redline | 49ff687dbb13ed84815f3f57c660a0a4fc5cb21c82b605ce53338538a864586d

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spoolsv.exe
Size

135KB
MD5

fcfae4fdcc273f8a46c51d49fa8a4a03
SHA1

3a0e314b7bbdf5467df8b92a348c1b464fd502b0
SHA256

49ff687dbb13ed84815f3f57c660a0a4fc5cb21c82b605ce53338538a864586d
SHA512

50e6960d98dbc8d63975b0514deb6e9f7266a054e129902ac2ecf7c8500c84e5125d4896c9ec54a4187971832abfe2c575fd4c166baea39712b35f2f35e000f7
SSDEEP

3072:pG+KeZW7bSWaWDbkDOrZBRHQbPRyZ2pPYU:pU17buWDbkiBR8AZ2

Score

10^/10

redline xworm l3monlogs discovery execution infostealer persistence ransomware rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

78.70.235.238:7000

f8terat.ddns.net:7000

Attributes

Install_directory
%Temp%
install_file
spoolsv.exe
telegram
https://api.telegram.org/bot7742194912:AAGSH51C4BpkbbvEQlO-cv-lDoJZMVxqyN4/sendMessage?chat_id=5456205643

Extracted

Family

redline

Botnet

l3monlogs

78.70.235.238:1912

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2124-1098-0x0000000000BC0000-0x0000000000BCE000-memory.dmp	disable_win_def

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2124-1-0x0000000001000000-0x0000000001028000-memory.dmp	family_xworm

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x003400000001a41b-1111.dat	family_redline
behavioral1/memory/1992-1113-0x0000000000890000-0x00000000008E2000-memory.dmp	family_redline

Redline family
redline
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2820	powershell.exe
2840	powershell.exe
2720	powershell.exe
536	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	spoolsv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	spoolsv.exe

Executes dropped EXE 1 IoCs

pid	Process
1992	nfzuzf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\spoolsv.exe"	spoolsv.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nfzuzf.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C8F36601-B56D-11EF-8BEB-4E219E925542} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0007e9d7a49db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a99ba79dfd3fa143817393e9c732a33b000000000200000000001066000000010000200000006b399a98fbb5dccf1de17d53027dd7d29b3224111b330247e14cadbc4e6edeaf000000000e800000000200002000000004cb0aacc7e961d536066bec2466d4a8c5152d8488355b7d6a44fcc9ee95a8f790000000e6f9f648cbab8e54bddd62742ef8e42377c173b2d10e59fa5277ec3269c37ce0bd31a661e4f15f412439f738bb4d1032580c758bd650cdc1a325e0631af5ba87afa7b804a23901ecd239267826ef31d2c3b03bf17bfa1554e72bd9178566fe7acab1003b763d6a6876c6c084f3de5d0ea7761efde082c292ec37e975f3df02a775fc8bb52054e4df0245102d3e09fddf400000002262cafe21dc5e26371e2e7bdfd860e7ea6f86953f02ba9e7e8098500c89f2e3cdf71a5c8ab39328b530409c3df5b2c3aa1ff2c348d72382352547e33e1e2f4b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a99ba79dfd3fa143817393e9c732a33b00000000020000000000106600000001000020000000169140d4a647c32e478809e475681326cef609d8dd4d345e6853169289240ee5000000000e80000000020000200000004297244a8e4803638e4fcd53993d6a9fe99fa00a1a761c616af08cb2734a977420000000a3d3f7772645bab485aaab3dbedac9e89e4258b18f68aaeb1e6ce2df46fc6bfc40000000883ecc689e98eeca0a00433b8abf6a756ead1b1a07669b25852ea125eef8393ba5edac20ce25ea3aa20f2eb959d23a05993e575aa9904eb70b369e90c4953edd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439828727"	iexplore.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2820	powershell.exe
2840	powershell.exe
2720	powershell.exe
536	powershell.exe
2124	spoolsv.exe
1992	nfzuzf.exe
1992	nfzuzf.exe
1992	nfzuzf.exe
1992	nfzuzf.exe
1992	nfzuzf.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2124	spoolsv.exe
Token: SeDebugPrivilege	2820	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	2720	powershell.exe
Token: SeDebugPrivilege	536	powershell.exe
Token: SeDebugPrivilege	2124	spoolsv.exe
Token: SeDebugPrivilege	2484	spoolsv.exe
Token: SeDebugPrivilege	2348	spoolsv.exe
Token: SeDebugPrivilege	1992	nfzuzf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2124	spoolsv.exe
2636	iexplore.exe
2636	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2820	2124	spoolsv.exe	32
PID 2124 wrote to memory of 2820	2124	spoolsv.exe	32
PID 2124 wrote to memory of 2820	2124	spoolsv.exe	32
PID 2124 wrote to memory of 2840	2124	spoolsv.exe	34
PID 2124 wrote to memory of 2840	2124	spoolsv.exe	34
PID 2124 wrote to memory of 2840	2124	spoolsv.exe	34
PID 2124 wrote to memory of 2720	2124	spoolsv.exe	36
PID 2124 wrote to memory of 2720	2124	spoolsv.exe	36
PID 2124 wrote to memory of 2720	2124	spoolsv.exe	36
PID 2124 wrote to memory of 536	2124	spoolsv.exe	38
PID 2124 wrote to memory of 536	2124	spoolsv.exe	38
PID 2124 wrote to memory of 536	2124	spoolsv.exe	38
PID 2124 wrote to memory of 1296	2124	spoolsv.exe	40
PID 2124 wrote to memory of 1296	2124	spoolsv.exe	40
PID 2124 wrote to memory of 1296	2124	spoolsv.exe	40
PID 2124 wrote to memory of 2636	2124	spoolsv.exe	43
PID 2124 wrote to memory of 2636	2124	spoolsv.exe	43
PID 2124 wrote to memory of 2636	2124	spoolsv.exe	43
PID 2636 wrote to memory of 2864	2636	iexplore.exe	44
PID 2636 wrote to memory of 2864	2636	iexplore.exe	44
PID 2636 wrote to memory of 2864	2636	iexplore.exe	44
PID 2636 wrote to memory of 2864	2636	iexplore.exe	44
PID 2980 wrote to memory of 2484	2980	taskeng.exe	47
PID 2980 wrote to memory of 2484	2980	taskeng.exe	47
PID 2980 wrote to memory of 2484	2980	taskeng.exe	47
PID 2980 wrote to memory of 2348	2980	taskeng.exe	48
PID 2980 wrote to memory of 2348	2980	taskeng.exe	48
PID 2980 wrote to memory of 2348	2980	taskeng.exe	48
PID 2124 wrote to memory of 1992	2124	spoolsv.exe	49
PID 2124 wrote to memory of 1992	2124	spoolsv.exe	49
PID 2124 wrote to memory of 1992	2124	spoolsv.exe	49
PID 2124 wrote to memory of 1992	2124	spoolsv.exe	49

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
"C:\Users\Admin\AppData\Local\Temp\spoolsv.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:536
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "spoolsv" /tr "C:\Users\Admin\AppData\Local\Temp\spoolsv.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1296
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2864
- C:\Users\Admin\AppData\Local\Temp\nfzuzf.exe
  "C:\Users\Admin\AppData\Local\Temp\nfzuzf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1992

C:\Windows\system32\taskeng.exe
taskeng.exe {BC2352E4-C512-4561-B5E6-88BCEF976D06} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
  C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
  C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13cea9042dd893ae7a1ce0ec219d4782

SHA1
f801665d6cd74705096dddc0c801c553269ca951

SHA256
049c52702e68893a44a6634ec2bf3b87d00e670f79a5e2ee021f325846140c3a

SHA512
022c2b415f6436ae14ec36485289177dc72ca5b031f61de2bfe27b5de7531adf6735b803f539721b3b57f0bd65f12f6c6696562bebaaf1c8cb2e0224eb099dfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74aa6f546de1bff4d0a4c5882ee437aa

SHA1
c25f523e5dd1f0b8dbed855f05a5012d6ac0ab81

SHA256
017fe96aeca99d060bff804f04a5a7cce5ee1bb11e5ae167d232039e8d5f0025

SHA512
7a9518fc81a84022b6ab9340aee6a322bd0dabaf237539cb689c8004af77df7a078cc1e8215f0fd292fb846a3476252b56d8308f05cb9a9c5dc09a76d13c2865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a190ac742d6afc76d5e80185a1512383

SHA1
df057b056154fe8e969dcf5fcd14610e070eeba2

SHA256
550cb73a045d2974e70a0c771575ac5f6c80854476c79526b1a43e7803274281

SHA512
0f917645252f5c59e5958a1922592a90721b1ae51e82b5d457fd0f702a50696e327acb3683f65337dd4f8c904a380bb095bca36ba8464da784b4e75aa510d4bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9221382faaa71b98261826670f0f9f22

SHA1
c89b0aa6f5037aaa7a8047cd0c7021389531511d

SHA256
29d3c2f74c788a49c4c42cf64a9283c34b8edf394f1edfd7992d6b672d131ebf

SHA512
bbf04abf1449f6e7792e7a867e350d96b7ec14bd286d2307f07f0e28506dd8c44b05bef524cfdd26589e044ebb46acae43373a223411cec3155a542a6983c80a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c06991d44338ce79ee8b822a33bb59cc

SHA1
f1695980e926604c18fed0ff1117a0c784e04b82

SHA256
132fd471d922aa6f7ec7d309fc7c9c757cf250709d7494a9cc92ff558048564c

SHA512
a88d2a24897a0bae26231b191e10cf0161507b66a9eaf4b91a4409c801ad1d736dd7b42111420425ec175e4b96a2e665cc8309b677408e06c88a138218d1e029

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c3596e02870c3d7ed7d017222778a38

SHA1
4b2bf3a320ccfbfe78fee946a4c861afe382af2e

SHA256
4abf4e6dfd86e248a56e1119a3505ff2c5b6952fa8aaef728d66ddc633d684ef

SHA512
784fd145235b55fc2c6a9d9de67e9e194e59a5ad3102398be242f21d0b9f23b272f7f6df480ccd4d515cb304086158bc27111964d536b58e31195db1f2374413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1598216cacb075634bfdfdac8356044c

SHA1
cd37f68bd5941ac408f9a8f9a0f243831ef420e2

SHA256
2973566b7ad8209a93daeb4a873d08432e496c6cbdb5a85238b5a1e27c510644

SHA512
8bdb86754c3acc07ef9763939e9499a34868ac6fa3379e581e4014134120a0c4e89249153bc5b23057c523322910e5f008d75670884887d4455306ce5fdcabb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3176c0da9c4afbbe6abb7bd006d7d110

SHA1
e96fe81c7b6e8933ce78be1988fa3c13877aa3f0

SHA256
d5460502e5ff44adcf6c018defb29555052713dff0529ba6c26dbb81209948c3

SHA512
0a0cf5d72d816c915bd19865658940ab93313faf02b6861585129e93a9716b6e6887ef101ac2b6140b5d5e5263ac4088a3a6fae11101ae93d7ffa696625a8b76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
222d5e0d10f3d10a7c08cfab2fd51a92

SHA1
dad6040858a39ca6b45c02d456a7bf56572c514e

SHA256
65ba447952c8a8ead5476a740a126d167075232eb73d7e460d68bf6495cd8c9a

SHA512
618232df57744879eb92e00809ff6393505029b237fec69b679a0c91ad983ebb1b49bd2034b2c3320e1e3d5be1461911cd56ba9b61cfb77868d511e8f465138f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91cb6c93c66ddb95882f627e083a201a

SHA1
32e0d661df5a05ba090081098f4ada1eb39c3593

SHA256
ae8271e69f00d7e41d73c0f81f09b4826fa9f36b587c2b892207ae2be70b457b

SHA512
b617f1fd0adbea76977d9b07b1fed734ec22d1f7da5d52d50325a520200649e59a8a8e063709b1d8f0ea4623d52f119ff55bd912c590fbd7d0aa249276b19978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10af20ecfd17456150d5b6b4b36b7022

SHA1
5a55e6e10bc751ed36dd5d88668c6b7a8d9b90d1

SHA256
06846c0fafc70953bcd264cbec64e9b6279751a068f1c6fb01bbcf48f823056e

SHA512
74eebc4bdd62491a2142d5d465c8936df67ddfbd9c9336fb2b7f3b026105f07edae614ca7eda988acddf7000e192e0a8bbb56aabf7ee20d3c77f290f8f1549dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86b094d7dd40faade7a2cdb37b228fbd

SHA1
b4b0b3888a1e81cf98e8250a6b0c7788f39237d3

SHA256
1a7123043114ce2c3e761124074ae93b60b6eb8bef2c8b6dd90c3e8cb2132eca

SHA512
ef0f110309a87220df9a9fcd0b8c917c9b95d1eb5213475bcdd6858532f55f868f0c41eb11aa0c1b1b76a212da29b9cb7111a4188f2b092a2c351eda895b7185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d151d1b7a06f0675b630c6f31bd1c8c

SHA1
eb087fa3f959ad954166352d711760c07878bd17

SHA256
e777b9cabe20a35bc3913d20093cc58873aef6a10094bb50e0bd75f68b5a87dc

SHA512
3f5a240e568afe77cae4024495c55096fcae2c2a49295ffc965db39de37b1558e65f3051a8ac6fecd7e092ab54a4e420409d34be5d798ca03a6885b40c67ee08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5be3609b83f73122472961ecde973088

SHA1
f71b07f167e557e809d482fc41e5500f937ad6db

SHA256
64f4443613af948608f1db3b71e5b50abebcd8374c997d54a87701438b678756

SHA512
1367bde81550aabb1641874be199fc1515e38fb2c50de903cdc18f11990a44df557b3b3e5c1e75149d3d591562eeb36bb91edc9450df05591ed4db9114fee1b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5e677bc6e53fcf0c7b51e5df9e148b8

SHA1
94064c1b247227b824a7734e06bf8667ed237c98

SHA256
f5965f4f2d8d9831357e6ad18e5889645a0645300ca38dbe485831170ee8dc63

SHA512
a033d89983b3dc52686f2a51132bb0076fb36041b51637092a4733da37abc4c1bda561672630eca439a4dd8afb89973fc2ad315781672034b1fcdc57c8464fa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17a5376bd4e6ffada5cb60fe57c62d04

SHA1
49edd83fb62105039d0a0cc3c2bfcbde00582da2

SHA256
4378289c68da4ea86e422a6d8ce51cb5b8d67ccc080f3909871cbd93d437424e

SHA512
2b1a53939a2d413d29681db2a3c0c627ebebc802a4352e00421566f729486391d5c9a0321f60779ed3d65c4c091481f89589733e77482000005a7585620950ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a93c2c88e7f3542d8cb41ad13663959

SHA1
51a48e8cedf6ca8bc6c0cf95c36570ab560faa56

SHA256
b8347e44d1dd22bb03b9017e966e25f98c7fcceb5e413c58a196ad7dbc489186

SHA512
1d1e3e649574ca387f70df8fe83e01d57b1faf24536446eafea75753323e3f088f8e71040ccab8705d390e54cec8ccb38d51d971b610ea254f48f4cd8b807dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd0d44b924ecfc16d469017d8369adc1

SHA1
9e192fc07b7032750b8d3b9e41ad4cbed889e860

SHA256
dd956331fcde39d7f3763e50042b042234813a41945e736687d9e30f89891658

SHA512
0e261d0e959262e091a854e29e559dcb557264942515024b34518ad6ec9c70b71a87ff52b4840dc02b5869795e7d40d2f7043f310aac1b2d01fa871f1386672d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77adad315976b1b09667d06eb16c8a63

SHA1
1ada838db78fd6498541e5123d11ef65297a4543

SHA256
a57e9bae3dee7b44db56fb0a0fa8633b9290bc233ef3c85a4d7972775a82a596

SHA512
b8c4a843ffa501b0d94667777a440fdeb120e83e60661c37f3e59d5558829ac09ba6ce7644d8b976f6a204e601e54e4275b6017aff7851086bba63c2933b24eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4f604636983a9aa6c1dadac7b134fc8

SHA1
30278ed007c603861928993b8925a7766e5b40af

SHA256
98e5f94a3b254f3e3ecfc2ec990ec6150362b52da75e72c90be567cfe0bd55c9

SHA512
0bd157432355f6d9ba26fbf118d0c67d46874ab646b6c90660a3655c3b7ce462b975df5b6a6323b2e3582382109ff02c49ee07df2cfd1a099a8b06cd02b1efc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9751.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar97C3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nfzuzf.exe

Filesize
300KB

MD5
dfefdd2e554fd23f3b87f68c3e0f9622

SHA1
8be107d3c7e0aba6346ccdac289e29e3a8127af2

SHA256
f47c2bb84ce619d0d69445b0a1dce760482f2dd508815ba2667bab5c3a3541e9

SHA512
8f11525da059c6aa655d5ad2c41f89ce535ebb7a2bd4d7ce197c2ea244f28947e2338b1f97378130179490e49fd73402ee3dcdc507901f48b41ce9acf79ca182

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
c1845894a87fda0b82442081e0f1a401

SHA1
00da4ae6fbe3d094124404f33e43c89b656a3090

SHA256
564944a645bfb011728111e4aca1094f7ca17395c967c45f2f6417bc268bb089

SHA512
2bb4eceef1d47075cc119ae192d89a143ce82cf19e41b28cfc93e36173e558200b879c054b3fd090bfc9cf0ef46902924170245e1d888a857e9b0c8f59d0434a

Download Submit
C:\Users\Admin\Desktop\ConvertDisable.docx.ENC

Filesize
13KB

MD5
25666502963e02a5e30e2a8a0398a6df

SHA1
6af976473e605ef5b5f7a03ab1ba7b55e116bc3a

SHA256
ebff1c3056146e7dc2d4e815d4042356020651a6574e9273adc006356d7c3104

SHA512
fea801c1740e24ef65be455b6c9318e161ad493182718bb866a0489b5c4a7bb925157a7939371b294eafdc3fa0c33e4e50f877d72c4c60acb875a4832f96013f

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\Documents\ApproveUnprotect.docm.ENC

Filesize
253KB

MD5
9e186daa3d5557c921dfeb16aa856e41

SHA1
75aaa4d7b2dddb1650751251129d9d2fc5d2ab9e

SHA256
2b26354ba770bb7ff3efa121f43fba50183ddcb6a3a07ccbdacd8bb2bca20f5a

SHA512
07870fe30545e200b6ea910385452f2dbc8825340bcd726c2b9c0b16255ad43b534be740ba00edbbad3bf56b17cc6bc00c2ab7b0464da60d379ba245fb104702

Download Submit
C:\Users\Admin\Documents\ConnectConvertTo.docx.ENC

Filesize
17KB

MD5
4b7e51a31e871456f412ca3a956f4e9e

SHA1
adf94355d87ee281f0cbb8dab04493ad6d4a082f

SHA256
26d4fc6ab2ce3785d066a3acd0e563db0dffca512e41689e5a39a4b1c17cd4d8

SHA512
44ac22522cb56f4ef3b46d0f6bb6adb7f92602b3a34835342bb940482b87e0ce6ceefcbdf243ec48320985a333808bbfab7231812fdb3fb20f3f87d51f92b521

Download Submit
C:\Users\Admin\Documents\LockNew.docx.ENC

Filesize
321KB

MD5
4ccfa0a3e1e90a7be34ca30aa324c997

SHA1
7a7c36027e76febb5fa37d7dc1913c4d11519845

SHA256
4274bcf0ff320599a480ae9c4ae92d6f5d21aca84c230266fbea67a561f3b7a0

SHA512
1a5b50ec2dfa9f052213e3dd64ce9bd0915a9220e3ee979736cc0b7b46c583a10896fdb091a86ca4eaac3aa63b1377a437437e04f7df47a255b9e1f1afec2363

Download Submit
C:\Users\Admin\Documents\UpdateDisable.docx.ENC

Filesize
457KB

MD5
9ba6c800e7448defaa6e544d0777f03b

SHA1
00bf76700b14232a04593cef41798e21cc16cb03

SHA256
efc380228d5b3f1ecef2dc71e16b4d9fcd699cbbab491f894bd93be7a4cc85fb

SHA512
fe2e68cbf62aecb24c1803ec9484395ab0167c5cdaf1f5d26e13aa1fd2fc71e47825a26103b641372909afbe4d26eaa8a7a2513890c8ee9a75f9c1e9af025d76

Download Submit
C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
42ab8eb81ebc2164308608f18f7560ef

SHA1
81588de100799eebec78d9af8d71f9cb89948799

SHA256
abdfbe7d9a59525c979e68d11df044e12fd4746957602306364dd94aa4a27955

SHA512
80c76b340ee62e8187681acea809d49afbff98ae2a3038926ca8a62508cc28767e0c5d70b9cf38fe4fd0384f76cea09e34da573f05737da4bcd4d1d4666c2446

Download Submit
memory/1992-1113-0x0000000000890000-0x00000000008E2000-memory.dmp

Filesize
328KB

Download
memory/2124-1106-0x0000000000ED0000-0x0000000000EE6000-memory.dmp

Filesize
88KB

Download
memory/2124-1104-0x000000001AA00000-0x000000001AA34000-memory.dmp

Filesize
208KB

Download
memory/2124-31-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

Filesize
48KB

Download
memory/2124-1098-0x0000000000BC0000-0x0000000000BCE000-memory.dmp

Filesize
56KB

Download
memory/2124-1099-0x000000001E330000-0x000000001E612000-memory.dmp

Filesize
2.9MB

Download
memory/2124-1100-0x0000000000EB0000-0x0000000000ECC000-memory.dmp

Filesize
112KB

Download
memory/2124-1101-0x0000000000FA0000-0x0000000000FE8000-memory.dmp

Filesize
288KB

Download
memory/2124-1102-0x0000000000BE0000-0x0000000000BE8000-memory.dmp

Filesize
32KB

Download
memory/2124-1103-0x000000001B240000-0x000000001B2E6000-memory.dmp

Filesize
664KB

Download
memory/2124-30-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1105-0x000000001AE10000-0x000000001AE5A000-memory.dmp

Filesize
296KB

Download
memory/2124-0-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Filesize
4KB

Download
memory/2124-2-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2124-1-0x0000000001000000-0x0000000001028000-memory.dmp

Filesize
160KB

Download
memory/2820-9-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2820-8-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2820-7-0x0000000002B20000-0x0000000002BA0000-memory.dmp

Filesize
512KB

Download
memory/2840-15-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2840-16-0x00000000027E0000-0x00000000027E8000-memory.dmp

Filesize
32KB

Download