xworm | c96a0fddccd367dbc5422cd5e2036a3f987eccd1cf62a00f5a7b243a74ebcf22

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/11/2024, 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c njfrDAJ.exe
Size

140KB
MD5

445e516f9ca9d204baa359ee36edc8e0
SHA1

f5a3267afbc73c16620bcc3b332fadd8104d60bf
SHA256

c96a0fddccd367dbc5422cd5e2036a3f987eccd1cf62a00f5a7b243a74ebcf22
SHA512

e315de1fe895123950d88d7e4e9f0f57b3317abf3ebd09f8aa2916f105529b6f9b6ea834c8a318b9a7c565171c08580d5f727c3d043cc797f80f74f5ff141810
SSDEEP

768:Gmcgc7ptu0Nqf4v6hCuuJf27ZZfFWPG9/06OOwh2SjGbn621sIwEk4w00wM:hc7tu0EgwCuuJfKFv9/06OOw4SC+EA

Score

10^/10

xworm discovery execution persistence ransomware rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

147.185.221.22:29307

videos-gsm.gl.at.ply.gg:29307

Mutex

akkHSUfQR3bLHwnR

Attributes

Install_directory
%Temp%
install_file
USB.exe

aes.plain

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2272-1-0x0000000000320000-0x0000000000348000-memory.dmp	family_xworm
behavioral1/files/0x000b0000000120f9-34.dat	family_xworm
behavioral1/memory/2544-36-0x00000000012B0000-0x00000000012D8000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2792	powershell.exe
2720	powershell.exe
2560	powershell.exe
2600	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShibaGTV16.lnk	c njfrDAJ.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShibaGTV16.lnk	c njfrDAJ.exe

Executes dropped EXE 3 IoCs

pid	Process
2544	ShibaGTV16
2292	ShibaGTV16
2872	ShibaGTV16

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\ShibaGTV16 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ShibaGTV16"	c njfrDAJ.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	c njfrDAJ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000058337ceaf3982342b1eec8ebb2b168fd00000000020000000000106600000001000020000000b71378df29ddeef617a22149af6c7f18d9654399cd6c6d10648bb47d9f6e3882000000000e8000000002000020000000110c78114acb74aa6ed30a46d80b27d1e324717d667c1aac644a8509994740a620000000ad6dfd40c7d05b6899a9438207cd7187f33f881b1ddca3fffc39ea39a5362444400000008d92a99de8e6b0797f82c74641f49c51d28dca3af42328597b5ba702c5cdf4422dfa4d409084d2834a493f2d600631bc22c4eba8db53c32b0c54c7dec0ef90fb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8DA5841-9B23-11EF-80FE-5E235017FF15} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000058337ceaf3982342b1eec8ebb2b168fd00000000020000000000106600000001000020000000c01b2588ccc98e92f7a431f56db4cd3459d9795e22c92cf1b48234b2ef893b2f000000000e8000000002000020000000d76bae07807b4021d42a6f1cbd7e88e0ce9bfabb6b5aea1392ef161d0f9c5aa7900000008f10408239c1567cb722c1fd278eb0836a98777815ddd15283f9517394898bcbb8f3d78b7a4ae2de7d315354be5d5e5c101c5b9c7f0d9dd985671638a46a2c59bfa62734ed0c993a19f41635a856e190bcb2ccf73047ce535f5a41dd50ceb19b7f2ae331e2566a089c5c0cef96b77b41222e240cca6c81d483052cc1c8c989e1654dd4a3bea30737075229d27ae0a8c94000000080ff4468d325d6d4e9ee264b03afb4d124ea58366bb026ce4c091de5d98f50f43b0cb9ea9219f2c6d1878e3b22d1cbf3545ecc91678db4a1db888831976bbfac	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a091629d302fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436938214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2792	powershell.exe
2720	powershell.exe
2560	powershell.exe
2600	powershell.exe
2272	c njfrDAJ.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	c njfrDAJ.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2272	c njfrDAJ.exe
Token: SeDebugPrivilege	2544	ShibaGTV16
Token: SeDebugPrivilege	2292	ShibaGTV16
Token: SeDebugPrivilege	2872	ShibaGTV16

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
892	iexplore.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2272	c njfrDAJ.exe
892	iexplore.exe
892	iexplore.exe
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2792	2272	c njfrDAJ.exe	31
PID 2272 wrote to memory of 2792	2272	c njfrDAJ.exe	31
PID 2272 wrote to memory of 2792	2272	c njfrDAJ.exe	31
PID 2272 wrote to memory of 2720	2272	c njfrDAJ.exe	33
PID 2272 wrote to memory of 2720	2272	c njfrDAJ.exe	33
PID 2272 wrote to memory of 2720	2272	c njfrDAJ.exe	33
PID 2272 wrote to memory of 2560	2272	c njfrDAJ.exe	35
PID 2272 wrote to memory of 2560	2272	c njfrDAJ.exe	35
PID 2272 wrote to memory of 2560	2272	c njfrDAJ.exe	35
PID 2272 wrote to memory of 2600	2272	c njfrDAJ.exe	37
PID 2272 wrote to memory of 2600	2272	c njfrDAJ.exe	37
PID 2272 wrote to memory of 2600	2272	c njfrDAJ.exe	37
PID 2272 wrote to memory of 2928	2272	c njfrDAJ.exe	39
PID 2272 wrote to memory of 2928	2272	c njfrDAJ.exe	39
PID 2272 wrote to memory of 2928	2272	c njfrDAJ.exe	39
PID 860 wrote to memory of 2544	860	taskeng.exe	43
PID 860 wrote to memory of 2544	860	taskeng.exe	43
PID 860 wrote to memory of 2544	860	taskeng.exe	43
PID 2272 wrote to memory of 892	2272	c njfrDAJ.exe	44
PID 2272 wrote to memory of 892	2272	c njfrDAJ.exe	44
PID 2272 wrote to memory of 892	2272	c njfrDAJ.exe	44
PID 892 wrote to memory of 1564	892	iexplore.exe	45
PID 892 wrote to memory of 1564	892	iexplore.exe	45
PID 892 wrote to memory of 1564	892	iexplore.exe	45
PID 892 wrote to memory of 1564	892	iexplore.exe	45
PID 860 wrote to memory of 2292	860	taskeng.exe	48
PID 860 wrote to memory of 2292	860	taskeng.exe	48
PID 860 wrote to memory of 2292	860	taskeng.exe	48
PID 860 wrote to memory of 2872	860	taskeng.exe	49
PID 860 wrote to memory of 2872	860	taskeng.exe	49
PID 860 wrote to memory of 2872	860	taskeng.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c njfrDAJ.exe
"C:\Users\Admin\AppData\Local\Temp\c njfrDAJ.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c njfrDAJ.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'c njfrDAJ.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ShibaGTV16'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ShibaGTV16'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "ShibaGTV16" /tr "C:\Users\Admin\AppData\Local\Temp\ShibaGTV16"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2928
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:892 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1564

C:\Windows\system32\taskeng.exe
taskeng.exe {54B5EABF-F716-4D36-9FE5-0F6D840B897C} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:860
- C:\Users\Admin\AppData\Local\Temp\ShibaGTV16
  C:\Users\Admin\AppData\Local\Temp\ShibaGTV16
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\ShibaGTV16
  C:\Users\Admin\AppData\Local\Temp\ShibaGTV16
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Users\Admin\AppData\Local\Temp\ShibaGTV16
  C:\Users\Admin\AppData\Local\Temp\ShibaGTV16
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0808d2b8d5d5dbaace497c23dfbeffa

SHA1
3757221dc8f33ee09e2c9b575bf1b67bd5e7b9fe

SHA256
400dbb98378e28ffe3dbfbcb8b6cba43bec10cd8b5e700cfbefd9f84af53f2c4

SHA512
ebef077b1c73636fc5dbf299fc00ff96f35a2c63068cae7578d511dd8897d2a07bc821db26a1c996dbf29d3a9666de02fad36902032ea1c7fc49fa5e14a3bab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1200889a7e4f5ad545e37560f37fbe1

SHA1
600d2275b5724e12edea7b61e258619acfde6f66

SHA256
5d698b2d8561b772f82ea096db27b1ff607ce0bfd52bab48dd64b706b2b02e1a

SHA512
777422cf3aba11fe14a03f6f0c435584161a0dd78788aacc228764b661b095fb9248188963f32f697ebeffd65f90d0fd5755b1d375990563718d56d36d033ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1743c47c7f1de13cc5719f774f4361c

SHA1
9441bb2ebbcd0b2ca1c0a0258f770546e6a92258

SHA256
17bf9b546a34fc196dd2854dfd20f07253763509032ec492d9b19d70306235a5

SHA512
656648b8555231d65ee305c3747496e5160c25c33728bf9e4614de333538ea33ecf391e2603736bb34063a34e98fca35dadd1f5e9c38e2cfc9425724afd353c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c61ccf3527f87c8ab65bd3ccb9f080fe

SHA1
9bec6191c2deeb3c118678abb2336cd0657c42fd

SHA256
2bf3bb5339e70d5e8560afa6b8294fba866c7631c4109c6beb888b44f81024e0

SHA512
749814b5316a10749297687d9158fc489016d4684341039d3f83b7651fc2e66ecf8172bab17915b88a1f0c87534d17c1f8ef7db52efb7d2d10a7c5164c2b06f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acee664006fd0461cd392ee2eabeaa86

SHA1
e52f660e281ed6c493451d97aa8408981bc43d4c

SHA256
7f8dc1fa50b8764a8a1e302f2ce27923d50fd599ea04f21940b9ee6323cd2ddf

SHA512
ddbcb2ecb715cc657cf2e6e3ef74761d9d1176b10170202153e358b2f3073422effe4a42a7f9e4f018ab455b82b7d90295b139f862014a81dfc3a020fda6c253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc9d186b9c49a9bc7920d7818ed2f89

SHA1
2c2cc57d37749f3485ff5cbb4ac4ae57bbd3b0c2

SHA256
d79147b19cc84daf1dca85ae4c34bc79c721a56ef6770ff251342c67345dd36e

SHA512
54793b42bd6979f6f9c0912ce6a483890fd1067548d9607e8a669e29aee502eeb098fb5a693250e37cb65bb0deb479e72a4adb8c5dad8f50e2721ca9362e0989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4013a65468ed00a8a0344ed692df5c47

SHA1
459e295c3af79fe9134e40e636e0905a861368e2

SHA256
2df31bfca3a3a01f1ec1bdcd35ccb85a2f25823bb58a7201e30e73a116adf558

SHA512
c4e0dbd60b8cd5f1f554dc4c5bf8752fdaa396d574219ecd3e80fbf046b398d5b81e64936b2e3d272ee32cfa879a6ee95b449a5fe01720cf1ee5f27abe351651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc8bd728fe3f539c3ca7232250f15f5

SHA1
9f6674a655359dd30288d5282675d31ddd2f7f10

SHA256
70fe74751a23bfe0429543877e518b5c922ffbfc72b4c0afea4a5c00bdf5c9e6

SHA512
5563f4fee1885bb983f682fd51664c2930e55bd26f153f6ed76aaf9cc2bb411a5d4a46de65c5acfbd091201668a83ed1f1ac95b1ac6ab2d1ab4e5fd5466e1066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05d2b6d77867176980736031cb05dbdc

SHA1
332a176335b9c91072f8e827496026da5441372c

SHA256
7c810ebb5ce72f97d2a39d4b3d89ac89fd870677b3b473689811dae505d7347f

SHA512
a7825a0579fd79e7ebccacf2dbe4db085d78027b514e17e533766a060fac22796f651dbd31139572f8cb5fc5c7543f1c7042f3c789c6728b8038bf1bee1d2d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c4cc3df8adc5f30e7c456a33cc6e6a6

SHA1
6a6f2b8673ffff2f0a6ba404b03788f4c87131aa

SHA256
ca870a4280f0d31dd49708da1fa8f5536a987cf80057d7154dbed9a26de4742a

SHA512
09146ea3692f1a051a18da272ff9636d7ce239ab242d546b9eecb13c73f69566d547ec8324ebe737d42d54c79b81e55056cf95f9bf1af8e6bc8d13cd8d33e0cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce7e21d2fe40453a2b553a6cfa7980a2

SHA1
5eb7f5d8ee1d904763ddc7d628166aa7f010d9fc

SHA256
9e0859b15b0a02aee4307564722fe067ad950128921bd35ea379330f1501fcf3

SHA512
66de753e5a91e57d612b9f476a0d85acea738fbca913d6103b2dbb651d7cde2425bd28c72cc0b3fd89f0b131a15023d6532700d27673fe254039ad70dfbc5034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f656ad57a177c864673dbc3d5d836b58

SHA1
07b84e558ef9058b62c2110711d95259de6482da

SHA256
6aefed12bd2dc8f58c4dac31972b536e7ff7458dd11421d22108bbfc1cb350a1

SHA512
f35f59d34519ecb4c42c08da6e7b07a0f28b6f4296566b66c866b71275543f46719cf31f886fba6b86f13b8c05115d318f88497cccd8cc4b153007421b982acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21f66ee1a02895822dcd9386d6c5ec9e

SHA1
577aed7224c2dd21221fe4a3cb32a8a76b810a29

SHA256
b6043a5f49e397862ba3eec53238888dd9a07b62d5a1c69af19482305ec94a6f

SHA512
0b06dfdddb3acf8374905faeefed1cdf85a854df808e7b81c4f553621e1163a58f56b51c2def9aac63303adaca8c6bf5c52efbd8e5dc9470e4b2b00dee43b81d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
033134841e1e02e0ed4a8e0470bf9693

SHA1
8f691105b1b65b1a06e2b047bddb5e64298ac0e3

SHA256
c24468a1fd9291b2ce158e3f96d4f2542eaf74bdccd70a2a8e65bad83dcc8391

SHA512
436a613b989bcfded9b67edde86eabd4661c7e2d47899a8eefa0efabc4937af565430dfd67e9013831e88d98bffa281e9d4a463b0faa4f0133b1bb89e423777b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a0699863ab5f7154a5918c1116afe3e

SHA1
5fffbef0bce43053a89e6ae14c6da92186e0c162

SHA256
9bb7e940ba02e61978488a94b9589fd9fe42606d0c42a975848fc10f52238b84

SHA512
5cd0ae0188032ad09869a1481117a0dbb563085d963ec50f44f028be10cf55a2959439f7754d8811f89b324455120f029e54c53d19592d6f9dc152b4244d37cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a590a88c342f94935474df13a5557ad

SHA1
9d56b189b6069a5ca72754bb3d1a9e7d36df2b04

SHA256
9bdc7e32e8b0d0d414ef9df59f9e4914c21c669f59df27e552164d27ed0e9b41

SHA512
8783df40af444c6db6ff33250a91d43d7a41fc68f9752bc546383496f962db172d8444a1b184aae2e0ad2670e3364781ee867ccb93ce4a55d042250ed6c9bccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fb8d5a755e1f59246c4dcc768b190c5

SHA1
cc54a7aec52aaf1f0f9de09ee9b972c0118de2f3

SHA256
3b9ea5ce9699d6e5592d99d40ea1d7943139d99ddf210687e74b0a632065138a

SHA512
f1c5dd11bab1a357d5bb8a492b0eb9c333b6527059e9554b2d9efca7cb2ae44c8d0045915934f81f57daeba1b9dea8e036401bed89cb1d5e8a5fa78a65b952d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b3748e0b734ed3f3846fbd0437ef5c0

SHA1
44d3432f56e251e758f97a9a07c22ff1ef08f613

SHA256
9f93864303a3447428c549f32e3c542463ac43104ffb3d6534789a5081444aaa

SHA512
64d7337f0bd780a121375e776ff80ee22e62397b91848cf92aaffb7bbd3c1799a271fec3e5e84f76e77115e4833a250730ede8e657110054fd0243fbd74a9111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfe6ad1f25ae6637a851cbc0c4b0d473

SHA1
2af4138dfbce3554192f846a435bc268bccc366f

SHA256
cfcb03c747fba4f1a2b33bf3791623db4a84e6ca659fcfd1b4a67fb02ebe42dc

SHA512
47e7c85bae9ac5c1dcaa55c50184cdf416f22dab2a4e2e6e98b1023f297fc7e831d4f7bdf860a99caaf07fc0b5f1b6ee824e118a599e0895d40e1e3ca2908b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCDBE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ShibaGTV16

Filesize
140KB

MD5
445e516f9ca9d204baa359ee36edc8e0

SHA1
f5a3267afbc73c16620bcc3b332fadd8104d60bf

SHA256
c96a0fddccd367dbc5422cd5e2036a3f987eccd1cf62a00f5a7b243a74ebcf22

SHA512
e315de1fe895123950d88d7e4e9f0f57b3317abf3ebd09f8aa2916f105529b6f9b6ea834c8a318b9a7c565171c08580d5f727c3d043cc797f80f74f5ff141810

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE6E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
29d41a25d53f5ee8ad302e8caf0036f3

SHA1
ba21ae755ce1d5420c3f821c7f1923dd2081d698

SHA256
7ab9eed5c4c303b3d86207aaf192263374cbdd7efb1a4a5e96f3f8287d51411b

SHA512
ef4ebe7b58ca2af27d70039523b13085c2275e54a7940a73e6e03babed9d0eaa25616de09c175dea84eccac8e665c787738733740cdf39478c193c00cd3299cc

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\Documents\SelectUnprotect.xlsx.ENC

Filesize
16KB

MD5
fe5071307bbad918bf894303c927a1d2

SHA1
98d4f2e2bd2fa5ecff77e04ba12b040849b97e07

SHA256
9611930f0db7936356489ff435229d7dafb5b64541f93a2c1e5e068bf32ceb2b

SHA512
f6b39bc3bae326f68f35065447ad19af21e6d19810d389f0b608fa5a7dfd5710f19aca13f826e96197a8f65c79fe989d8ed41e059d3eb78255947d3d519ee56b

Download Submit
C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
d5c75a7d2cf4360668a33a441270d729

SHA1
74ac64a322c850641e7fb786ab8ac1f67ce08c88

SHA256
433514db18c955c65e66330a2a4488b7e876d78488c1f59cecd8fc35ce6abb49

SHA512
01e3628ec48fe004698827ee4a695213269d163e9f72f7a44b7bd0db0d79f428ada7c7c840d6b5a72058a8466d12ceed20a21b57939e1d470eac8474c1940bd7

Download Submit
memory/2272-32-0x000000001B3D0000-0x000000001B450000-memory.dmp

Filesize
512KB

Download
memory/2272-31-0x000007FEF5173000-0x000007FEF5174000-memory.dmp

Filesize
4KB

Download
memory/2272-30-0x000000001B3D0000-0x000000001B450000-memory.dmp

Filesize
512KB

Download
memory/2272-37-0x00000000005A0000-0x00000000005AC000-memory.dmp

Filesize
48KB

Download
memory/2272-0-0x000007FEF5173000-0x000007FEF5174000-memory.dmp

Filesize
4KB

Download
memory/2272-1-0x0000000000320000-0x0000000000348000-memory.dmp

Filesize
160KB

Download
memory/2544-36-0x00000000012B0000-0x00000000012D8000-memory.dmp

Filesize
160KB

Download
memory/2720-15-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/2720-14-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2792-8-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2792-7-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2792-6-0x0000000002BF0000-0x0000000002C70000-memory.dmp

Filesize
512KB

Download