filesize

            84KB

            MD5

            3b03324537327811bbbaff4aafa4d75b

            SHA1

            1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7

            SHA256

            8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880

            SHA512

            ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62

            Download Submit

          • memory/1612-65-0x00000000026E0000-0x00000000026E8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/1884-64-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

            Filesize

            2.9MB

            Download