redline | 4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2477.exe
Size

125KB
MD5

02201ab0ffca3905fbf110296fd58298
SHA1

4068eb4c09f6e09637588ee3cf62bf7229a25faa
SHA256

4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe
SHA512

4f2d86d8dbdb6946bdd982b7c48aea803eccd99c51ddbd6edcb1f7301f9a8f255953210b5b47ecd6e6a8f1bf93269bb519b3a83548f7d3ea63ded3980bef3705
SSDEEP

1536:Rn7TvjnE1RowM/gZbgjx1LAYivy6sDOsyrXdtyVt3A7HPd4n+lbeRZIbSQPYU:RHovoX/0bgAoORHyHQbPRyZ2pPYU

Score

10^/10

redline stormkitty xworm l3monlogs discovery execution infostealer persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

l3monlogs

78.70.235.238:1912

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2272-645-0x000000001A750000-0x000000001A75E000-memory.dmp	disable_win_def

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2272-1-0x0000000000FA0000-0x0000000000FC6000-memory.dmp	family_xworm
behavioral1/files/0x000b0000000120f9-35.dat	family_xworm
behavioral1/memory/2184-37-0x00000000013C0000-0x00000000013E6000-memory.dmp	family_xworm

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x003000000001937b-659.dat	family_redline
behavioral1/memory/2580-661-0x0000000000E90000-0x0000000000EE2000-memory.dmp	family_redline

Redline family
redline
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/2272-755-0x000000001D570000-0x000000001D690000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2880	powershell.exe
1276	powershell.exe
2584	powershell.exe
2636	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	2477.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	2477.exe

Executes dropped EXE 3 IoCs

pid	Process
2184	spoolsv.exe
1668	spoolsv.exe
2580	rexjvc.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Users\\Admin\\AppData\\Roaming\\spoolsv.exe"	2477.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	2477.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rexjvc.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd2ed75a996c5941bc30c329e6d09b56000000000200000000001066000000010000200000008c57e2a6321a8422ed03f4507b73f6068ebaaf94438f5ca69021620f80b06de3000000000e8000000002000020000000c59da03a571cc729d77cf3969abb0e74711f0952a3ebb7f8196918d35aad6772200000009ca0d9832302cbae5d53b7b2c16cea0bfc0d5d24e0c7769cb9465ab81f36bbe040000000e968e18252b82ff0628e21e6123c56bbcdd8f5172e00c5886252abbc7704c25899f6ade3ce35a0ed94ff14cbd73974a47dcfa657f09e214a68df19e2039efe06	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE2A1FA1-B56D-11EF-80FE-5E235017FF15} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0082c0b27a49db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fd2ed75a996c5941bc30c329e6d09b560000000002000000000010660000000100002000000069d260966617224a1ef3f479d9009eaffa0a566d99b85e5eef7bab0bbdce850a000000000e8000000002000020000000c8e4a0899753e579df75e66bd3c61215e93c0241f6832693ad104a95ab32a008900000001e0e7aa6bd18005b8d384bdd35dfe72af3528d89896ca16ccdaf7e7dd03cb6600802e213550cdff2eb45bf6187346b9fdbc5e0c865bc0dc615a44021dcd4c3bb9fcc6f450e51bd2508627e98e26ea910abec612a6d852cdb611db50650bc27508a4165cddf454aa608db5caa864e83b742d3188a4b51215dcac355071b1f11767bb8a8433794dab5acc14f79e2a7220f400000004a59cfd800eb62c5112bb5eddd0e969c84f497b66d633c04cbdd14d3fc228b2e3c35146cc7d7a7bdc9589859350d8ab51b20f4a256c54378708fa82fc51028d3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2584	powershell.exe
2636	powershell.exe
2880	powershell.exe
1276	powershell.exe
2272	2477.exe
2580	rexjvc.exe
2580	rexjvc.exe
2580	rexjvc.exe
2580	rexjvc.exe
2580	rexjvc.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	2477.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeDebugPrivilege	2636	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe
Token: SeDebugPrivilege	2272	2477.exe
Token: SeDebugPrivilege	2184	spoolsv.exe
Token: SeDebugPrivilege	1668	spoolsv.exe
Token: SeDebugPrivilege	2580	rexjvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2272	2477.exe
2588	iexplore.exe
2588	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2584	2272	2477.exe	32
PID 2272 wrote to memory of 2584	2272	2477.exe	32
PID 2272 wrote to memory of 2584	2272	2477.exe	32
PID 2272 wrote to memory of 2636	2272	2477.exe	34
PID 2272 wrote to memory of 2636	2272	2477.exe	34
PID 2272 wrote to memory of 2636	2272	2477.exe	34
PID 2272 wrote to memory of 2880	2272	2477.exe	36
PID 2272 wrote to memory of 2880	2272	2477.exe	36
PID 2272 wrote to memory of 2880	2272	2477.exe	36
PID 2272 wrote to memory of 1276	2272	2477.exe	38
PID 2272 wrote to memory of 1276	2272	2477.exe	38
PID 2272 wrote to memory of 1276	2272	2477.exe	38
PID 2272 wrote to memory of 2376	2272	2477.exe	40
PID 2272 wrote to memory of 2376	2272	2477.exe	40
PID 2272 wrote to memory of 2376	2272	2477.exe	40
PID 2976 wrote to memory of 2184	2976	taskeng.exe	43
PID 2976 wrote to memory of 2184	2976	taskeng.exe	43
PID 2976 wrote to memory of 2184	2976	taskeng.exe	43
PID 2272 wrote to memory of 2588	2272	2477.exe	44
PID 2272 wrote to memory of 2588	2272	2477.exe	44
PID 2272 wrote to memory of 2588	2272	2477.exe	44
PID 2588 wrote to memory of 2680	2588	iexplore.exe	46
PID 2588 wrote to memory of 2680	2588	iexplore.exe	46
PID 2588 wrote to memory of 2680	2588	iexplore.exe	46
PID 2588 wrote to memory of 2680	2588	iexplore.exe	46
PID 2976 wrote to memory of 1668	2976	taskeng.exe	48
PID 2976 wrote to memory of 1668	2976	taskeng.exe	48
PID 2976 wrote to memory of 1668	2976	taskeng.exe	48
PID 2272 wrote to memory of 2580	2272	2477.exe	49
PID 2272 wrote to memory of 2580	2272	2477.exe	49
PID 2272 wrote to memory of 2580	2272	2477.exe	49
PID 2272 wrote to memory of 2580	2272	2477.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2477.exe
"C:\Users\Admin\AppData\Local\Temp\2477.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2477.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2477.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1276
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "spoolsv" /tr "C:\Users\Admin\AppData\Roaming\spoolsv.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2376
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2680
- C:\Users\Admin\AppData\Local\Temp\rexjvc.exe
  "C:\Users\Admin\AppData\Local\Temp\rexjvc.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2580

C:\Windows\system32\taskeng.exe
taskeng.exe {F2069F36-F78B-45EE-B09D-926B6E3CD92B} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Roaming\spoolsv.exe
  C:\Users\Admin\AppData\Roaming\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Users\Admin\AppData\Roaming\spoolsv.exe
  C:\Users\Admin\AppData\Roaming\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b83554c8de164b68df531646012e9fd3

SHA1
e3798f3e34fc2b0124a9538d48eb030163c27d99

SHA256
7fda4e47fe287ce368efacdf37b280df7565fdc434997df0dbc8f2cb2e704c81

SHA512
f04575e6f27b850279e1601c20aef560920228309f0c16149c685343afc5fa152482f3bb8ef3e58bdd18b9c9d218239ce25f7f99a87010b99e2c82e23c03c81f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f497a25a067fb690ae56179efa918d6

SHA1
0bc03d6744d0ab62fd1c95090306a492a5c2ca7c

SHA256
b6c645626dc7030c580922cff89a8930505480030c50408370939370548eeceb

SHA512
fe86e37cab5289176ba38b3fe1a63f846b79733633ab5d22a9e0171eacecf7aa8837a0979a1534a291901b6a8878ca1d0178500097b4f5849559e0a53780bfd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2af3458335ca261b36bbc07f5e864254

SHA1
55dc412952bfa623a3b83226a0d7698a00506c71

SHA256
3feaba753bc4396e5cba84b4bacab6a1a958b7d8275f0cc785daca94012b128f

SHA512
d2b39cb173ccc519367700e78b12eebc2d712dde6517682e8e2ec34db731cc7385ba7717cc9554bacf9aee5f18aa672ee6d574da7ebdf10971b80d0a5ce5d683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
092dc880f33f8eb116905f0fec28a127

SHA1
8189c43b65b233e70369cb23302f0732e11ad5c8

SHA256
84a2113fbc3e750e6948b4085e429942c4cff9ebedd85e4c68a34eb1741bd3af

SHA512
ede2dfc191fdcc24317bd9c20c8d843fc72dac6fd64b5b72d4f0f561fe9d7d29234464b7ee9329b122b04dd90cb136f5bdf9bd9b5cdc4a010ea8c2093178077e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08c2c21615fd245cad7f1e3a347507af

SHA1
c0afa7bb5cd268cdd7fa586187ffa5a345589cf6

SHA256
6ae562344b1172871d2b17622fc9ba337acf5d346a4f5efc68ab087fbc70b891

SHA512
d35a5ccacba0d91c38e8f44c45a2ba247603689422e7aa9470dd94eb2aec5238ddb169734277bff672deed0c2adeef037f42bf5506dc8421944a0c7b51e40b58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0982e6c8d1baeaac347baea37c8f26fb

SHA1
a7927540d52b0f4552317331eaf8916e027942b7

SHA256
5438bb3ff909024f36f7d90511de90ca1d833ae6b17128d92fdd8613c681e34b

SHA512
799323ff51d04c85b8ae11e1d0abd5535107fe7301b360e23296eb63f7c9d555b99672fb029fbe92146c39476877bb52e0d1e390dc8d56b8762d49c6ce18bc22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b019a38e4cddc0784ac53e0d6232699

SHA1
2cdf5885b6f5626a58cb6dc6cb9fc0f39feb190b

SHA256
7fd7ff89696f6128ff8d05659396bee8cd866393a32f3978b2d4c3f37722eb84

SHA512
888beb113a9809939ceabe9b3013dee899fc66c17f59dbfe8860d954b56b0f7bae95d45c11a3b4e572747519f74c636dc128c7cd720742008630db638cb1f30e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8c80b66373aae542700b682c0bdd0bb

SHA1
f80bb80c029c8bde3d875f6cb175fe482d2e828b

SHA256
b6a15a44e50e9cd4a66accde96d9f60e54b504ceb99a79e05889b330326febda

SHA512
71a9136c9e587a6d9ccc5906830ce6657f7973d9d4924e13b3c6cd198f149c2f55bcc7ecf2f8a61700f663818c299af5b43fbcf7a6508236d5fe4677deb2ce06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c28a07836cff28c51101be89195664e

SHA1
20380ccf3eb437771b3e4dc1d4661a8f4463ac62

SHA256
aa2a1094ce27b2d4b6014663bf7af199747861aaff03f8c7c3b2921551557508

SHA512
1746f601f65acddbb967000a9a172356d014f41eb40454d69ed307936eb4cc1b4daf824d05164dd50fbe4a5665ad832da6804fcc18846d9e5b7ec17d5728a1c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64858cf41644ec0e65e7d672490dd810

SHA1
e576c90e0f8cc8991eb6fc8d177457b420ad77a0

SHA256
b20e027c490d03b40d50a180fa7621d1997535dfdd74cd0daac94450e5e1b5f8

SHA512
7f70240a96548e3336c6781080a67fe4b69aa0a432c21889de1c213e73a2895a7c292c8ff01d34040bd06a991231600c61e71dcb63f24b262c0e28303b8db3bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ef756669dc942d26cbefc0e993aaee7

SHA1
ed3b9e41cf6e3e7ec7f4777d716ac8570305a4ed

SHA256
8e1dc57f6d732b57adc7a0079546a19a47cd2a0c1a659e271ab07611c29f63c9

SHA512
6750abd8ce42f6476c450c113ba5e85eaa5451a9dbf2d42125ecb0b69de78c350e5e8e20057b7f99f73b5ad6165785756bf5ce39b03933662cb964dc836a2513

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC20A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC2B9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rexjvc.exe

Filesize
300KB

MD5
dfefdd2e554fd23f3b87f68c3e0f9622

SHA1
8be107d3c7e0aba6346ccdac289e29e3a8127af2

SHA256
f47c2bb84ce619d0d69445b0a1dce760482f2dd508815ba2667bab5c3a3541e9

SHA512
8f11525da059c6aa655d5ad2c41f89ce535ebb7a2bd4d7ce197c2ea244f28947e2338b1f97378130179490e49fd73402ee3dcdc507901f48b41ce9acf79ca182

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
09c38fe8165f50fe35c03c3128c25e71

SHA1
f8d24830436b049d709174ab4a9178472f79e5fd

SHA256
3cb3007608cb3f7634fb437e81a64a59830e2deb4f56d00ab17d90c085331888

SHA512
f70cc36dbf755b207b99d184214b2ed499d4edb98890faf21b9fc976225acf620da403b4ddb8a0ffe752bfdb5c10091f105e819ac47bb6a280c3c4b181d313b3

Download Submit
C:\Users\Admin\AppData\Roaming\spoolsv.exe

Filesize
125KB

MD5
02201ab0ffca3905fbf110296fd58298

SHA1
4068eb4c09f6e09637588ee3cf62bf7229a25faa

SHA256
4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe

SHA512
4f2d86d8dbdb6946bdd982b7c48aea803eccd99c51ddbd6edcb1f7301f9a8f255953210b5b47ecd6e6a8f1bf93269bb519b3a83548f7d3ea63ded3980bef3705

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\Documents\EditDismount.docx.ENC

Filesize
1.9MB

MD5
5feec801de3274f8d8f077c1af52a63a

SHA1
f73c21469034d13554393ad15e06bf1f5f964850

SHA256
0e5e4465975697f2066fdcd093c59132bfa813b8e401d9839e449f6af2e8bdbd

SHA512
593b2567d7adfe7c01fd41402392f72dc9b3b76686a78afacc88c60e8780884cd4f50ba290974ae6e116b610aa0d8198193c090743f30e98618634a322ac85b0

Download Submit
C:\Users\Admin\Documents\FormatConnect.docx.ENC

Filesize
14KB

MD5
19aba95cd19c4a7df9b898e8e96018bc

SHA1
0fd81d2bf951fa50a4d05a16d791ddb0d1e90ffc

SHA256
31622ce1b1875f3aee9f30e82d48e8deefe2d6a4dbf914b2f53c20e39dfde28d

SHA512
6e7dc5b51e43dc721cdbea75acb4935de6a9255161dffe424b025c259a5021740e54afab082f407a05c52ed464466e10b83e72177af8fe6154813e48035387d2

Download Submit
C:\Users\Admin\Documents\OutEdit.docx.ENC

Filesize
18KB

MD5
086c5024e30fbc436c9637e1d8d92591

SHA1
c5e56fe4ae09027838497eb0c5145feead56f112

SHA256
ebacc57ee7f237653771802b53d58aeee7406ee5ad1c2590be2ec2ac80442218

SHA512
869cbccf52ff4e07ea346bc43e62e2aab5dd5391dc40e3a59c0c8f333b798d6f16e6d266166d85988fceb8a6594a1a2858b09d65dac99facdb75b27589168433

Download Submit
C:\Users\Admin\Documents\SelectUnprotect.xlsx.ENC

Filesize
16KB

MD5
fe5071307bbad918bf894303c927a1d2

SHA1
98d4f2e2bd2fa5ecff77e04ba12b040849b97e07

SHA256
9611930f0db7936356489ff435229d7dafb5b64541f93a2c1e5e068bf32ceb2b

SHA512
f6b39bc3bae326f68f35065447ad19af21e6d19810d389f0b608fa5a7dfd5710f19aca13f826e96197a8f65c79fe989d8ed41e059d3eb78255947d3d519ee56b

Download Submit
C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
d5c75a7d2cf4360668a33a441270d729

SHA1
74ac64a322c850641e7fb786ab8ac1f67ce08c88

SHA256
433514db18c955c65e66330a2a4488b7e876d78488c1f59cecd8fc35ce6abb49

SHA512
01e3628ec48fe004698827ee4a695213269d163e9f72f7a44b7bd0db0d79f428ada7c7c840d6b5a72058a8466d12ceed20a21b57939e1d470eac8474c1940bd7

Download Submit
memory/2184-37-0x00000000013C0000-0x00000000013E6000-memory.dmp

Filesize
152KB

Download
memory/2272-33-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2272-652-0x000000001B5D0000-0x000000001B61A000-memory.dmp

Filesize
296KB

Download
memory/2272-0-0x000007FEF5173000-0x000007FEF5174000-memory.dmp

Filesize
4KB

Download
memory/2272-755-0x000000001D570000-0x000000001D690000-memory.dmp

Filesize
1.1MB

Download
memory/2272-645-0x000000001A750000-0x000000001A75E000-memory.dmp

Filesize
56KB

Download
memory/2272-646-0x000000001D910000-0x000000001DBF2000-memory.dmp

Filesize
2.9MB

Download
memory/2272-647-0x000000001A760000-0x000000001A77C000-memory.dmp

Filesize
112KB

Download
memory/2272-648-0x000000001A780000-0x000000001A7C8000-memory.dmp

Filesize
288KB

Download
memory/2272-649-0x000000001A7D0000-0x000000001A7D8000-memory.dmp

Filesize
32KB

Download
memory/2272-650-0x000000001BA30000-0x000000001BAD6000-memory.dmp

Filesize
664KB

Download
memory/2272-651-0x000000001A7E0000-0x000000001A814000-memory.dmp

Filesize
208KB

Download
memory/2272-38-0x000000001AC60000-0x000000001AC6C000-memory.dmp

Filesize
48KB

Download
memory/2272-653-0x000000001A820000-0x000000001A836000-memory.dmp

Filesize
88KB

Download
memory/2272-1-0x0000000000FA0000-0x0000000000FC6000-memory.dmp

Filesize
152KB

Download
memory/2272-2-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2272-3-0x000007FEF5173000-0x000007FEF5174000-memory.dmp

Filesize
4KB

Download
memory/2580-661-0x0000000000E90000-0x0000000000EE2000-memory.dmp

Filesize
328KB

Download
memory/2584-9-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2584-8-0x0000000002CE0000-0x0000000002D60000-memory.dmp

Filesize
512KB

Download
memory/2584-10-0x0000000002730000-0x0000000002738000-memory.dmp

Filesize
32KB

Download
memory/2636-16-0x000000001B7B0000-0x000000001BA92000-memory.dmp

Filesize
2.9MB

Download
memory/2636-17-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download