xworm | 10db45b88db5377749bce89b2fe511917e38d027e539ac652ea79829fb82985d

Resubmissions

23-06-2024 15:54

240623-tb8n1swfqd 10

23-06-2024 14:41

240623-r2xy4avbra 10

22-06-2024 22:45

240622-2pwklsyajg 10

Analysis

max time kernel
176s
max time network
176s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-06-2024 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sussy Executor.exe
Size

66KB
MD5

0680a239ba405c1935c687ebdf6d4540
SHA1

bf2cc8de357fe1af9888e120e1c139ca2bc77c15
SHA256

10db45b88db5377749bce89b2fe511917e38d027e539ac652ea79829fb82985d
SHA512

09ff2d0449404f7b704cb8270ceecfc87d84c42c202a55ce20fb425230d81f5bf8a798c1c52a2a1ed19c599ad8d2f72188c561d734dd79ac70b7973fbd07fc73
SSDEEP

1536:44Sw2KfDxiZcy2fdbdFSQ37E6vObaKjG:4OL1yGdbdF5ZObPG

Score

10^/10

xworm execution persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

medical-m.gl.at.ply.gg:28857

Attributes

Install_directory
%ProgramData%
install_file
Runtime Broker.exe

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3020-1-0x0000000001360000-0x0000000001376000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2536	powershell.exe
2356	powershell.exe
2616	powershell.exe
2792	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Sussy Executor.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.lnk	Sussy Executor.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\ProgramData\\Runtime Broker.exe"	Sussy Executor.exe

Drops desktop.ini file(s) 14 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	Sussy Executor.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Sussy Executor.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Sussy Executor.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	Sussy Executor.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	Sussy Executor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2008	timeout.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "425319994"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d100000000020000000000106600000001000020000000106320ead5b4fd8800536d1db10b61d20a95ff3ada7df160f5cd5a21d3ce09e7000000000e8000000002000020000000303cfcd8701fec8c3260155da62068839fc0dcfc5509e4a86a7b37567914c3c720000000ef9345a29c356f68afb013d0c63f00192683263c9d6c2266314b6ed1b36d961d40000000675dead7b94eea49b3eadf9358fd794050f00c6dcb752f397d4b9877d75330a22b63efe97794b5cc341bed005daf72ce8ef6ecae11b56f2e37acbf8daf16b8af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fde5d685c5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d7c7e73b934388418857a0db8be9c1d10000000002000000000010660000000100002000000014550f026ea4fc21e6f475a4d47795e2aeddeea3aa094d6d30887ef6e1badf00000000000e8000000002000020000000e70493d0529f2164dddde9370e94952ebd9bcae5bb3c518d0cbf54e745e00adc90000000aecb943f0360269ccc58607c0ed14cfd9a1c513ee1653275fb38752b2a8da3d1692c52ebd937182f78aacf9c0a3e0600a3d2948acc3f59cab39a94a486565fee9ba389a718bd1f975afacfefa3e390d60722cc55e2fd2da6c4f87473bb5ed46dc7d4b9fdf493ba875c0df3376010cc83fae5f4a48d2d5cb5ed7ec7a3eba623f40ee45b8b38abea62564365b2d62a7d3740000000ed5d6ffb2170a7fbf3a6ed00dce318c93e4ba67a94b2522d87d300a005866aad2d1ac0823d4ef30af6c16f10eb16251159c889a77f3de2723740808054fb7c2d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02628E81-3179-11EF-B781-461900256DFE} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2616	powershell.exe
2792	powershell.exe
2536	powershell.exe
2356	powershell.exe
3020	Sussy Executor.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	Sussy Executor.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2356	powershell.exe
Token: SeDebugPrivilege	3020	Sussy Executor.exe
Token: 33	688	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	688	AUDIODG.EXE
Token: 33	688	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	688	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3024	iexplore.exe
3020	Sussy Executor.exe
3020	Sussy Executor.exe
3020	Sussy Executor.exe
3020	Sussy Executor.exe
3020	Sussy Executor.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3020	Sussy Executor.exe
3024	iexplore.exe
3024	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2616	3020	Sussy Executor.exe	29
PID 3020 wrote to memory of 2616	3020	Sussy Executor.exe	29
PID 3020 wrote to memory of 2616	3020	Sussy Executor.exe	29
PID 3020 wrote to memory of 2792	3020	Sussy Executor.exe	31
PID 3020 wrote to memory of 2792	3020	Sussy Executor.exe	31
PID 3020 wrote to memory of 2792	3020	Sussy Executor.exe	31
PID 3020 wrote to memory of 2536	3020	Sussy Executor.exe	33
PID 3020 wrote to memory of 2536	3020	Sussy Executor.exe	33
PID 3020 wrote to memory of 2536	3020	Sussy Executor.exe	33
PID 3020 wrote to memory of 2356	3020	Sussy Executor.exe	35
PID 3020 wrote to memory of 2356	3020	Sussy Executor.exe	35
PID 3020 wrote to memory of 2356	3020	Sussy Executor.exe	35
PID 3020 wrote to memory of 2520	3020	Sussy Executor.exe	37
PID 3020 wrote to memory of 2520	3020	Sussy Executor.exe	37
PID 3020 wrote to memory of 2520	3020	Sussy Executor.exe	37
PID 3020 wrote to memory of 3024	3020	Sussy Executor.exe	42
PID 3020 wrote to memory of 3024	3020	Sussy Executor.exe	42
PID 3020 wrote to memory of 3024	3020	Sussy Executor.exe	42
PID 3024 wrote to memory of 2652	3024	iexplore.exe	45
PID 3024 wrote to memory of 2652	3024	iexplore.exe	45
PID 3024 wrote to memory of 2652	3024	iexplore.exe	45
PID 3024 wrote to memory of 2652	3024	iexplore.exe	45
PID 3020 wrote to memory of 3060	3020	Sussy Executor.exe	50
PID 3020 wrote to memory of 3060	3020	Sussy Executor.exe	50
PID 3020 wrote to memory of 3060	3020	Sussy Executor.exe	50
PID 3020 wrote to memory of 2836	3020	Sussy Executor.exe	52
PID 3020 wrote to memory of 2836	3020	Sussy Executor.exe	52
PID 3020 wrote to memory of 2836	3020	Sussy Executor.exe	52
PID 2836 wrote to memory of 2008	2836	cmd.exe	54
PID 2836 wrote to memory of 2008	2836	cmd.exe	54
PID 2836 wrote to memory of 2008	2836	cmd.exe	54

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Sussy Executor.exe
"C:\Users\Admin\AppData\Local\Temp\Sussy Executor.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Sussy Executor.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Sussy Executor.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Runtime Broker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Runtime Broker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Runtime Broker" /tr "C:\ProgramData\Runtime Broker.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2520
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2652
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /f /tn "Runtime Broker"
  2⤵
  PID:3060
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC36E.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2008

C:\Windows\system32\taskeng.exe
taskeng.exe {A5BB0815-ECA0-4D3A-B617-4983B9F2BFE0} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]
1⤵
PID:1196

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x484
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a034338e68983468e1585fa291368cee

SHA1
d1980771cde4cd35d1e94a13ff0b8cf782d28082

SHA256
6fb5eb9c4ea4a2ffe80b343c8303113e75af2ec46a782d6235ec4ba77163d807

SHA512
a93db8026530a84aaa72fc3bbfa9e0f821be0e98d6b3c8e3efa1d11ce56dc09109741d17fcb6865a877c42543fb9e6fe2cc565d273e0a220b13f3eadb17d16d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f075d9e3566ebe8c7521ca786e2bb5a

SHA1
61bfe2e124284b65e706f02c1a464d28686d7538

SHA256
443be772ca03555a4cff8901426d41e571efec308e8058dfabadab343f1c1884

SHA512
7e8bd06b2efb08fca5f9ff918a3a3bbe9d56abb6fdb086c1a9835bdd52675e46864ff183299f2ac6e52ff17e9e749e079e9f0cd60bf6e94cd8b1d1db3e0e8637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e17addb63ee0b12f1988f003dff52d4

SHA1
674f07dd0ff703a9bac89580f4c65dc924684111

SHA256
82e7646ab50878112069a155e902b3589ea6baffa67c8b54ccf741dcaba6154b

SHA512
1fbd2ffcde1a123e5e7989ea5138c815bbc5c0e53a2196872ef2106c434d342da340a92d4c2ce21ea7ce7b31f7013db71d9e44ac0a1588215125c098c58f3c0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6829f8a66d0a9e5b244000b296ccf7cb

SHA1
fa673a795a5a988e38ffd1b3d07a4fdc54c7f81e

SHA256
c72dd1b660ae2baba392b197f67a054efc7f02a2b9ecf43424e595e0a71f3c4e

SHA512
a36afdd35ddbdddbea70de9fbae0fd702b4ebb6f59f0d228d1d00c835a135492ff250cbf68972840f128c01cf382b4503bc3a5e3f85572174e92d960ab74c1e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e745afa064c5b0877fd0ff72a23bdc3a

SHA1
61169787183510726a4bfb7cdf818ea370d72165

SHA256
fdfcecff69cdcf575d09d4840b432dd4e817b8ff5fd501881ed04edaa2804e7c

SHA512
783784e7cd2d386ae56e1eb6cf1344707cd19bf997742b058da0c85360369f657bec227346bea1be28c01d97f1dbc67b6ac23d4df417ed0be71d47897042ee41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c101fe8fde739e1697df22f368c646a

SHA1
a8188900144112fd4346fc7ab431c8786be77a15

SHA256
39987886cf332b3283b9c2af692f02f4b0424035fa8aafeab9542c19482084a8

SHA512
efcf6c0b440dd27c5ada26787f37bcfeabec42727225de8998b60c11da327fecb369f2337902d78e3236aecc9bef0205821243d76372eb3899c1b09ee2307303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb38a137458916c00b45e612bc5af530

SHA1
f44f2cf3e42916b71fc241faaa38221c0ab63e85

SHA256
2f34ff4d4a7c29ca67b9d671e4617ce36f5742d3611d091a8cd8c6cd0efe0e85

SHA512
8e518eb3873aa18ac33ec492742e387ef17db5bd9952cf9c29233a53524684259004f104226b862fa9655d7e694976803350771b183698a912a35c029ccde5e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96a31682081137dac327c8fbdf7f4a95

SHA1
e391e4db23b6c986ec060d6bca4d4ab366822dc5

SHA256
00ec5afc50be849fa3f9a77b60f3bbc300bf2a0ef93b8910edce06f7bcfef9b5

SHA512
c3eb7602ec4b455c5bd8c9c8aa6135d91ae65680e5191a1e60854e5867ca1751ef42cb1d7a298db217bb1fa29f2929d6ea339373802a00057798db2ad60c7e4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63e3ff4f65b3b59438de7771affa5171

SHA1
0d6130b43edb43d5de7f47628df1d3c888471241

SHA256
bf316c7f9036e8b20ff5c09430134d8733edcd63637062e38d4fe06533b04b60

SHA512
4d9346f4f93310737d40fe58d14b1ddb4b70d6e5fe3d822c45230221480eb05f2bc5bf05e9f3096d52e8bc421ff104856021a57804ee64e366cc03bfe041a289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4292ed5ced6f9df3a52a61cc19fb9477

SHA1
ae1387bc6cdd94d202f80ce6a5de547507004761

SHA256
44a23d1e5e96bc58aec7af009432fc290cd071d513996835f712dfb7d39451f8

SHA512
6b8f59ed47aa3222d290831b86aeeec01b0143ab277865ed92ccc3be3c31233d71d7b01e004c9a711230dcc7add436a3c2024ba42772d972f660e82ce3f3f5cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29bc7964ae860745ba8261a0706e1dfc

SHA1
a725dbcd67f88497bb01177e4dd3e456f90c72e2

SHA256
3e5ef9a8fc9cfa6bb471f4038ce976fa3228f15624a9ec5ef1cdebe5141884d0

SHA512
a05072498fbaeebc79f1a8b8c170ce998d262f9b5874e1e4db0eec9e85506b6e193db5cca7e36e807a9ea2d00903e16b5f7f6d5542e6fc2b9d7583f62cf6918c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52dd792028aa805798b83df731dddb8f

SHA1
50af33d893e920e8328ef1e060f59ad89a437967

SHA256
585a8e7f55c8f27f62a3864e4585b891d115d1901c29c1f10d6fa7caf0219903

SHA512
069db998a7c42552e021baca22d86d55526a39e08140dfae47a202b1735e46d2bc2704117491a7fd02b87d08366f2850bc951620a0e80f4b94d5e39429bbec5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87136372aaf25484fe356008dd807a29

SHA1
cbe128c654875c1017c9b1e8ea0257e60a30c861

SHA256
ce6afd737895d6b7ec729a4b7bdbf3c9d03c6a73ab4eb5a83fb8c98109c870ae

SHA512
ec5f8366c3d4fcc77b48163e4532cd949f746c5ae050ecc19b28b553818655937332f660aebc1993a53866c891e6b9f68f521973d5054c224605272d38adceb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed987678140d87a1475f9ed8d5dea9ae

SHA1
48cae81abfc46683d53e3a38b6d92523fcc8753f

SHA256
8860cc567bf86cf425c969808514a8255c8beaa5979fa74f76a6993316619454

SHA512
87cabea0166e2290178050f3f8625fa01da38b8aec3282c047bcc5c72c6ae4beb88c31dc3fb9d7fdbe55021c91fb050da02f19e0a595cabbcbbe6b62ed4d1e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
694ba1d7ba7b07d83afbb364d6a4e711

SHA1
4738a8dc010aa95f86525bbb0ea45bbe835f9609

SHA256
d828bcd76e81ed3806def99d479125c69848b243bb56ad715212c7ad9bb58dd3

SHA512
973db8474f7f162123aaaadcf0dd2749c7dd72a1ac79d409344bdf2957e2d8854c705e87ad226473317ded31b51a7ea991f2c08e101229a88c88968ffdfa3f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1785f858e8cfa71b722d11732bd833e2

SHA1
42fc5dfc6fac4cba1341135c824c4eb718f182bd

SHA256
d670e13898b01c0cfe4bc50f19254b408db6220b2b8657b1f65a3d16c44da920

SHA512
a4188373dd394d8e338e2c32fc37eee274bcbc878029c1accf30bd3df68b07d1980e772ab2ab67c5086f8118c05a36e5ea94282f59a17336a58d36d8fa0df50a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cb5cf6f3a6a7458387ac229e4670f9d

SHA1
87f1b79ff35f8274e6151d53cd7b77987490f08c

SHA256
a7a98a8b72aee4b6a2ab5219fa340637cf58d212a82e09b2fc83099bbbdbd60c

SHA512
5bbd23f6f3c00e57cfc7fdb05f667f64002f741b5444ad1472be206ff1ac7eb69da31967f5017336bfa38afd5bb96b5905ad27af9218d625eb67cd146e614f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77289423388a2d01eafeff01241e8082

SHA1
8aa0ba3f799583d3370123ed6291d6c15a011127

SHA256
620cea692a5568dff5e751e52a008e8b79401bfd1d9490544d176d3be4c42de0

SHA512
07861e616bb3030b1b622b1241ac6ec0e50c41fca79d80cb83379e72360563a75d00ba9a330620607442a42b4f5c5ec23e15d96121f8954f63e4f43c7cc83300

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AE1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3BA4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC36E.tmp.bat

Filesize
166B

MD5
bcba32287eb34140f0412d0f09e74dce

SHA1
1cd26cbddcc9d7f41900cfb0aeeec1abed0ae0b9

SHA256
cc9fbab3f86cc03cbaf5fe001c6ee5cc61f43d3f2a0d0beaeaf196947c5119a9

SHA512
704915e5517b5f8c1204e36b67fe884d72dba8b0d53a762273cb70fc03f6c9a0cd46439f92e4d64dbd382e9805629173d707c8fbd71d33a759b1eec3388020df

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
b3786a1dd51ccf8c02aefeab7d37381d

SHA1
a2701bb00d1c0569b6d163139d39405dbcbeffee

SHA256
4f70e993bc11151af1fb1813ee4c14ad6e1ab088b6287f74da355a27728ac66a

SHA512
24bdf17923f531eee221d12988c4d031d71d4e910bed8103ef4510862381a9c38ec013571ebac1139272daf3f70beda5de8df1f7e3cdaaafa3b1e698332e53d9

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
656B

MD5
7393b250754264d8658d6ad81207124e

SHA1
f2bf456b40052fd273ee7e3c1080dd5ae6594cdd

SHA256
74d1041d835485c74561d23e63b1569afe0e92383d7798f70a6951294a2c7899

SHA512
aeb796f5a51269ccde738e3c4151ef442e0f4f6528507998ddb9ff0ffca861f3c1221eb9dfee16a639ab4608614f074b96d51ba58219736b8ac9f1beadac50c4

Download Submit
C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
b71c8cd21e9189a1e43cfa482b3ab84f

SHA1
6eb8286a351ba93c37ad1e6489545979351e12cc

SHA256
8f38a90bb263d3ea2a5054cb92679d8d164c285a818098adfdb0e37d9dce91bd

SHA512
2a060815605ac947ddc0e8877b86fb34d92f0d4f7e61e2bcceaa0c4c25af8b1e654b07f9ac171d1c092475fa27806ddc480fa3c43756a656c01c99d478751b73

Download Submit
memory/2616-9-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2616-8-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2616-7-0x0000000002CA0000-0x0000000002D20000-memory.dmp

Filesize
512KB

Download
memory/2792-16-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2792-15-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download
memory/3020-31-0x000007FEF5293000-0x000007FEF5294000-memory.dmp

Filesize
4KB

Download
memory/3020-0-0x000007FEF5293000-0x000007FEF5294000-memory.dmp

Filesize
4KB

Download
memory/3020-32-0x000007FEF5290000-0x000007FEF5C7C000-memory.dmp

Filesize
9.9MB

Download
memory/3020-2-0x000007FEF5290000-0x000007FEF5C7C000-memory.dmp

Filesize
9.9MB

Download
memory/3020-1-0x0000000001360000-0x0000000001376000-memory.dmp

Filesize
88KB

Download
memory/3020-1801-0x0000000001340000-0x000000000134A000-memory.dmp

Filesize
40KB

Download
memory/3020-33-0x0000000000C30000-0x0000000000C3C000-memory.dmp

Filesize
48KB

Download
memory/3020-1816-0x000007FEF5290000-0x000007FEF5C7C000-memory.dmp

Filesize
9.9MB

Download