xworm | d5965f21df0867fe7d0885a006667390d61b55f6d5ff6ad706a021bf0ebf13ea

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
__3GqLWGmDyooI5CmFz9ril.exe
Size 179KB
Sample240613-2l5dcaxcnl
SHA256 d5965f21df0867fe7d0885a006667390d61b55f6d5ff6ad706a021bf0ebf13ea
MD5 d0a1aba3a5d89c7fd422c6d2b58a4582
SHA1 ed0acc42e8623999d0313758e6c751161892b138
SHA512 351e5b390876d870a8979e6efee38ce6aa64387ff225dcfd94a523c659220a3e4ce56c5727c2d8f8ccbc169f896d9642ab0e058adad2f4bc1d36e2be4892c06a
SSDEEP 3072:lAehwR7Bt4Wu/6TuLD79EeZwTo6BxzQFs3YzWADlKjNl3UKRj2NwP5KMmw0/Ur0E:lEvtg/fz9E3o6Bt3OL5YamPLmwJ4Rr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

astaaa.ddnsfree.com:1177

Mutex

WtJQOp11bCLfrAjG

Attributes

Install_directory
%ProgramData%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000800000002344f-16.dat	family_xworm
behavioral2/memory/3308-24-0x00000000002C0000-0x00000000002CE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	__3GqLWGmDyooI5CmFz9ril.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Host Display Windows.lnk	System Host Display Windows.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System Host Display Windows.lnk	System Host Display Windows.exe

Executes dropped EXE 2 IoCs

pid	Process
448	__3GqLWGmDyoI5CmFz9ril.exe
3308	System Host Display Windows.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	System Host Display Windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe
4848	msedge.exe
4848	msedge.exe
3688	identity_helper.exe
3688	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3308	System Host Display Windows.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 448	4356	__3GqLWGmDyooI5CmFz9ril.exe	81
PID 4356 wrote to memory of 448	4356	__3GqLWGmDyooI5CmFz9ril.exe	81
PID 4356 wrote to memory of 448	4356	__3GqLWGmDyooI5CmFz9ril.exe	81
PID 4356 wrote to memory of 3308	4356	__3GqLWGmDyooI5CmFz9ril.exe	83
PID 4356 wrote to memory of 3308	4356	__3GqLWGmDyooI5CmFz9ril.exe	83
PID 3308 wrote to memory of 4848	3308	System Host Display Windows.exe	94
PID 3308 wrote to memory of 4848	3308	System Host Display Windows.exe	94
PID 4848 wrote to memory of 2452	4848	msedge.exe	95
PID 4848 wrote to memory of 2452	4848	msedge.exe	95
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 1740	4848	msedge.exe	96
PID 4848 wrote to memory of 4692	4848	msedge.exe	97
PID 4848 wrote to memory of 4692	4848	msedge.exe	97
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98
PID 4848 wrote to memory of 4868	4848	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\__3GqLWGmDyooI5CmFz9ril.exe
"C:\Users\Admin\AppData\Local\Temp\__3GqLWGmDyooI5CmFz9ril.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Admin\AppData\Roaming\__3GqLWGmDyoI5CmFz9ril.exe
  "C:\Users\Admin\AppData\Roaming\__3GqLWGmDyoI5CmFz9ril.exe"
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Users\Admin\AppData\Roaming\System Host Display Windows.exe
  "C:\Users\Admin\AppData\Roaming\System Host Display Windows.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe2eb46f8,0x7ffbe2eb4708,0x7ffbe2eb4718
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,7511129443119100553,9405838462214275745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      PID:3876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f
MD5 3a09f853479af373691d131247040276
SHA1 1b6f098e04da87e9cf2d3284943ec2144f36ac04
SHA512 341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e
MD5 db9081c34e133c32d02f593df88f047a
SHA1 a0da007c14fd0591091924edc44bee90456700c6
SHA512 12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4039b270a87962a391ca0ce60603558e457f070e4bc1597a7726980f8b4b94ba
MD5 8c60c0149a19d68ba480bfe1c83ae895
SHA1 2622084046980a73c198bce9e6540607a7e193e6
SHA512 73dabd95bbade4ce6f9b314d4f4022ed51ceb666974a43feb79746761284d5754ffd4a528f22aa9e9647b2767cf937271ee6e15b46b67d9116cabb444d82f73c
SSDEEP 96:nvkjoxm/DQYmqk10ftW/wpvWMoiVmdeHgiivUWQyV+VDCziEwb:nvkFI7GYGWMXivro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5313173638ccae38280af3535340dda2e72a72aec133c4952c7516585c3b6874
MD5 7bd634c1ebeb9b32b8e16546a0c708c8
SHA1 9dee9dc51298942c287d1efe3603be4326939aea
SHA512 c93714df7f5b2d267d984bc0bd719a922c398b8d015b522aa7cafbee920d6175a97922ae3b2ed7579e6a8cf2fba2411009aeeabbef6bfa0fb2c55385ae0d4b8d
SSDEEP 96:nvkVoxm/Dnmqk10ftW/wpvWMoiVmdeHgiivUWQyV+VD7AiEwb:nvkf67GYGWMXivrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 59f2458d8c49f0ff099f38386a0986df9d3c709eaa9e2d0d701c5b0b8cabeabe
MD5 d0c5a0d1dacabbbad7ee0be7484bf22b
SHA1 1fc9868fa5e9bda2b49296d718993a76f3510988
SHA512 64689d5aadb1f114c54117e372bf4d8bffd7032e11f1ad1ca1c64fb0fd7c3695b8433c74b06a20f1465e0f8fd9fc3abdf164adb1cf5337ce1064028c75d81470
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwAe2RUUh2kx3z2OMDCRHqT:A9iIxuERzA83h09RZxYwebpxaOMWRHqT
MD5 SHA1 SHA512 SSDEEP

Submit Download

System Host Display Windows.exe

Path C:\Users\Admin\AppData\Roaming\System Host Display Windows.exe
Size 31KB
SHA256 b9c0b23ad7bc8b077202ea84b40a222dafa3f7e14301ad5986d0f06eb3eed232
MD5 8d582279b551f8a6348c45410fff73e0
SHA1 10244d856cae5095c16a3f1fd14bd84e5bc52cdd
SHA512 1ddb9744f034f10e84b2da515b90b5ba7e65649cfad259ebc38edd19cd4b800177d8374779a3127d189ecca162fde2bc5268daf0e95c5d3c6e0e53ee15c6a1e1
SSDEEP 384:UuTNqCr4TOXqMkc7qiPRr49hL5zwDs2ETIiJ5R+gtFqBLTiZw/WNCvK9IkVuhfxT:1k2lUD5EePJ5ZFr9RgOjhn/3vK
MD5 SHA1 SHA512 SSDEEP

Submit Download

__3GqLWGmDyoI5CmFz9ril.exe

Path C:\Users\Admin\AppData\Roaming\__3GqLWGmDyoI5CmFz9ril.exe
Size 136KB
SHA256 d307829b6114eb9fee109cd80558e82f8fd9a9f46358970383d8923ad1571a06
MD5 fe290365e805cfb02c441cc2f4b5f7cc
SHA1 63ffa75eccc18a3a607e7bac81d57ba01fff3127
SHA512 0cb75be26ca7421f15fbc11e5ef28c4ba7d38b2784240ac635a4a0ee196defdf908f4049a054fec15ef5aa7893b9300ddcb758d67b29dfdbd8b205824e066f82
SSDEEP 3072:s0QRKibYWwzFR0n1MN/jalZ8+5wbeThp1Ximaz5yvGO:bQwnFRyWBjyZ7EI1XEzwvGO
MD5 SHA1 SHA512 SSDEEP

Submit Download

How To Decrypt My Files.html

Path C:\Users\Admin\Desktop\How To Decrypt My Files.html
Size 723B
SHA256 bfbb59fa451071b37088b6286c3e5941f2536c4d9a1b77c1c6e987da9545b6ae
MD5 553cf6c7e10d1c701098d7e1d0a01839
SHA1 3cbdf41c6d02de51754a2696a382485be5175771
SHA512 591ace58027c743e663598f29857e3fa52e47e5a015dfb5e46570fcc563b623306b6e9de5df0aed2f5242c7ae88178aced6c909ec3b8c075b5d7239922d3183c
MD5 SHA1 SHA512

Submit Download

NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

Path C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
Size 16B
SHA256 b1be54e9d57ad9678740a73c896a77da02c9fc6a85d249ef4eff433468f8d2a0
MD5 8d9be36b52e4bd6cf8ede2512fc5b771
SHA1 7614c8da8b21112f2502729036f37b250e9800c3
SHA512 a333b5ea57525f845bb122aa47600d2bbae02d3981cb809eab10d44d7996ab88128eaa3c63ce7ba5ad3d9d95331bcffddaad43de120eed791ac7d68efc128e6f
MD5 SHA1 SHA512

Submit Download

memory/448-32-0x00000000001D0000-0x00000000001F6000-memory.dmp

Download

memory/3308-26-0x00007FFBE65B0000-0x00007FFBE7071000-memory.dmp

Download

memory/3308-42-0x0000000000990000-0x000000000099C000-memory.dmp

Download

memory/3308-35-0x00007FFBE65B0000-0x00007FFBE7071000-memory.dmp

Download

memory/3308-34-0x00007FFBE65B0000-0x00007FFBE7071000-memory.dmp

Download

memory/3308-31-0x00007FFBE65B0000-0x00007FFBE7071000-memory.dmp

Download

memory/3308-24-0x00000000002C0000-0x00000000002CE000-memory.dmp

Download

memory/4356-0-0x00007FFBE65B3000-0x00007FFBE65B5000-memory.dmp

Download

memory/4356-1-0x0000000000CA0000-0x0000000000CD2000-memory.dmp

Download