Overview
overview
10Static
static
10samples.zip
windows7-x64
1samples.zip
windows10-2004-x64
1samples/Ev...ng.exe
windows7-x64
6samples/Ev...ng.exe
windows10-2004-x64
6samples/Ev...32.dll
windows7-x64
3samples/Ev...32.dll
windows10-2004-x64
3samples/fr...ng.exe
windows7-x64
10samples/fr...ng.exe
windows10-2004-x64
10Analysis
-
max time kernel
455s -
max time network
417s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 14:36
Behavioral task
behavioral1
Sample
samples.zip
Resource
win7-20240903-en
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
samples.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral3
Sample
samples/Everything.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
samples/Everything.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
samples/Everything32.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
600 seconds
Behavioral task
behavioral6
Sample
samples/Everything32.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
600 seconds
Behavioral task
behavioral7
Sample
samples/freeworldencrypting.exe
Resource
win7-20240708-en
windows7-x64
30 signatures
600 seconds
Behavioral task
behavioral8
Sample
samples/freeworldencrypting.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
31 signatures
600 seconds
General
-
Target
samples/freeworldencrypting.exe
-
Size
2.0MB
-
MD5
22c109d5539b862d629daa01673352cd
-
SHA1
2eed43bf7f139243d9ef93bf4ed0903ced8a08b5
-
SHA256
f5a331009d6e46236036c2de3578f2a8414742271ed4b23496859c8b99f5c4de
-
SHA512
3d251c3c633f24b1ddf7d1f5dcf8a2c8093c892c0a1e5577aec8dc01fcf50aebdc0d481c96f65d83dadd7a7873c2e8013761b16728bd5f6e3621977b2ae46bc2
-
SSDEEP
49152:wa/RPnb1b+uL5KTu8l6VP/DOdmGtPY4ldP1nKESY:wa/RTd56M9/DmmGmMP
Malware Config
Signatures
-
Detects Mimic ransomware 1 IoCs
resource yara_rule behavioral8/files/0x00070000000234db-23.dat family_mimic -
Mimic
Ransomware family was first exploited in the wild in 2022.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" freeworldencrypting.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" freeworldencrypting.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" freeworldencrypting.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" freeworldencrypting.exe -
Clears Windows event logs 1 TTPs 3 IoCs
pid Process 1356 wevtutil.exe 3432 wevtutil.exe 3636 wevtutil.exe -
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 3196 bcdedit.exe 4860 bcdedit.exe -
pid Process 1576 wbadmin.exe -
pid Process 2196 wbadmin.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-nt.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msaccess.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msftesql.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\raw_agent_svc.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchApp.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\encsvc.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsnapvss.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW32.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineElevatedCfg.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SimplyConnectionManager.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ssms.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydesktopservice.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\node.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlmangr.exe freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\httpd.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" freeworldencrypting.exe -
Executes dropped EXE 6 IoCs
pid Process 1976 freeworldencrypting.exe 1092 freeworldencrypting.exe 1148 freeworldencrypting.exe 3896 freeworldencrypting.exe 4388 Everything.exe 4888 Everything.exe -
Loads dropped DLL 4 IoCs
pid Process 1976 freeworldencrypting.exe 1148 freeworldencrypting.exe 1092 freeworldencrypting.exe 3896 freeworldencrypting.exe -
Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" freeworldencrypting.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell freeworldencrypting.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open freeworldencrypting.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" freeworldencrypting.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" freeworldencrypting.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command freeworldencrypting.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open\command freeworldencrypting.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" freeworldencrypting.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open\command freeworldencrypting.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\freeworldencrypting = "\"C:\\Users\\Admin\\AppData\\Local\\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\\freeworldencrypting.exe\" " freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\freeworldencrypting.exe = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\HACKLENDINIZ.txt\"" freeworldencrypting.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" freeworldencrypting.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\K: Everything.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\X: Everything.exe -
Power Settings 1 TTPs 15 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1932 powercfg.exe 4136 powercfg.exe 5020 powercfg.exe 4652 powercfg.exe 3044 powercfg.exe 4904 powercfg.exe 4892 powercfg.exe 1704 powercfg.exe 3840 powercfg.exe 212 powercfg.exe 3000 powercfg.exe 2864 powercfg.exe 1924 powercfg.exe 4140 powercfg.exe 1336 powercfg.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
pid Process 232 powershell.exe 5024 powershell.exe 2080 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language freeworldencrypting.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language freeworldencrypting.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fsutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language freeworldencrypting.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language freeworldencrypting.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Everything.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language freeworldencrypting.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4960 cmd.exe 428 PING.EXE -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile freeworldencrypting.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" freeworldencrypting.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command freeworldencrypting.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" freeworldencrypting.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EncryptedDATA\ = "mimicfile" freeworldencrypting.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command freeworldencrypting.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" freeworldencrypting.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open\command freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open freeworldencrypting.exe Key created \REGISTRY\MACHINE\Software\Classes\.EncryptedDATA freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" freeworldencrypting.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell freeworldencrypting.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\HACKLENDINIZ.txt\"" freeworldencrypting.exe Key created \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000_Classes\exefile\shell\open\command freeworldencrypting.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 2880 notepad.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 428 PING.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe 2080 powershell.exe 5024 powershell.exe 232 powershell.exe 2080 powershell.exe 5024 powershell.exe 1148 freeworldencrypting.exe 1148 freeworldencrypting.exe 3896 freeworldencrypting.exe 3896 freeworldencrypting.exe 232 powershell.exe 1976 freeworldencrypting.exe 1976 freeworldencrypting.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4744 freeworldencrypting.exe Token: SeSecurityPrivilege 4744 freeworldencrypting.exe Token: SeTakeOwnershipPrivilege 4744 freeworldencrypting.exe Token: SeLoadDriverPrivilege 4744 freeworldencrypting.exe Token: SeSystemProfilePrivilege 4744 freeworldencrypting.exe Token: SeSystemtimePrivilege 4744 freeworldencrypting.exe Token: SeProfSingleProcessPrivilege 4744 freeworldencrypting.exe Token: SeIncBasePriorityPrivilege 4744 freeworldencrypting.exe Token: SeCreatePagefilePrivilege 4744 freeworldencrypting.exe Token: SeBackupPrivilege 4744 freeworldencrypting.exe Token: SeRestorePrivilege 4744 freeworldencrypting.exe Token: SeShutdownPrivilege 4744 freeworldencrypting.exe Token: SeDebugPrivilege 4744 freeworldencrypting.exe Token: SeSystemEnvironmentPrivilege 4744 freeworldencrypting.exe Token: SeChangeNotifyPrivilege 4744 freeworldencrypting.exe Token: SeRemoteShutdownPrivilege 4744 freeworldencrypting.exe Token: SeUndockPrivilege 4744 freeworldencrypting.exe Token: SeManageVolumePrivilege 4744 freeworldencrypting.exe Token: SeImpersonatePrivilege 4744 freeworldencrypting.exe Token: SeCreateGlobalPrivilege 4744 freeworldencrypting.exe Token: 33 4744 freeworldencrypting.exe Token: 34 4744 freeworldencrypting.exe Token: 35 4744 freeworldencrypting.exe Token: 36 4744 freeworldencrypting.exe Token: SeIncreaseQuotaPrivilege 1976 freeworldencrypting.exe Token: SeSecurityPrivilege 1976 freeworldencrypting.exe Token: SeTakeOwnershipPrivilege 1976 freeworldencrypting.exe Token: SeLoadDriverPrivilege 1976 freeworldencrypting.exe Token: SeSystemProfilePrivilege 1976 freeworldencrypting.exe Token: SeSystemtimePrivilege 1976 freeworldencrypting.exe Token: SeProfSingleProcessPrivilege 1976 freeworldencrypting.exe Token: SeIncBasePriorityPrivilege 1976 freeworldencrypting.exe Token: SeCreatePagefilePrivilege 1976 freeworldencrypting.exe Token: SeBackupPrivilege 1976 freeworldencrypting.exe Token: SeRestorePrivilege 1976 freeworldencrypting.exe Token: SeShutdownPrivilege 1976 freeworldencrypting.exe Token: SeDebugPrivilege 1976 freeworldencrypting.exe Token: SeSystemEnvironmentPrivilege 1976 freeworldencrypting.exe Token: SeChangeNotifyPrivilege 1976 freeworldencrypting.exe Token: SeRemoteShutdownPrivilege 1976 freeworldencrypting.exe Token: SeUndockPrivilege 1976 freeworldencrypting.exe Token: SeManageVolumePrivilege 1976 freeworldencrypting.exe Token: SeImpersonatePrivilege 1976 freeworldencrypting.exe Token: SeCreateGlobalPrivilege 1976 freeworldencrypting.exe Token: 33 1976 freeworldencrypting.exe Token: 34 1976 freeworldencrypting.exe Token: 35 1976 freeworldencrypting.exe Token: 36 1976 freeworldencrypting.exe Token: SeIncreaseQuotaPrivilege 1148 freeworldencrypting.exe Token: SeSecurityPrivilege 1148 freeworldencrypting.exe Token: SeTakeOwnershipPrivilege 1148 freeworldencrypting.exe Token: SeLoadDriverPrivilege 1148 freeworldencrypting.exe Token: SeSystemProfilePrivilege 1148 freeworldencrypting.exe Token: SeSystemtimePrivilege 1148 freeworldencrypting.exe Token: SeProfSingleProcessPrivilege 1148 freeworldencrypting.exe Token: SeIncBasePriorityPrivilege 1148 freeworldencrypting.exe Token: SeCreatePagefilePrivilege 1148 freeworldencrypting.exe Token: SeBackupPrivilege 1148 freeworldencrypting.exe Token: SeRestorePrivilege 1148 freeworldencrypting.exe Token: SeShutdownPrivilege 1148 freeworldencrypting.exe Token: SeDebugPrivilege 1148 freeworldencrypting.exe Token: SeSystemEnvironmentPrivilege 1148 freeworldencrypting.exe Token: SeChangeNotifyPrivilege 1148 freeworldencrypting.exe Token: SeRemoteShutdownPrivilege 1148 freeworldencrypting.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4388 Everything.exe 4888 Everything.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4744 wrote to memory of 1976 4744 freeworldencrypting.exe 83 PID 4744 wrote to memory of 1976 4744 freeworldencrypting.exe 83 PID 4744 wrote to memory of 1976 4744 freeworldencrypting.exe 83 PID 1976 wrote to memory of 5016 1976 freeworldencrypting.exe 84 PID 1976 wrote to memory of 5016 1976 freeworldencrypting.exe 84 PID 1976 wrote to memory of 5016 1976 freeworldencrypting.exe 84 PID 1976 wrote to memory of 1092 1976 freeworldencrypting.exe 85 PID 1976 wrote to memory of 1092 1976 freeworldencrypting.exe 85 PID 1976 wrote to memory of 1092 1976 freeworldencrypting.exe 85 PID 1976 wrote to memory of 1148 1976 freeworldencrypting.exe 86 PID 1976 wrote to memory of 1148 1976 freeworldencrypting.exe 86 PID 1976 wrote to memory of 1148 1976 freeworldencrypting.exe 86 PID 1976 wrote to memory of 3896 1976 freeworldencrypting.exe 87 PID 1976 wrote to memory of 3896 1976 freeworldencrypting.exe 87 PID 1976 wrote to memory of 3896 1976 freeworldencrypting.exe 87 PID 1976 wrote to memory of 1704 1976 freeworldencrypting.exe 89 PID 1976 wrote to memory of 1704 1976 freeworldencrypting.exe 89 PID 1976 wrote to memory of 1336 1976 freeworldencrypting.exe 90 PID 1976 wrote to memory of 1336 1976 freeworldencrypting.exe 90 PID 1976 wrote to memory of 3840 1976 freeworldencrypting.exe 91 PID 1976 wrote to memory of 3840 1976 freeworldencrypting.exe 91 PID 1976 wrote to memory of 1924 1976 freeworldencrypting.exe 92 PID 1976 wrote to memory of 1924 1976 freeworldencrypting.exe 92 PID 1976 wrote to memory of 4652 1976 freeworldencrypting.exe 93 PID 1976 wrote to memory of 4652 1976 freeworldencrypting.exe 93 PID 1976 wrote to memory of 4892 1976 freeworldencrypting.exe 94 PID 1976 wrote to memory of 4892 1976 freeworldencrypting.exe 94 PID 1976 wrote to memory of 2864 1976 freeworldencrypting.exe 95 PID 1976 wrote to memory of 2864 1976 freeworldencrypting.exe 95 PID 1976 wrote to memory of 3000 1976 freeworldencrypting.exe 96 PID 1976 wrote to memory of 3000 1976 freeworldencrypting.exe 96 PID 1976 wrote to memory of 5020 1976 freeworldencrypting.exe 97 PID 1976 wrote to memory of 5020 1976 freeworldencrypting.exe 97 PID 1976 wrote to memory of 4904 1976 freeworldencrypting.exe 98 PID 1976 wrote to memory of 4904 1976 freeworldencrypting.exe 98 PID 1976 wrote to memory of 4136 1976 freeworldencrypting.exe 99 PID 1976 wrote to memory of 4136 1976 freeworldencrypting.exe 99 PID 1976 wrote to memory of 4140 1976 freeworldencrypting.exe 100 PID 1976 wrote to memory of 4140 1976 freeworldencrypting.exe 100 PID 1976 wrote to memory of 1932 1976 freeworldencrypting.exe 101 PID 1976 wrote to memory of 1932 1976 freeworldencrypting.exe 101 PID 1976 wrote to memory of 212 1976 freeworldencrypting.exe 102 PID 1976 wrote to memory of 212 1976 freeworldencrypting.exe 102 PID 1976 wrote to memory of 3044 1976 freeworldencrypting.exe 103 PID 1976 wrote to memory of 3044 1976 freeworldencrypting.exe 103 PID 1976 wrote to memory of 232 1976 freeworldencrypting.exe 104 PID 1976 wrote to memory of 232 1976 freeworldencrypting.exe 104 PID 1976 wrote to memory of 2080 1976 freeworldencrypting.exe 105 PID 1976 wrote to memory of 2080 1976 freeworldencrypting.exe 105 PID 1976 wrote to memory of 5024 1976 freeworldencrypting.exe 106 PID 1976 wrote to memory of 5024 1976 freeworldencrypting.exe 106 PID 1976 wrote to memory of 4388 1976 freeworldencrypting.exe 125 PID 1976 wrote to memory of 4388 1976 freeworldencrypting.exe 125 PID 1976 wrote to memory of 4388 1976 freeworldencrypting.exe 125 PID 1976 wrote to memory of 3196 1976 freeworldencrypting.exe 151 PID 1976 wrote to memory of 3196 1976 freeworldencrypting.exe 151 PID 1976 wrote to memory of 4860 1976 freeworldencrypting.exe 152 PID 1976 wrote to memory of 4860 1976 freeworldencrypting.exe 152 PID 1976 wrote to memory of 1576 1976 freeworldencrypting.exe 153 PID 1976 wrote to memory of 1576 1976 freeworldencrypting.exe 153 PID 1976 wrote to memory of 2196 1976 freeworldencrypting.exe 156 PID 1976 wrote to memory of 2196 1976 freeworldencrypting.exe 156 PID 1976 wrote to memory of 4888 1976 freeworldencrypting.exe 162 PID 1976 wrote to memory of 4888 1976 freeworldencrypting.exe 162 -
System policy modification 1 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection freeworldencrypting.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = " " freeworldencrypting.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System freeworldencrypting.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System freeworldencrypting.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" freeworldencrypting.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Sisteminizdeki bir gￃﾼvenlik aￃﾧￄﾱￄﾟￄﾱnￄﾱ kullanarak sisteminizi ￅﾟifreledim.\nBilgilerinizi istiyorsanￄﾱz bize ￃﾶdeme yapmalￄﾱsￄﾱnￄﾱz.\nSisteminizde kullandￄﾱￄﾟￄﾱm fidye yazￄﾱlￄﾱmￄﾱ projesi tamamen ￃﾶzel bir projedir. Kￄﾱrￄﾱlamaz. ￃﾧￃﾶzￃﾼlemez.\nSize yardￄﾱmcￄﾱ olabileceￄﾟini sￃﾶyleyen kiￅﾟiler sￄﾱklￄﾱkla bize gelerek sizin adￄﾱnￄﾱza yardￄﾱm talebinde bulunuyorlar.\nBu durumda normalde ￃﾶdediￄﾟinizden daha fazla ￃﾶdemek zorunda kalacaksￄﾱnￄﾱz. Doￄﾟrudan bizimle iletiￅﾟime geￃﾧmeniz durumunda ￃﾶdeyeceￄﾟiniz ￃﾼcret daha dￃﾼￅﾟￃﾼk olacaktￄﾱr.\nBize gￃﾼvenmiyor olabilirsiniz. Ama size yardￄﾱmcￄﾱ olmak iￃﾧin elimizden geleni yapￄﾱyoruz.\n48 saat iￃﾧerisinde verilerini aￃﾧￄﾱp sizi yardￄﾱm ettiￄﾟimiz bir firmaya yￃﾶnlendirebiliriz.\nDￃﾼnyanￄﾱn her yerinde referanslarￄﾱmￄﾱzￄﾱn olduￄﾟunu bilmenizi isteriz.\nￅﾞifrelenmiￅﾟ verileri aￃﾧacaￄﾟￄﾱz. Bu bizim iￅﾟimiz. Para alￄﾱyoruz ve yardￄﾱm ediyoruz. Gￃﾼvenlik aￃﾧￄﾱklarￄﾱnￄﾱzￄﾱ kapatￄﾱyoruz. Gￃﾼvenliￄﾟinizi saￄﾟlￄﾱyoruz ve tavsiyelerde bulunuyoruz.\nBizden satￄﾱn alacaￄﾟￄﾱnￄﾱz ￅﾟey sadece verileriniz deￄﾟildir. aynￄﾱ zamanda gￃﾼvenliￄﾟiniz\nAmacￄﾱmￄﾱz hacklenen sistemleri size geri dￃﾶndￃﾼrmek.\nAncak hizmetlerimizin karￅﾟￄﾱlￄﾱￄﾟￄﾱnￄﾱ almak istiyoruz.\nSizden istediￄﾟimiz en ￃﾶnemli ￅﾟey. Hￄﾱzlￄﾱ olmalￄﾱsￄﾱn. ￄﾰletiￅﾟim kurarken hￄﾱzlￄﾱ tepki verin ve durumu hￄﾱzlￄﾱ bir ￅﾟekilde ￃﾧￃﾶzￃﾼn. Zaman kaybetmek istemiyoruz.\nￅﾞifrelenmiￅﾟ verileri aￃﾧabildiￄﾟimizi size kanￄﾱtlayabiliriz.\nSizin iￃﾧin ￃﾶnemli olmayan .png, jpg, avi, pdf dosya uzantￄﾱlarￄﾱna sahip istediￄﾟiniz ￃﾶrnek dosyayￄﾱ gￃﾶnderebilirsiniz. Dosyayￄﾱ ￃﾧalￄﾱￅﾟￄﾱr durumda size geri gￃﾶndereceￄﾟiz. \nDosya limitimiz 3'tￃﾼr. Daha fazlasￄﾱnￄﾱ sizin iￃﾧin ￃﾼcretsiz aￃﾧamayￄﾱz.\nVeritabanￄﾱ dosyalarￄﾱnￄﾱzￄﾱ bize gￃﾶnderebilirsiniz. Veritabanￄﾱ dosyanￄﾱzￄﾱ ￃﾧalￄﾱￅﾟtￄﾱrdￄﾱktan sonra size istediￄﾟiniz tablonun ekran gￃﾶrￃﾼntￃﾼsￃﾼnￃﾼ gￃﾶnderebiliriz.\n\nE-posta adresi: [email protected]\n\nBu Anahtarￄﾱ Bize Gￃﾶndereceksiniz: yltAiCdUX9ecl0T6bZvP0MYU7-MfiX-rFT6oZNn1kFU*EncryptedDATA" freeworldencrypting.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" freeworldencrypting.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer freeworldencrypting.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" freeworldencrypting.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" freeworldencrypting.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\samples\freeworldencrypting.exe"C:\Users\Admin\AppData\Local\Temp\samples\freeworldencrypting.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"2⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1976 -
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D3⤵
- System Location Discovery: System Language Discovery
PID:5016
-
-
C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" -e watch -pid 1976 -!3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1092
-
-
C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" -e ul13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" -e ul23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3896
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off3⤵
- Power Settings
PID:1704
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:1336
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:3840
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:1924
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:4652
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:4892
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:2864
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:3000
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:5020
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:4904
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 03⤵
- Power Settings
PID:4136
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 03⤵
- Power Settings
PID:4140
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 03⤵
- Power Settings
PID:1932
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Power Settings
PID:212
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb613⤵
- Power Settings
PID:3044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:232
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2080
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5024
-
-
C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe"C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe" -startup3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4388
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
PID:3196
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
PID:4860
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP3⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1576
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet3⤵
- Deletes backup catalog
PID:2196
-
-
C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe"C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\Everything.exe" -startup3⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4888
-
-
C:\Windows\SysWOW64\notepad.exenotepad.exe "C:\Users\Admin\AppData\Local\HACKLENDINIZ.txt"3⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:2880
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl security3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:1356
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl system3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:3636
-
-
C:\Windows\SysWOW64\wevtutil.exewevtutil.exe cl application3⤵
- Clears Windows event logs
- System Location Discovery: System Language Discovery
PID:3432
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe" & cd /d "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88" & Del /f /q /a *.exe *.ini *.dll *.bat *.db"3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4960 -
C:\Windows\SysWOW64\PING.EXEping 127.2 -n 54⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:428
-
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=20000000 "C:\Users\Admin\AppData\Local\D18EE4FE-214C-FF0E-6542-D9DFD58DEE88\freeworldencrypting.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2284
-
-
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:224
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1900
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3196
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2140
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1860
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1124
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2964
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:916
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:944
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5044
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4876
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:2692
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:1644
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:1904
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD56e4a12d35893ed1115749b48393b5200
SHA1fbd8f6e92ecaf2e50dc3d0f53d21815059b1b6ba
SHA2560b3f8ab04d1c18025a671424df02b55805ae7fbc7eeefd7bdc5801264d287aa4
SHA51240c0fde7ca92b50c7664abf6d959592e7a26a8054b0f0c3d6273ffc63e1dc64a6e8c2c3af6791aa365a7ca64dd6905bd9d6670b6f68c33e59cd4adf608e6db38
-
Filesize
13.1MB
MD5eef7e17d9a809e4a8c27760abec8a0df
SHA191937b2fae7ad545a6ee6b2bc34080e3439c6be5
SHA25687094e5b3e34c3aa8796369adf07f3aaed2aa8b67802ef50c3c81c7bcdb13b16
SHA512fbee6a6f7f39957175c9b67b8eb608f163a2623d6b1765b96e948ba2a992271b64ec329e9215939c40925186257c02a996bbc1f3d4a3b5bfa1ac719a9c15672f
-
Filesize
27.1MB
MD529bbcfc4cf4da12cd403deeb806691cf
SHA14414c6fb81b3f3501934fe2c81db563b5dee5334
SHA2569f323e6284dec51c09ffe8d2ade136b78c30e00a06783d4ca296e2fec3a49fab
SHA512971265f344fd6ecefbbdc82fee8a22d7debf84c3132ac2a52bc542e96dfe2b70536f0c187a38bdff827a65fdb11e09a85136938744fdc721f9e0085e5f375487
-
Filesize
3KB
MD53f0813615deaad7b64e2e31bb5cd1aa2
SHA10aa7d06ccf31b480eb4ed00708b2ea429a8efe57
SHA256af6225e4b8d9987a20a07cc26125a9e6151d5ef3b6a1dccd6e5f395f1cd23861
SHA512bbe6c451bb64a6c4a1f30235c0dc982601b307c6f706f9d16507a2f8a8a321c24c79b9d649f09b5da9e3ac6eaa318ff92e17305d8916f7806ace11a2667e1fa9
-
Filesize
13.1MB
MD5ee80a4ff45171147aab175fa8766cb49
SHA1a420825b8b4f05e076242d6f9ec54ccfcfcec810
SHA256bdcfde126a72cfabe4ac40c243318a7f7a9e74ab05fc997a58a9de45bd6b91ee
SHA5125c7848171c46f50fdf06cef56780bc179952aa35a591ea5ed23ddc35c82131e3e08506a968e290590d87475026bb49d05d34464ddc906d84a7b153cb3d46798e
-
Filesize
1.7MB
MD5c44487ce1827ce26ac4699432d15b42a
SHA18434080fad778057a50607364fee8b481f0feef8
SHA2564c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
SHA512a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
-
Filesize
20KB
MD5e88dc675f71c2a4f0afa52c85fab9de7
SHA1d95a2fefc4bb90306079d000dfc1376d06736e17
SHA256a98df0af953cd3db95b2177eb71b8d11271ccdc165137a829608fd4c9f91bc69
SHA5126a48e55fd03b12596a9d50790c04ec37e0d2f20f633202ece1523e45773cdab36f033fe8bab8066df8da19ad1eb73f9aa8cc651deea806fd41de43069b227d02
-
Filesize
20KB
MD5472ee5a9b076aede5574eb747412cc8a
SHA1cb1541d2aad53309e82c44cb99c220e02bc219d2
SHA2567854d3d94db23ed7e453f30e4a5e302bea209b2ebb60b5554dbc78ac1caefe4d
SHA51222407550d8c602fc2f6c70a671ec948770f8df494e2613d66efb8625f75adaea8047d35931e97c6a841b786fca9b2922e805799f149b58f34c881e5605b8f86a
-
Filesize
3KB
MD5fd4589304a588a420da7dd0b56784130
SHA13a8267d2459cef2d9ea4d782eef8ec2876fbecaa
SHA256a3041b2a3f207ad2e467085b36ca51eae3a5d60f899251c9d5c4c9b248c60482
SHA51228aa740ab94e8643af5339e6cbc4af38cf68c58f76b163e4b2fc0875802889abb2689507e4bd15eab62c095c5d852ab54c200324179c0f804e8158c8c71c1a67
-
Filesize
84KB
MD53b03324537327811bbbaff4aafa4d75b
SHA11218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
SHA2568cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
SHA512ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
-
Filesize
3KB
MD5392c3b27af6755b705128fc738d77348
SHA11c23542f187fcff5aca60532fe6d30517e84c57d
SHA256ea920d619c25a834bdf2fe7c82d36be2150a530ec1f5215cda741b23d29823cb
SHA512901fe1a3ca757b2a883c49776ecda903b0fa521d584466416bcaa97ea83c2319692d399212cf9bf3c794df2e51ea8c452b120d944e6af139022097a800e3b072
-
Filesize
2.2MB
MD5696682f1a9d5efcd5cfe72adf2649efb
SHA163ac46cd91decfe85d57c4d3fba0cbb7124edb83
SHA256bfc7bd83edc3aacf0130900b63f2f2ee2ffeb961cf749719f09b68660381a2f0
SHA512d2b33184d1bfe2a050bf0050af24a5c28408b856dd73214d058ca23ddbf75b2edd44ed677d22c548768df897152c7cca5359ad8526e0a60c811221cb156c0529
-
Filesize
2.0MB
MD522c109d5539b862d629daa01673352cd
SHA12eed43bf7f139243d9ef93bf4ed0903ced8a08b5
SHA256f5a331009d6e46236036c2de3578f2a8414742271ed4b23496859c8b99f5c4de
SHA5123d251c3c633f24b1ddf7d1f5dcf8a2c8093c892c0a1e5577aec8dc01fcf50aebdc0d481c96f65d83dadd7a7873c2e8013761b16728bd5f6e3621977b2ae46bc2
-
Filesize
32B
MD5c241eda7e1143981d8cf780be372d33a
SHA19ed5184329f8f6c41740b69c5f7404ce4294dd35
SHA256b5b4a55f7a189862bcb90aeab4abf005a472598f79914b28d1e5a0cda0441b6f
SHA51219db4988951005449ee72e41646c21b9ffa3a9ab9b6ca8b51a624ffcb668a9456a0747bb5bb7360eeaf85110ede13b263d3e49e0341f0b9a48ed005fff255872
-
Filesize
1KB
MD530797274eff2ec1a2df9e81fa85b0047
SHA1d42a4b1c3d34f0de8003f61fc0a8ce893deee230
SHA256ca9c94e4dcc26ae2f596590fa7297bb2a4b74811ae88f57dadba8c9ffc79bb51
SHA51211a12c1f1048b65653e8cdfa4e96caf594dd18b89e8dcb34965ede7d14124f2296ac3a706b3d0e5ee1131b9cdfbe120e34f7938e12a84a4b2f7272deb62643f1
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5bd5940f08d0be56e65e5f2aaf47c538e
SHA1d7e31b87866e5e383ab5499da64aba50f03e8443
SHA2562d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
SHA512c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82