xworm | ae045f8e36db8f38af35258127ff43a71d522ae6ad15b7aad527bf75dd7a7666

Analysis

max time kernel
1592s
max time network
1595s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23-03-2023 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LbsClient.exe
Size

63KB
MD5

762f2fc17465058d27010124bb425202
SHA1

1b6b701c9c09128886e4676c4f1e534c7db39ad9
SHA256

ae045f8e36db8f38af35258127ff43a71d522ae6ad15b7aad527bf75dd7a7666
SHA512

329eacc85396f176fb30989f8d85fbeea097388ab37edecf22c3f4f368c1b0b0106cc7ec5c5ad06abbe488868ce4a5731ab04e4e7852a3d37bb1bdc42bb4e932
SSDEEP

768:8FfQVS7rGOe01ZDKMFiw7qyignMEOoCenkHubK23vuEBXKZ7ifudOPJhsAjDOep:Yfo/mKM1qrgnqebKivpaV0udOR3us

Score

10^/10

xworm persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

ways-examining.at.ply.gg:18120

Attributes

install_file
USB.exe

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1468-1238-0x000000001ADF0000-0x000000001ADFC000-memory.dmp	disable_win_def

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Modifies extensions of user files 9 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

LbsClient.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\AddPush.tif.ENC	LbsClient.exe
File opened for modification	C:\Users\Admin\Pictures\CompressInstall.tif.ENC	LbsClient.exe
File opened for modification	C:\Users\Admin\Pictures\ReceiveInvoke.raw.ENC	LbsClient.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertToRequest.tiff.ENC	LbsClient.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeExport.raw.ENC	LbsClient.exe
File opened for modification	C:\Users\Admin\Pictures\RemoveConfirm.tif.ENC	LbsClient.exe
File opened for modification	C:\Users\Admin\Pictures\UnblockUninstall.png.ENC	LbsClient.exe
File opened for modification	C:\Users\Admin\Pictures\UnlockLock.raw.ENC	LbsClient.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertToRequest.tiff	LbsClient.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1036 cmd.exe

pid	process
1036	cmd.exe

Drops startup file 2 IoCs

Processes:

LbsClient.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LbsClient.lnk	LbsClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LbsClient.lnk	LbsClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

LbsClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\LbsClient = "C:\\Users\\Admin\\AppData\\Roaming\\LbsClient.exe"	LbsClient.exe

Drops desktop.ini file(s) 13 IoCs

Processes:

LbsClient.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	LbsClient.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	LbsClient.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 ip-api.com

flow	ioc
3	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

LbsClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	LbsClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

LbsClient.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LbsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	LbsClient.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

364 timeout.exe

pid	process
364	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

LbsClient.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	LbsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	LbsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	LbsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	LbsClient.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386340790"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F9DCF31-C979-11ED-80CF-D6914D53598A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e200000000020000000000106600000001000020000000071daa10f01af15b3e1c674a63c7ead286e7cec2e04af6318ee8b4a916389b42000000000e800000000200002000000046423adb1101d5f4f0a66391265afed009d3b89f60eec5e4fa88d322effa1fd520000000f5fa0bcbdf43f1fc8087b7b96965006c805897702154494ed45b7c3daf8294604000000009a2b2feb177322b02dd414f2daffed103f7b883f335dc48e00254bd5516c3820d4a1ce6fff297ca179566e692070e3e0043517635b32b011de3bfa3e99954fc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900fe01b865dd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007837404bb2ac374381d657b4bfd4f9e200000000020000000000106600000001000020000000edcc6493988bee762cb34a84553b942eed504b5e2c1193881c202d3058c7da60000000000e800000000200002000000013ff4050a66d8dede9cb316aa043f12f1c8c3ab0a60856d0743b362b15539c2a90000000f89da0ba3cc341866bd1024713af7adc68ca33ad6eb0afe77a131d003aae2769ec8fc5bc275f3cd1a9b5c8b3313066e2d2bc18c610c6c2b98759eb24af76b04a2426e51856c18628e1b7323dc728519834f0761336def0f80c37ee4922a444f8353d762382eb2654714261b7fc09c2ae5ac9719ff99d60f60e713371a88d3367ca47d317c61e7329225a3f6ac5ec6a2240000000e6233c1de54d1c1eece53e0e715f1eb8f482108fa82dce39500aac7a1f390c2027d8ddc5cc4761300c66b363068229f348ae3bcadc8aa55333e164e5b79bda79	iexplore.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

LbsClient.exe

pid process

1468 LbsClient.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

LbsClient.exe

description pid process

Token: SeDebugPrivilege 1468 LbsClient.exe
Token: SeDebugPrivilege 1468 LbsClient.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1580 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

LbsClient.exeiexplore.exeIEXPLORE.EXE

pid process

1468 LbsClient.exe
1580 iexplore.exe
1580 iexplore.exe
1400 IEXPLORE.EXE
1400 IEXPLORE.EXE
1400 IEXPLORE.EXE
1400 IEXPLORE.EXE

pid	process
1468	LbsClient.exe

description	pid	process
Token: SeDebugPrivilege	1468	LbsClient.exe
Token: SeDebugPrivilege	1468	LbsClient.exe

pid	process
1580	iexplore.exe

pid	process
1468	LbsClient.exe
1580	iexplore.exe
1580	iexplore.exe
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE
1400	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

LbsClient.exeiexplore.execmd.exe

description	pid	process	target process
PID 1468 wrote to memory of 1580	1468	LbsClient.exe	iexplore.exe
PID 1468 wrote to memory of 1580	1468	LbsClient.exe	iexplore.exe
PID 1468 wrote to memory of 1580	1468	LbsClient.exe	iexplore.exe
PID 1580 wrote to memory of 1400	1580	iexplore.exe	IEXPLORE.EXE
PID 1580 wrote to memory of 1400	1580	iexplore.exe	IEXPLORE.EXE
PID 1580 wrote to memory of 1400	1580	iexplore.exe	IEXPLORE.EXE
PID 1580 wrote to memory of 1400	1580	iexplore.exe	IEXPLORE.EXE
PID 1468 wrote to memory of 1036	1468	LbsClient.exe	cmd.exe
PID 1468 wrote to memory of 1036	1468	LbsClient.exe	cmd.exe
PID 1468 wrote to memory of 1036	1468	LbsClient.exe	cmd.exe
PID 1036 wrote to memory of 364	1036	cmd.exe	timeout.exe
PID 1036 wrote to memory of 364	1036	cmd.exe	timeout.exe
PID 1036 wrote to memory of 364	1036	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\LbsClient.exe
"C:\Users\Admin\AppData\Local\Temp\LbsClient.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1400
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpA16E.tmp.bat""
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:364

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23a2dd4e6b076bf3e9ef7d315ca503cc

SHA1
0948e737e57c6427ca0529a19bbaf70b0b341258

SHA256
82db8b53ba2bbd94980ecd39d0f9ea7a6f5df50fae90fea99b23f12cb4a2e216

SHA512
4df4a9a7c913a5742fd6846a017d3c8bc31a9deb41c587afed7367c9bea78bcf8084689a20226aafed17ec2535fb5fe3f8c278eb6ecf0ce3d34e8356937127af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76bbfe500e18ed5da1d8dd538385b47e

SHA1
32218ea28c00261e962e630f39253a07b1a983c1

SHA256
27663b3b3edefcf74100e93808eca16ff0887bc223bbf8bbb669555ba2325783

SHA512
f252c20a205b7833c3e2231d09f8f1b19e00c4050092ea26245020ddef822c4fc5a5e3b21a43e2a90ccceb585ab7714213ba572a6b9250cd22a6ac8d844c8485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
950ce0986db78f1bd8cccad057afd901

SHA1
df93984b97f1f5f67086bbc414239e7b9e10f18b

SHA256
ba2741ac40effa661db334dbbdb121ea0d823753d772213ba966d3cac4546445

SHA512
5121b3583b10b3a95e81806f6af9ea5da0448e478907081d3dce24007cc13e5abb1c3e85f7061938800cc1ba6a8d9fcc1cac0f43a7cb6c5682840cc0373a5226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da85865bd58b6519b521db54675debbe

SHA1
5d6c7b3dd80d9a183d8c0f725c619e246b1f257a

SHA256
3dcfd6600f6160a0a66b6eb2f5e44d0579087b6e06aeb101dbc3c353216aeeec

SHA512
e9efe48370b8c39efa668b826367a5f8b83a092905cc2aed4f31a94db318a5e6babceb373565e32c31b58005a2f110862b71e31f36436fc1094403f0f54fc5a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19f523bb89a95f7d477ed92756f30a10

SHA1
ecd746c6a74c1b08560a9fccaf313d87bb530b86

SHA256
d7525503bbb8ad9a9b0fccbe7a58b8cb058ebc73166bc3596d5b86df100b4cd7

SHA512
6fd16be947d32ccc0333faa9c9a5bf2606cb69f11de086bbc737cabd09a74c8aabd7e0e04fc6c545bece8ac7e771df78105111223f2baf3e834434f8c9fb927e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aada5bd705867ab0146d2e8500eb27b

SHA1
14a97b6ef1247551eb7042ca4680ef7df8ff80d7

SHA256
8d56c6d00965d84642fafea4af34311b82d0e2799b9f2476eda279ec33e13dca

SHA512
eb07fdce04d07797b7a20d92a39cedf3a4944b785a24f9f1f72f6462096888ad448ac3c61bf06bf2f63b645f0617ff737434c9cdc1ef534eff9dc47dbdde9577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
addac61ca5a5542d1dc4a94b740efca2

SHA1
96fde085a1356a21267c8a8df0d8fe2090c4ea69

SHA256
d38c19f782185803992342041291d94caf5c6fff545b1c2530395f0c6b9165a8

SHA512
478c6925506abc276b4c1efe17a96b5a28fe7f9efb49b1e51fec76548cb082e2556b88488deb507d217920ff083b6eba1b03f01c20cf7ea52cd62d01788ea9b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97a1c8740ad843b55d0100354dc0660c

SHA1
beb3273a45ec302e4853e2d3ddf5c84bed4c3a7d

SHA256
87b2d3cc297551f3ac387d36bf31adb98f0b9c4514e66c5a1af00e459c46f328

SHA512
797b0b60dbddb75afa7fc6160c68624400a92b4bf5f355ef20d71069cd4044479e3b51c23654d5e0b2c6f3022d59847a2bb35f6b8ff0641706c1d7295d39a9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOYUJSME\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD05D.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD495.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB01.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA16E.tmp.bat

Filesize
161B

MD5
ca0efff653065e568245bf8e53324200

SHA1
f1a3bf3fede6c10bd40c42ca0764f4552e226436

SHA256
2d375d85075bd562d2424edf096c5dfde275a1bd5ca2b22bda68a6a7bac108c8

SHA512
3826bd71d01a71f3b821bae0622808b42610406fda1ff10aa4bb5fed4db69dfb4bfc1ff20277de676e5e55a4aef9163d206f704c45ad536913cba73847f2385b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA16E.tmp.bat

Filesize
161B

MD5
ca0efff653065e568245bf8e53324200

SHA1
f1a3bf3fede6c10bd40c42ca0764f4552e226436

SHA256
2d375d85075bd562d2424edf096c5dfde275a1bd5ca2b22bda68a6a7bac108c8

SHA512
3826bd71d01a71f3b821bae0622808b42610406fda1ff10aa4bb5fed4db69dfb4bfc1ff20277de676e5e55a4aef9163d206f704c45ad536913cba73847f2385b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9BFERCD8.txt

Filesize
601B

MD5
419981bce7ccadad11934d9d34addc08

SHA1
8e3a13d9b049a2884a70b98611377671d1becb86

SHA256
766073af2ba3771ef021edf32b9af38bbf2723fd136c7f15a18e4dc883678cee

SHA512
4fcbbc4984bd0b5eadf42623a76ba0414844ccf86cc6d2056528b7c8f6c16b4dfadfa6dd93f861d997e02b0a43ee37bc099c521445bd070844520af60ace715b

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
721B

MD5
6c5a8ad499d266587d6c1d3aef66d121

SHA1
b096729bf4e9115391776bb09c6d676f1287111d

SHA256
a4acf18ce9e6fd576d84db4f3717e8d09281e78db8aa3aad4c85b7106f38de31

SHA512
bc4d4b2d4d5b4030e7f309a956e38da88578ec45326aaa4b3e27344314375a542b5c330eccd8068c9145549f7ea1de41f49d5ed557799f0227ca301b25c14624

Download Submit
C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
7de123abd52f05d35c662e1b2fac960d

SHA1
0cb58d891e5b98a88d699ce6e57b9e1085a266ca

SHA256
c3473be1c9bd18644c928e490b5e1a0026fe252202380ea8515ece50e4374912

SHA512
0fa390845044938b2f7fabd6d9c7d734698c655af197b361c592305134ddb5fc97045d7b6ede4cb6e21d7c64a394e1f566be7049e3e618a90628f556bac44154

Download Submit
memory/1468-1206-0x000000001ADD0000-0x000000001ADDE000-memory.dmp

Filesize
56KB

Download
memory/1468-54-0x0000000000380000-0x0000000000396000-memory.dmp

Filesize
88KB

Download
memory/1468-55-0x000000001B390000-0x000000001B410000-memory.dmp

Filesize
512KB

Download
memory/1468-59-0x000000001A700000-0x000000001A70A000-memory.dmp

Filesize
40KB

Download
memory/1468-1237-0x000000001ADE0000-0x000000001ADEC000-memory.dmp

Filesize
48KB

Download
memory/1468-1238-0x000000001ADF0000-0x000000001ADFC000-memory.dmp

Filesize
48KB

Download
memory/1468-231-0x000000001B390000-0x000000001B410000-memory.dmp

Filesize
512KB

Download
memory/1468-61-0x000000001A730000-0x000000001A73C000-memory.dmp

Filesize
48KB

Download