xworm | 90d2777179534bb5746559397a767aeee141f30a57b53c5d9c2122278b4bc4b7

Analysis

max time kernel
1781s
max time network
1794s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22-03-2023 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XClient.exe
Size

67KB
MD5

404dee8c8fe0b8c25ac39f60960dcbf0
SHA1

078b5427a3c29a2f410f0e09f667389ad630ed60
SHA256

90d2777179534bb5746559397a767aeee141f30a57b53c5d9c2122278b4bc4b7
SHA512

9d7c6c2cceff330acea030002c4c7fde0a9ebe4f6a94a035e6fd6f08d7f5fea407680e5acd5baef687a19f40e116c47e8615dd4f728bdac7636529665e83956e
SSDEEP

768:I9Zqr1TeXYQI9WFFTLmxVm2LXT8fbKQCQ/bm1f5Nc0Mrufk+NY1DT4sMOcPhoRcp:1r1g+wrXFfsybmtlMi2asMOasUbj

Score

10^/10

xworm evasion persistence ransomware rat trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/924-62-0x0000000000DE0000-0x0000000000DEC000-memory.dmp	disable_win_def

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	XClient.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

XClient.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\UnprotectMeasure.raw.ENC	XClient.exe
File opened for modification	C:\Users\Admin\Pictures\WaitRedo.png.ENC	XClient.exe
File opened for modification	C:\Users\Admin\Pictures\BackupInitialize.png.ENC	XClient.exe
File opened for modification	C:\Users\Admin\Pictures\ConfirmTest.tif.ENC	XClient.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertToStop.tif.ENC	XClient.exe
File opened for modification	C:\Users\Admin\Pictures\MountSuspend.png.ENC	XClient.exe
File opened for modification	C:\Users\Admin\Pictures\PushLock.png.ENC	XClient.exe
File opened for modification	C:\Users\Admin\Pictures\StopPublish.png.ENC	XClient.exe

Drops startup file 2 IoCs

Processes:

XClient.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	XClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	XClient.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

XClient.exe

description	ioc	process
File opened (read-only)	\??\Z:	XClient.exe
File opened (read-only)	\??\F:	XClient.exe
File opened (read-only)	\??\I:	XClient.exe
File opened (read-only)	\??\L:	XClient.exe
File opened (read-only)	\??\P:	XClient.exe
File opened (read-only)	\??\R:	XClient.exe
File opened (read-only)	\??\S:	XClient.exe
File opened (read-only)	\??\W:	XClient.exe
File opened (read-only)	\??\A:	XClient.exe
File opened (read-only)	\??\M:	XClient.exe
File opened (read-only)	\??\O:	XClient.exe
File opened (read-only)	\??\Y:	XClient.exe
File opened (read-only)	\??\E:	XClient.exe
File opened (read-only)	\??\G:	XClient.exe
File opened (read-only)	\??\U:	XClient.exe
File opened (read-only)	\??\X:	XClient.exe
File opened (read-only)	\??\V:	XClient.exe
File opened (read-only)	\??\B:	XClient.exe
File opened (read-only)	\??\H:	XClient.exe
File opened (read-only)	\??\J:	XClient.exe
File opened (read-only)	\??\K:	XClient.exe
File opened (read-only)	\??\N:	XClient.exe
File opened (read-only)	\??\Q:	XClient.exe
File opened (read-only)	\??\T:	XClient.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com

flow	ioc
3	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	XClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

596 schtasks.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1732 taskkill.exe

pid	process
596	schtasks.exe

pid	process
1732	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca00000000020000000000106600000001000020000000e97782d67fcc0e866e8ba45b23420deec2c12b10f9c5bc7567c69dfee2d7d4c2000000000e800000000200002000000029e75b017ee35dedb66a7e73a5063fd8bca2191b24ca53ae8203668b4196da732000000078c7c101f214b62d978a55cf86ea1dfa6ffe8366c242fa7922ea6caed4ade843400000001070d78ce2fb53f991dcbbc3690cf8b6a692a7854f44150cf21a4eed290e71e30aa5789cfe7da2af7c129ce1f134a6cc86d63d2ab64279efcd8538451c619afc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca00000000020000000000106600000001000020000000e3fdf04d5fb1605e2e048f5273a3ab405070eaefe3eaadd12fc71db01bc62463000000000e80000000020000200000003953df52f6f029bcaf66127fbb33bf7cc5aac56031396dcd48bee32bcc01973e90000000194625d70f1797e3a8655c2740b06d6a590bc9ea6f22841cb73a8518c450b1cdc8cc154bf9ebede1c25ed0c0c06c302f0bd671ccb9003d4e31de8f512f80ddb05d95fe7c297296da8efc499b87d7a0dd5d13b09bf3cfdb1f568b8d53890515989618bad7f6c58bce9ae854eaa35b4fcf42f389c66c0fc23d62fe811ead2ec7986227ebc6d008b644b01635e360ae26fc40000000bb71b0e43b7ed79dbe28d7aebd1461743c1e916b7d63a45535c93564e971dd27b2929b8682292aea0d20c430a95a775f2c491a00146427a363c49b67f5b49a7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E42568B1-C910-11ED-AE0F-DEF2FB1055A6} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0007abb1d5dd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386295967"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

XClient.exe

pid process

924 XClient.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

XClient.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 924 XClient.exe
Token: SeDebugPrivilege 924 XClient.exe
Token: SeDebugPrivilege 1732 taskkill.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeXClient.exe

pid process

1380 iexplore.exe
924 XClient.exe
924 XClient.exe
924 XClient.exe
924 XClient.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

XClient.exeiexplore.exeIEXPLORE.EXE

pid process

924 XClient.exe
1380 iexplore.exe
1380 iexplore.exe
908 IEXPLORE.EXE
908 IEXPLORE.EXE
908 IEXPLORE.EXE
908 IEXPLORE.EXE

pid	process
924	XClient.exe

description	pid	process
Token: SeDebugPrivilege	924	XClient.exe
Token: SeDebugPrivilege	924	XClient.exe
Token: SeDebugPrivilege	1732	taskkill.exe

pid	process
1380	iexplore.exe
924	XClient.exe
924	XClient.exe
924	XClient.exe
924	XClient.exe

pid	process
924	XClient.exe
1380	iexplore.exe
1380	iexplore.exe
908	IEXPLORE.EXE
908	IEXPLORE.EXE
908	IEXPLORE.EXE
908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

XClient.exeiexplore.exe

description	pid	process	target process
PID 924 wrote to memory of 596	924	XClient.exe	schtasks.exe
PID 924 wrote to memory of 596	924	XClient.exe	schtasks.exe
PID 924 wrote to memory of 596	924	XClient.exe	schtasks.exe
PID 924 wrote to memory of 1380	924	XClient.exe	iexplore.exe
PID 924 wrote to memory of 1380	924	XClient.exe	iexplore.exe
PID 924 wrote to memory of 1380	924	XClient.exe	iexplore.exe
PID 1380 wrote to memory of 908	1380	iexplore.exe	IEXPLORE.EXE
PID 1380 wrote to memory of 908	1380	iexplore.exe	IEXPLORE.EXE
PID 1380 wrote to memory of 908	1380	iexplore.exe	IEXPLORE.EXE
PID 1380 wrote to memory of 908	1380	iexplore.exe	IEXPLORE.EXE
PID 924 wrote to memory of 1732	924	XClient.exe	taskkill.exe
PID 924 wrote to memory of 1732	924	XClient.exe	taskkill.exe
PID 924 wrote to memory of 1732	924	XClient.exe	taskkill.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

XClient.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\policies\system	XClient.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	XClient.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XClient.exe
"C:\Users\Admin\AppData\Local\Temp\XClient.exe"
1⤵
- UAC bypass
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:924

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
2⤵
- Creates scheduled task(s)
PID:596

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1380 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:908

C:\Windows\system32\taskkill.exe
taskkill /F /IM explorer.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\system32\taskeng.exe
taskeng.exe {71494B19-82D8-43D3-B0A9-AB6503E130B0} S-1-5-21-3499517378-2376672570-1134980332-1000:MLXLFKOI\Admin:Interactive:[1]
1⤵
PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
b2ff91fbcd6658a16f88329a28879937

SHA1
b7c6aae816f8bf2396bf3f70692069ab84ed4bfb

SHA256
c09828ee617837f0bf86cec1c815b83c564916c398f9b54ef0996f4a39f4c4d5

SHA512
b41502937af2b340147eba340414c871825b7178a504566d0a809fdb9012881e4118c05ccf7a10ef537c1fcff1ddc5a03a271e188f83a54b8f01a02a8010640c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
070bce231fe617b18a67926f142ac9ad

SHA1
31953039931096ce10f533b8bacfeb9eb893ab11

SHA256
07d6af575e288c1ab82ec8d0df031b1487963d4054b3cdd0714f51b266362a36

SHA512
1cce83e6f3648bdb8dcd59743197b3068e0ad123326b83ecf52b6fe3da6c816fb8745694ce15290e815b2712333d2a45e8dd4eda6ab807cb4c776f96bc35695c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
bfead9c06e2e432397f654fb4cc6a9e7

SHA1
c2b179c3d613755fd08a4c4914b21d5b83f7feb8

SHA256
2f9db57049af25358a14ee0f8064ac3d6ef51e41013082b48e9fbba4ec55696f

SHA512
b24b9ee03d09359e3494fdb03d2ab2e16cada3f1711206c8ab510a64ae8ada805bd8bf7b8a7b9e54ac506eb18980267541946d82b49ba1c9a4d22aebf5552b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
709937bad3a819aaf6542d6a717cfe07

SHA1
b5db520b46d8f6af881b621ca8a6a99522679f73

SHA256
545b42a279297d52832d39762659c7154f4b53e5fc8b2518d2036ac753294371

SHA512
33ecccbfe27621c81b4a58ef7fe9a36adc5e0275903ee0b867c6b15aaf1fce30db111d24c5e6e01f6d57a312dbfbe5521b0ad6b3af7a58b1a78120c3694fc050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
4a6b1c2a79398b194974717e7f06a9fc

SHA1
27572322620ba5f3a2f177045347bbf703a35d7b

SHA256
a4d615a7b0dc12f48f078279594646106da4f8186bc1079c8e6308d4c3013f34

SHA512
692c663d65b20d4fec19ea2bd5b3004090ee962023ee8308916e0dd0a915f5db931361f8513af9187dabc2a483c0c5c8c5eb14183c20647b1c068a3ffd9f2c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
0df3a3c74a77cc80beca8e3ca4fad06c

SHA1
c398aa52013398ddb200f67ba6eba1fa208bba40

SHA256
9513975362c4e15cc358a1a5dfd89d7040f1da9a237e140dadddbb7af00ea792

SHA512
9d26088c93440be827c2e2a5f13f1685a4593853110d46135e4ce825d60a10815586602c69097536361e79d36f1653e46b2f8f95581f1005c3c7dd3cf5afcee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
8dd9efbf259a6daf5ca7023753c5ecd2

SHA1
0233892a56c41a65d055a765e14b7761c38ffcf3

SHA256
8fecf2ede32471f7844c78e56bce6d4a6b340f3a96a7a79c2daf14a62ec844f3

SHA512
b7b79a132f82610d3e8fd8d9fb2f6af7fc8488555dbbecd91582e33c5b4e2faf8f1e0312ea76a763e0eb0b5cd75c3a4181346038ef8d12ef4bd99f7d8d2a1f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
503468bc942a8adf6fa267b976408a46

SHA1
66deddfc41de1fddf93974ea8f4fb8e01c9c03b2

SHA256
1fd92506ae37f3665a9e85b932f32b6f1048be6be788dcbd837ff2ec4226857e

SHA512
6afb1a91cb22b55c84bd8a988be33108e5a5ac3332b5a3e7dd77f48f09c91145c3a517b9643c3a569f012336fa37e10852663cb8193e3fa8c1f0bcc1828907df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
3a57244fc01656614955c8e16ccef125

SHA1
4a2e39cc60b9e45417f470372a76d135e71c2043

SHA256
fb02cce8cb220895e3108326ddea348ee563564c6f1529321427cf61b5845382

SHA512
bcb92bc8c0468904d3be87f829ae3b4e0d762153bf6a3e92f1a20093fe91e86eb21473690a0c1d7077cc8c38f8e103eaaf221d3b9855dbbd7854cafb5bfd15de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
a9db48b988cdbc60cc0e8a5e984a1ace

SHA1
28cdcd1cf6a7a7b478c1a8c6a2da0d4bc712d760

SHA256
0ad91edd64f4d90d8d8585af9d8151cd690b2cb0291f1fc07ab23c2366d4458b

SHA512
67074d680a6574ad165ec7bbf2522dac804639ed8bf0671d08fb9a0fa4bd796e4a3a8396090e95243a99ee54e1d97d012fa46e028b512f1130d1c937fc3c1b20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-US
Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2197.tmp
Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22A9.tmp
Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6WI15071.txt
Filesize
604B

MD5
79cda2e54ccad6baf04a2d5a47159558

SHA1
205d244be66331d05d4cd4014f60458df7efd5ca

SHA256
f7f1c966eec5403972bb1270a47da0b0df9c4e14d79f6b33870b6b2f70de53fa

SHA512
c5387cda7e8010669ad05782990ea648972d648b17eed323d7cf7bd63d31cccc3607d9a11de987f184f58d57c399f86a26c2c3f499b01f37465db51370acc81c

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html
Filesize
723B

MD5
553cf6c7e10d1c701098d7e1d0a01839

SHA1
3cbdf41c6d02de51754a2696a382485be5175771

SHA256
bfbb59fa451071b37088b6286c3e5941f2536c4d9a1b77c1c6e987da9545b6ae

SHA512
591ace58027c743e663598f29857e3fa52e47e5a015dfb5e46570fcc563b623306b6e9de5df0aed2f5242c7ae88178aced6c909ec3b8c075b5d7239922d3183c

Download Submit
C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC
Filesize
16B

MD5
24b6c0f49c7b8093b45cfe896e243169

SHA1
8de53659db01736f5b6b8d0eb5f90f497d409823

SHA256
a5cc4c7d7eec0f11d4555b5fa93dce571574d34cf5ee0bbede4509e890f7940a

SHA512
bd2140f6c627a43c5ff0df43a993aaee42befdf1698460ff614b432dc5cd83996cab9d8d505375cea563cc37cbdf1a27b3ba7ef70ae02812795619acb16227ae

Download Submit
memory/924-55-0x000000001B0F0000-0x000000001B170000-memory.dmp

Filesize
512KB

Download
memory/924-54-0x00000000013E0000-0x00000000013F8000-memory.dmp

Filesize
96KB

Download
memory/924-59-0x000000001B0F0000-0x000000001B170000-memory.dmp

Filesize
512KB

Download
memory/924-61-0x0000000001240000-0x000000000124E000-memory.dmp

Filesize
56KB

Download
memory/924-719-0x00000000013D0000-0x00000000013D1000-memory.dmp

Filesize
4KB

Download
memory/924-720-0x000000001B0B0000-0x000000001B0BA000-memory.dmp

Filesize
40KB

Download
memory/924-62-0x0000000000DE0000-0x0000000000DEC000-memory.dmp

Filesize
48KB

Download
memory/924-63-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Filesize
48KB

Download