xworm | 4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe

Analysis

max time kernel
147s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 14:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spoolsv.exe
Size

125KB
MD5

02201ab0ffca3905fbf110296fd58298
SHA1

4068eb4c09f6e09637588ee3cf62bf7229a25faa
SHA256

4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe
SHA512

4f2d86d8dbdb6946bdd982b7c48aea803eccd99c51ddbd6edcb1f7301f9a8f255953210b5b47ecd6e6a8f1bf93269bb519b3a83548f7d3ea63ded3980bef3705
SSDEEP

1536:Rn7TvjnE1RowM/gZbgjx1LAYivy6sDOsyrXdtyVt3A7HPd4n+lbeRZIbSQPYU:RHovoX/0bgAoORHyHQbPRyZ2pPYU

Score

10^/10

xworm discovery execution persistence ransomware rat spyware stealer trojan

Malware Config

Signatures

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1760-1-0x0000000000F40000-0x0000000000F66000-memory.dmp	family_xworm
behavioral1/files/0x000a0000000120fe-35.dat	family_xworm
behavioral1/memory/2044-37-0x00000000011E0000-0x0000000001206000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2256	powershell.exe
1896	powershell.exe
2952	powershell.exe
2868	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	spoolsv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolsv.lnk	spoolsv.exe

Executes dropped EXE 3 IoCs

pid	Process
2044	spoolsv.exe
1536	spoolsv.exe
1172	spoolsv.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Users\\Admin\\AppData\\Roaming\\spoolsv.exe"	spoolsv.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XBackground.bmp"	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2a2312f75d6ed4fb63087a079dc8c8e00000000020000000000106600000001000020000000f99e4f92711de81d59340ed57a804070c0d29fe36c57083f8d93bb775be7c951000000000e8000000002000020000000091c620937e2c645a19e370a0aa65681a6f41b888a69d0561207d01f3c74dadb9000000003561c1cbf04adce4feb57a50664b0d7e13fe1ca3d12b1f2ec3bc030ec7d63c451d6930e30b86b651ad3199d111e67a586c17369e77ee4eb626d586c6497d0e13a0505c106750906865a7ef36c8b36bcdced792adcd0b92bb7b23e82bc2378a9b9d519099afe256903a2e6bf1627f45c6ad86cd67bef6170ebde2c45cc8c97484b6fcb09eda2819807ce1a9537dca58b4000000046e3434757e55794893e1fe73fe18777e3ef885ce53d8570cc0340a540d780d8533de5fca46706aeed6a9f5c896f9b178e4c55a8f85304425c931e628c3ca1a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2a2312f75d6ed4fb63087a079dc8c8e00000000020000000000106600000001000020000000c7bbfe6c0c1bdb134c6b2aed8052fdb85a3a35b216191f97dca4479b14ff66ff000000000e800000000200002000000068e546f1b0138e4edb9827fe44a64c3506ad772b133eb16cdeccbc5b2958125020000000fc24b5de98f2445b9f5494e92060137ea420aca571f0dcbe0c2eebc30595ed4540000000138012087260143ce6256e493851b41ee5c2abbaf996cebea2e63d34151af2c082fce2537b068f6ff3a3b2850080f0f50eb72ebe8b594ee8392e1b88fd24ac0c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05c263f7d49db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6AB397B1-B570-11EF-A429-7A64CBF9805C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2952	powershell.exe
2868	powershell.exe
2256	powershell.exe
1896	powershell.exe
1760	spoolsv.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	spoolsv.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1760	spoolsv.exe
Token: SeDebugPrivilege	2044	spoolsv.exe
Token: SeDebugPrivilege	1536	spoolsv.exe
Token: SeDebugPrivilege	1172	spoolsv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1760	spoolsv.exe
2300	iexplore.exe
2300	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2952	1760	spoolsv.exe	31
PID 1760 wrote to memory of 2952	1760	spoolsv.exe	31
PID 1760 wrote to memory of 2952	1760	spoolsv.exe	31
PID 1760 wrote to memory of 2868	1760	spoolsv.exe	33
PID 1760 wrote to memory of 2868	1760	spoolsv.exe	33
PID 1760 wrote to memory of 2868	1760	spoolsv.exe	33
PID 1760 wrote to memory of 2256	1760	spoolsv.exe	35
PID 1760 wrote to memory of 2256	1760	spoolsv.exe	35
PID 1760 wrote to memory of 2256	1760	spoolsv.exe	35
PID 1760 wrote to memory of 1896	1760	spoolsv.exe	37
PID 1760 wrote to memory of 1896	1760	spoolsv.exe	37
PID 1760 wrote to memory of 1896	1760	spoolsv.exe	37
PID 1760 wrote to memory of 2092	1760	spoolsv.exe	39
PID 1760 wrote to memory of 2092	1760	spoolsv.exe	39
PID 1760 wrote to memory of 2092	1760	spoolsv.exe	39
PID 2100 wrote to memory of 2044	2100	taskeng.exe	42
PID 2100 wrote to memory of 2044	2100	taskeng.exe	42
PID 2100 wrote to memory of 2044	2100	taskeng.exe	42
PID 2100 wrote to memory of 1536	2100	taskeng.exe	43
PID 2100 wrote to memory of 1536	2100	taskeng.exe	43
PID 2100 wrote to memory of 1536	2100	taskeng.exe	43
PID 1760 wrote to memory of 2300	1760	spoolsv.exe	45
PID 1760 wrote to memory of 2300	1760	spoolsv.exe	45
PID 1760 wrote to memory of 2300	1760	spoolsv.exe	45
PID 2300 wrote to memory of 2388	2300	iexplore.exe	46
PID 2300 wrote to memory of 2388	2300	iexplore.exe	46
PID 2300 wrote to memory of 2388	2300	iexplore.exe	46
PID 2300 wrote to memory of 2388	2300	iexplore.exe	46
PID 2100 wrote to memory of 1172	2100	taskeng.exe	48
PID 2100 wrote to memory of 1172	2100	taskeng.exe	48
PID 2100 wrote to memory of 1172	2100	taskeng.exe	48

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\spoolsv.exe
"C:\Users\Admin\AppData\Local\Temp\spoolsv.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'spoolsv.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "spoolsv" /tr "C:\Users\Admin\AppData\Roaming\spoolsv.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2092
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\How To Decrypt My Files.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2388

C:\Windows\system32\taskeng.exe
taskeng.exe {99AB9D0C-4829-4D20-86D2-CECECC0D1CC6} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Roaming\spoolsv.exe
  C:\Users\Admin\AppData\Roaming\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Users\Admin\AppData\Roaming\spoolsv.exe
  C:\Users\Admin\AppData\Roaming\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Users\Admin\AppData\Roaming\spoolsv.exe
  C:\Users\Admin\AppData\Roaming\spoolsv.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65bca957b6d38e7a5f23bec23a15dc3b

SHA1
8158083d7faa97ad2da7b3959354ce04cf6a5616

SHA256
0746a15b26841823f4cc2452aceac04e2365cf9b03d4918eabe72f749ab9b6f9

SHA512
7afda2931d8d57f6842ec87e7bb6395f4e12ac4b553fbea89e839b712f063b26e2b2700954abe812567acdefc9e821c73b6657389fdd1d94bc634b992e56cdf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20c0b1237b334633c4455a5a7ed3a5aa

SHA1
a13dcb6d41406da3c00e97fd9639f951753a11e3

SHA256
a16d480f1aa614d632d4bef2132ff86f87c044a680a0403014d19d666a6e0b4e

SHA512
e348ba739bd3f40808127a60bb79dbaec554127b2690cc8496ef6ec41d445d66590a1324056798ee384ecbd73d4cb8b9d5608129c6d7ff1306ecfcfca9264410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd5f400d8f7246d3a6e7ba119b527ea3

SHA1
a4142bca2ec729a2a28b0f6407cf133d2931e3e3

SHA256
74dbdee8ecccf6efabceca035123295f5403c1ec8afdc46b75224459867ca869

SHA512
3f08628ad9089a8aedd980aafb3d51c8c5c56dad55606d6d2ccab98a67fbd811b17fc9f0731633ee68357bfb4bc52c84ed3ebeeb475c621972f99eb51d087eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d377602783b4861d1e397052909458

SHA1
b11791747a22e8a4dc8e0e1493a2490c5c2a227f

SHA256
9c2e1d2d4d9987ed814a8599b8a427bf2679389eb514fb1d9a0514d2f982f8ab

SHA512
805d0bb44c60f4b95c9f208112a6afda51a0f014a7f94e6df4ed75f01db7b225639029cc1e730e9575aa5c6e18913e839d81f0430e9be2f4102f6e9e73746ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46e6b274aa577c1c50c907f3a58c83ae

SHA1
ab26d5671b0d74b95f71d2d0e0ff1309c6fa8431

SHA256
1dd4e69dbc6ed852307959823ddc33c438d655513a7ea8dcaeec393341cd2d8d

SHA512
09b92b5a3d558fdeb65b03730e510cc7aecadf5ae08f582244f3cb24938081b36a9f57064d430701b49b3c938db8120b52f3a4e8aa758a58f828635759f94db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e69d3d9a69ef6bc1f1ab45b9c9415c14

SHA1
6e071cf964b368930a557f0965b91e3d97ccedf4

SHA256
bf0dc490ac03437938e38f4e06b91fcd8d2b273038596c7f33174929c5fdc08b

SHA512
2fcbfca4b7446fa0a0959fad93ce55bf4da550846b27a8f331a3e60255eb2e5a3d0996cd37715430cca73924eefe71a72636183d2082b1356756b78539c25987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
708a8d5432dd69c62d8233dbc5aaac71

SHA1
580dd57c4551ad43534de7f70ff585f865ad10ce

SHA256
c7a97786541603cb7950110cb92a66902d3580a5d41a6f142960e93a85ff0bfc

SHA512
3404135e3a4a15edebaccac8f301f70f0821de84b592b19477faac1b29c3acbfefa67985fc69759209106a2016a15a06397f9ef971ece79d355f89a836e19442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6b32b2522bdd4b092f38d8678836f1a

SHA1
3108703da599c531cbf96a3c04f085e9ee37d514

SHA256
d288f79f0950a44bc159e5f59e8a900ecb7c7142b6cb49b2479dec28a8bba1cb

SHA512
b9fe025646a35b14d299840025c4be805dc7938381a14a8ce8a1c63c0ca4dd3db66085f2527834e4630ea31fb6177e18a9f27a5f75d6e287628cccae817251e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4629d44ccade51b1d809793183984075

SHA1
56c30418c1c265afb9f438fe3d75c8b975d3c253

SHA256
4f3f243d5248ac714525ee11cb9d322855119ced9d860edc0a5748fe2ff556ef

SHA512
0db3346134e241e24a0d7b19e577c1d621c4a23b50c70c67a88f3707e42574eac01fbdab9fd7c064e6084c65d90935663a9703b9fd612e4e18320356e9d0153e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8420.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84A1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
644187ca387aef7b53976a701493bc01

SHA1
3fe4a6938774696113760f09826e87f0beba2bfe

SHA256
17b050888d713113ac2b7ea8bdf792a48900d9eba3451ab2906fe83a53bdab7c

SHA512
53234e15f983db999c5bf9b01982998c9b454a0d1db2b8cef3789c20866936406329d26438d2bcb2aeddcec972eb5243ee3b4ac93ad0a5b3446252628d90ce00

Download Submit
C:\Users\Admin\AppData\Roaming\spoolsv.exe

Filesize
125KB

MD5
02201ab0ffca3905fbf110296fd58298

SHA1
4068eb4c09f6e09637588ee3cf62bf7229a25faa

SHA256
4d0f2f8fd89fec7e4f1348b5b6a0ea528d2b391f48e69df140b91845c0989abe

SHA512
4f2d86d8dbdb6946bdd982b7c48aea803eccd99c51ddbd6edcb1f7301f9a8f255953210b5b47ecd6e6a8f1bf93269bb519b3a83548f7d3ea63ded3980bef3705

Download Submit
C:\Users\Admin\Desktop\How To Decrypt My Files.html

Filesize
639B

MD5
d2dbbc3383add4cbd9ba8e1e35872552

SHA1
020abbc821b2fe22c4b2a89d413d382e48770b6f

SHA256
5ca82cbc4d582a4a425ae328ad12fd198095e2854f4f87b27a4b09e91173a3be

SHA512
bb5e1bbf28c10c077644136b98d8d02bfec3b3e49c0829b4d4570b30e0aea0276eb748f749a491587a5e70141a7653be1d03c463a22e44efecde2e5a6c6e5e66

Download Submit
C:\Users\Admin\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ENC

Filesize
16B

MD5
42ab8eb81ebc2164308608f18f7560ef

SHA1
81588de100799eebec78d9af8d71f9cb89948799

SHA256
abdfbe7d9a59525c979e68d11df044e12fd4746957602306364dd94aa4a27955

SHA512
80c76b340ee62e8187681acea809d49afbff98ae2a3038926ca8a62508cc28767e0c5d70b9cf38fe4fd0384f76cea09e34da573f05737da4bcd4d1d4666c2446

Download Submit
memory/1760-42-0x0000000000E80000-0x0000000000E8C000-memory.dmp

Filesize
48KB

Download
memory/1760-3-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/1760-38-0x0000000000B30000-0x0000000000B3E000-memory.dmp

Filesize
56KB

Download
memory/1760-33-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1760-39-0x000000001DD30000-0x000000001E080000-memory.dmp

Filesize
3.3MB

Download
memory/1760-1-0x0000000000F40000-0x0000000000F66000-memory.dmp

Filesize
152KB

Download
memory/1760-2-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1760-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/2044-37-0x00000000011E0000-0x0000000001206000-memory.dmp

Filesize
152KB

Download
memory/2868-16-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2868-17-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2952-9-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2952-8-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/2952-10-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download