xworm | ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ya.exe
Size

63KB
MD5

222c2d239f4c8a1d73c736c9cc712807
SHA1

c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
SHA256

ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
SHA512

1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
SSDEEP

1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W

Score

10^/10

xworm persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

127.0.0.1:23638

209.25.140.1:5525:23638

bring-recorder.gl.at.ply.gg:23638

action-yesterday.gl.at.ply.gg:23638

147.185.221.19:23638

then-wheel.gl.at.ply.gg::23638

then-wheel.gl.at.ply.gg:23638

teen-modes.gl.at.ply.gg:23638

Attributes

Install_directory
%LocalAppData%
install_file
uwumonster.exe

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000B00000-0x0000000000B16000-memory.dmp	family_xworm
behavioral2/files/0x00080000000233d6-9.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\International\Geo\Nation	ya.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk	ya.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uwumonster.lnk	ya.exe

Executes dropped EXE 2 IoCs

pid	Process
1948	uwumonster.exe
628	uwumonster.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uwumonster = "C:\\Users\\Admin\\AppData\\Local\\uwumonster.exe"	ya.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	ya.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3188	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
5056	msedge.exe
5056	msedge.exe
5140	identity_helper.exe
5140	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5112	ya.exe
Token: SeDebugPrivilege	5112	ya.exe
Token: SeDebugPrivilege	1948	uwumonster.exe
Token: SeDebugPrivilege	628	uwumonster.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe
5056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3188	5112	ya.exe	91
PID 5112 wrote to memory of 3188	5112	ya.exe	91
PID 5112 wrote to memory of 5056	5112	ya.exe	118
PID 5112 wrote to memory of 5056	5112	ya.exe	118
PID 5056 wrote to memory of 1892	5056	msedge.exe	119
PID 5056 wrote to memory of 1892	5056	msedge.exe	119
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 996	5056	msedge.exe	120
PID 5056 wrote to memory of 4828	5056	msedge.exe	121
PID 5056 wrote to memory of 4828	5056	msedge.exe	121
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122
PID 5056 wrote to memory of 3876	5056	msedge.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ya.exe
"C:\Users\Admin\AppData\Local\Temp\ya.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "uwumonster" /tr "C:\Users\Admin\AppData\Local\uwumonster.exe"
  2⤵
  - Creates scheduled task(s)
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb9e846f8,0x7ffdb9e84708,0x7ffdb9e84718
    3⤵
    PID:1892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
    3⤵
    PID:3876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:5232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:5792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,14424804193595061350,8263082123354921339,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:5800

C:\Users\Admin\AppData\Local\uwumonster.exe
C:\Users\Admin\AppData\Local\uwumonster.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Users\Admin\AppData\Local\uwumonster.exe
C:\Users\Admin\AppData\Local\uwumonster.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\uwumonster.exe.log

Filesize
654B

MD5
2ff39f6c7249774be85fd60a8f9a245e

SHA1
684ff36b31aedc1e587c8496c02722c6698c1c4e

SHA256
e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

SHA512
1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4b1b76514dea893fa15dfa655c25146

SHA1
fabd41a529326d6d5492e46a4b25cc59c28f798d

SHA256
27f7bc04d2e310a1c7aa27370a2242ad2a38d4bf8d9b2f515a13fbb39e967130

SHA512
0e4e98b8b866456e6e0bb9caa01129dd18ab6f9abc1c514cdeefbd5c2894508f38c4259c8c942e5575ed99df40b1488dddb87d198ad8e5fc281caa5c774168e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
72efa24c5d4241de2199b38e9114f121

SHA1
265a4ef6cdd5e6c96d24b38fe7d15730efb41991

SHA256
8404a1a7171542ea112384ed0a130f341e5c3118fd765bf36491da02257f60e9

SHA512
aa0c9798354d0c73362a46edc2e237a83851a504acd7caf872568d85db1466dce5bdac18023a0199f2b7b7e77cf920bcee510fe940eda7c362a6e6f7bfbac189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a7e9c282-b903-4928-b66e-bf003016b851.tmp

Filesize
11KB

MD5
e4601408fe886a7d290e2d60faea675c

SHA1
7c89cc39dc5645cbaacc479bf6910c88b330b5dd

SHA256
74adb3321ea3aa535de79e0ded937de7ccac40d21b3ba00a3e0237f21b912c81

SHA512
321becf9abaa52344e11cd3a5cc0bc83f0d2ae0f653ff2de561373a62aa7bf49a785fe178f96ed18c08244f07bced0bcd31d301e5347c843717f31908f24aa66

Download Submit
C:\Users\Admin\AppData\Local\uwumonster.exe

Filesize
63KB

MD5
222c2d239f4c8a1d73c736c9cc712807

SHA1
c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c

SHA256
ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d

SHA512
1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
d4c9f953da4d669882e4f3d98f5e98b9

SHA1
438a9462e920dfa41fa4654ba432916512df28ff

SHA256
acdbf74ca896f92641dae85451e895f5d46dcc3a5aa67134de20659ce8cd85ec

SHA512
204ade2295cc7ab895c586ba6044a8a7338891f5dbfe70999106d65da76032ed48d306ec97f4b14a8b45b0bd97ff0bc4fb4c45da48ff26068329220d8c8d8b5a

Download Submit
memory/628-173-0x00007FFDC12A0000-0x00007FFDC1D61000-memory.dmp

Filesize
10.8MB

Download
memory/628-17-0x00007FFDC12A0000-0x00007FFDC1D61000-memory.dmp

Filesize
10.8MB

Download
memory/1948-13-0x00007FFDC12A0000-0x00007FFDC1D61000-memory.dmp

Filesize
10.8MB

Download
memory/1948-11-0x00007FFDC12A0000-0x00007FFDC1D61000-memory.dmp

Filesize
10.8MB

Download
memory/5112-19-0x000000001C1E0000-0x000000001C1EC000-memory.dmp

Filesize
48KB

Download
memory/5112-18-0x0000000002BE0000-0x0000000002BEC000-memory.dmp

Filesize
48KB

Download
memory/5112-0-0x0000000000B00000-0x0000000000B16000-memory.dmp

Filesize
88KB

Download
memory/5112-8-0x000000001B730000-0x000000001B740000-memory.dmp

Filesize
64KB

Download
memory/5112-7-0x00007FFDC12A0000-0x00007FFDC1D61000-memory.dmp

Filesize
10.8MB

Download
memory/5112-6-0x000000001B730000-0x000000001B740000-memory.dmp

Filesize
64KB

Download
memory/5112-1-0x00007FFDC12A0000-0x00007FFDC1D61000-memory.dmp

Filesize
10.8MB

Download