General Info

File name

jsworm.exe

Full analysis
https://app.any.run/tasks/bb5e0399-1e5a-4d5f-a140-efcce7633a61
Verdict
Malicious activity
Analysis date
7/18/2019, 01:07:41
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:

ransomware

Indicators:

MIME:
application/x-dosexec
File info:
PE32 executable (GUI) Intel 80386, for MS Windows
MD5

c669320b97f2c124307c3e8ae2e9206d

SHA1

7600f09f914830fa6054defdb97a8d70ce6036ef

SHA256

46761b8b727f3002d1c73fa6c8568ebcf2ec0066666251f66dcda9d4268e03e8

SSDEEP

3072:77LlFWt1yDzVwq4wk+KdXqSmT9C8Fi7FvSJv+R1Y:77a2XC9+KBJmT9BihSlw+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
300 seconds
Additional time used
240 seconds
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (75.0.3770.100)
  • Google Update Helper (1.3.34.7)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.7.2 (4.7.03062)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.21.27702 (14.21.27702.2)
  • Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702 (14.21.27702)
  • Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702 (14.21.27702)
  • Mozilla Firefox 67.0.4 (x86 en-US) (67.0.4)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • Update for Microsoft .NET Framework 4.7.2 (KB4087364) (1)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB4019990
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Deletes shadow copies
  • cmd.exe (PID: 772)
  • cmd.exe (PID: 2384)
  • cmd.exe (PID: 3496)
Writes file to Word startup folder
  • jsworm.exe (PID: 3484)
Starts BCDEDIT.EXE to disable recovery
  • cmd.exe (PID: 1484)
Actions looks like stealing of personal data
  • jsworm.exe (PID: 3484)
Renames files like Ransomware
  • jsworm.exe (PID: 3484)
Modifies files in Chrome extension folder
  • jsworm.exe (PID: 3484)
Starts MSHTA.EXE for opening HTA or HTMLS files
  • cmd.exe (PID: 3628)
Creates files like Ransomware instruction
  • jsworm.exe (PID: 3484)
Reads the cookies of Mozilla Firefox
  • jsworm.exe (PID: 3484)
Reads the cookies of Google Chrome
  • jsworm.exe (PID: 3484)
Uses TASKKILL.EXE to kill process
  • cmd.exe (PID: 2304)
  • cmd.exe (PID: 3996)
  • cmd.exe (PID: 1356)
  • cmd.exe (PID: 3448)
Writes to a desktop.ini file (may be used to cloak folders)
  • jsworm.exe (PID: 3484)
Uses REG.EXE to modify Windows registry
  • cmd.exe (PID: 1500)
  • cmd.exe (PID: 2980)
Starts CMD.EXE for commands execution
  • jsworm.exe (PID: 3484)
Creates files in the user directory
  • jsworm.exe (PID: 3484)
Creates files in the program directory
  • jsworm.exe (PID: 3484)
Reads internet explorer settings
  • mshta.exe (PID: 2992)
Dropped object may contain Bitcoin addresses
  • jsworm.exe (PID: 3484)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.exe
|   Win32 Executable MS Visual C++ (generic) (42.2%)
.exe
|   Win64 Executable (generic) (37.3%)
.dll
|   Win32 Dynamic Link Library (generic) (8.8%)
.exe
|   Win32 Executable (generic) (6%)
.exe
|   Generic Win/DOS Executable (2.7%)
EXIF
EXE
MachineType:
Intel 386 or later, and compatibles
TimeStamp:
2019:06:25 08:43:51+02:00
PEType:
PE32
LinkerVersion:
14.21
CodeSize:
141312
InitializedDataSize:
9728
UninitializedDataSize:
null
EntryPoint:
0x133b1
OSVersion:
6
ImageVersion:
null
SubsystemVersion:
6
Subsystem:
Windows GUI
Summary
Architecture:
IMAGE_FILE_MACHINE_I386
Subsystem:
IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:
25-Jun-2019 06:43:51
DOS Header
Magic number:
MZ
Bytes on last page of file:
0x0090
Pages in file:
0x0003
Relocations:
0x0000
Size of header:
0x0004
Min extra paragraphs:
0x0000
Max extra paragraphs:
0xFFFF
Initial SS value:
0x0000
Initial SP value:
0x00B8
Checksum:
0x0000
Initial IP value:
0x0000
Initial CS value:
0x0000
Overlay number:
0x0000
OEM identifier:
0x0000
OEM information:
0x0000
Address of NE header:
0x000000F8
PE Headers
Signature:
PE
Machine:
IMAGE_FILE_MACHINE_I386
Number of sections:
3
Time date stamp:
25-Jun-2019 06:43:51
Pointer to Symbol Table:
0x00000000
Number of symbols:
0
Size of Optional Header:
0x00E0
Characteristics
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
Sections
Name Virtual Address Virtual Size Raw Size Charateristics Entropy
.text 0x00001000 0x000226E8 0x00021800 IMAGE_SCN_CNT_CODE,IMAGE_SCN_MEM_EXECUTE,IMAGE_SCN_MEM_READ,IMAGE_SCN_MEM_WRITE 6.49858
.idata 0x00024000 0x00000A36 0x00000C00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_READ 4.86106
.reloc 0x00025000 0x00001848 0x00001A00 IMAGE_SCN_CNT_INITIALIZED_DATA,IMAGE_SCN_MEM_DISCARDABLE,IMAGE_SCN_MEM_READ 6.43537
Resources

No resources.

Imports
    KERNEL32.dll

    ADVAPI32.dll

    SHELL32.dll

    CRYPT32.dll

Exports

    No exports.

Screenshots

Processes

Total processes
71
Monitored processes
25
Malicious processes
4
Suspicious processes
0

Behavior graph

+
start jsworm.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs vssadmin.exe no specs cmd.exe no specs cmd.exe no specs bcdedit.exe no specs bcdedit.exe no specs wbadmin.exe no specs mshta.exe no specs wmic.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3484
CMD
"C:\Users\admin\AppData\Local\Temp\jsworm.exe"
Path
C:\Users\admin\AppData\Local\Temp\jsworm.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\jsworm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ole32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\propsys.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\userenv.dll

PID
1500
CMD
"C:\Windows\System32\cmd.exe" /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zapiska" /d "C:\ProgramData\JSWRM-DECRYPT.txt" -y
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
2980
CMD
"C:\Windows\System32\cmd.exe" /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zapiska" /d "C:\ProgramData\JSWRM-DECRYPT.txt" -y
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
3448
CMD
"C:\Windows\System32\cmd.exe" /c taskkill.exe taskkill /f /im store.exe
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
3780
CMD
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zapiska" /d "C:\ProgramData\JSWRM-DECRYPT.txt" -y
Path
C:\Windows\system32\reg.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Registry Console Tool
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
3996
CMD
"C:\Windows\System32\cmd.exe" /c taskkill.exe taskkill /f /im sqlserver.exe
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
1356
CMD
"C:\Windows\System32\cmd.exe" /c taskkill.exe taskkill /f /im dns.exe
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
2936
CMD
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "zapiska" /d "C:\ProgramData\JSWRM-DECRYPT.txt" -y
Path
C:\Windows\system32\reg.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Registry Console Tool
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
2304
CMD
"C:\Windows\System32\cmd.exe" /c taskkill.exe taskkill /f /im sqlwriter.exe
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
4056
CMD
taskkill.exe taskkill /f /im store.exe
Path
C:\Windows\system32\taskkill.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Terminates Processes
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\winsta.dll

PID
2888
CMD
taskkill.exe taskkill /f /im sqlserver.exe
Path
C:\Windows\system32\taskkill.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Terminates Processes
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\winsta.dll

PID
3412
CMD
taskkill.exe taskkill /f /im dns.exe
Path
C:\Windows\system32\taskkill.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Terminates Processes
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\winsta.dll

PID
3612
CMD
taskkill.exe taskkill /f /im sqlwriter.exe
Path
C:\Windows\system32\taskkill.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Terminates Processes
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\mpr.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\winsta.dll

PID
3628
CMD
"C:\Windows\System32\cmd.exe" /c start C:\ProgramData\JSWRM-DECRYPT.hta
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\propsys.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\mshta.exe
c:\windows\system32\setupapi.dll
c:\windows\system32\devobj.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll

PID
2384
CMD
"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
2
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\vssadmin.exe

PID
2220
CMD
"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures -y
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
1484
CMD
"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No -y
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
3488
CMD
vssadmin.exe delete shadows /all /quiet
Path
C:\Windows\system32\vssadmin.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
2
Version:
Company
Microsoft Corporation
Description
Command Line Interface for Microsoft® Volume Shadow Copy Service
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\vssadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\vsstrace.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\vssapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll

PID
3496
CMD
"C:\Windows\System32\cmd.exe" /c wbadmin delete catalog -quiet
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
4294967294
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\wbadmin.exe

PID
772
CMD
"C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete -y
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
jsworm.exe
User
admin
Integrity Level
MEDIUM
Exit code
44506
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\apphelp.dll

PID
3800
CMD
bcdedit /set {default} bootstatuspolicy ignoreallfailures -y
Path
C:\Windows\system32\bcdedit.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Boot Configuration Data Editor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\windows\system32\bcdedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll

PID
3568
CMD
bcdedit /set {default} recoveryenabled No -y
Path
C:\Windows\system32\bcdedit.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Boot Configuration Data Editor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\bcdedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

PID
2724
CMD
wbadmin delete catalog -quiet
Path
C:\Windows\system32\wbadmin.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
4294967294
Version:
Company
Microsoft Corporation
Description
Command Line Interface for Microsoft® BLB Backup
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\wbadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\slc.dll
c:\windows\system32\credui.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll

PID
2992
CMD
"C:\Windows\System32\mshta.exe" "C:\ProgramData\JSWRM-DECRYPT.hta"
Path
C:\Windows\System32\mshta.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Microsoft (R) HTML Application host
Version
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\mshta.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\psapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\msls31.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\clbcatq.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msimtf.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\sxs.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\imgutil.dll
c:\windows\system32\pngfilt.dll
c:\windows\system32\msimg32.dll

PID
3892
CMD
wmic shadowcopy delete -y
Path
C:\Windows\System32\Wbem\WMIC.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
44506
Version:
Company
Microsoft Corporation
Description
WMI Commandline Utility
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\secur32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\program files\common files\microsoft shared\office14\msoxmlmf.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll

Registry activity

Total events
266
Read events
254
Write events
12
Delete events
0

Modification events

PID
Process
Operation
Key
Name
Value
3484
jsworm.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3484
jsworm.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3628
cmd.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3628
cmd.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2992
mshta.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2992
mshta.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1

Files activity

Executable files
0
Suspicious files
1717
Text files
2133
Unknown types
42

Dropped files

PID
Process
Filename
Type
3484
jsworm.exe
C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\STINTL.DLL.trx_dll
binary
MD5: 5c016c58a96a76c979cbc6bf41336bd1
SHA256: f18cb45428b236bc4589f04a9dbd35b77f4351daf0bea184319f7dc9098c9226
3484
jsworm.exe
C:\Users\Public\Videos\Sample Videos\Wildlife.wmv
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Videos\Sample Videos\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b793ef3c74a1b1188f8aaea3a4152cd9
SHA256: ae1241f245cab64ef031f3af609f96d44d32168cd5f80c86380372c457a3ef30
3484
jsworm.exe
C:\Users\Public\Videos\Sample Videos\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Videos\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8ae12a9c24ad57a072b69501c4680f2d
SHA256: af76f55229d5c245587f072b16952ac29ff6743a398265d4c3271656f82b5aac
3484
jsworm.exe
C:\Users\Public\Videos\Sample Videos\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\Videos\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Recorded TV\Sample Media\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 01585131cd751becd2f7fc58fbae9fc5
SHA256: b95b0ab94ff511a3272f1ff669070b0392884b039dab5e0f97d14cda3e25772b
3484
jsworm.exe
C:\Users\Public\Recorded TV\Sample Media\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\Recorded TV\Sample Media\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Recorded TV\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6e1955634b38cbaf4b0b76dc3e459701
SHA256: fb1fe02c27194fa7e0e4f448f9e9dbe706d711e4368f4ec1f412dc4eb0db0c9c
3484
jsworm.exe
C:\Users\Public\Recorded TV\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: fb9a113d82c2099f2bb8fa6ed0a62cbf
SHA256: 32d4ee1511b7141273cd0265dc13015dc21475ab457d16f46046e1fa3bf2e31c
3484
jsworm.exe
C:\Users\Public\Recorded TV\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: cce2df7159ccb23e0d31e0a6b7dcf191
SHA256: 176b9378a83708a991e4d7d6065592a5e08874dd8f30523a253a862b6aafafea
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4740cf5c293998d3b7475d87cd20c204
SHA256: 6a7cbd7474c625750e4e234fa10fb63efecdb569131f91825462b28e0a6d15cb
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: af84d1fde57d451f4ef337fe92804a7a
SHA256: 63f7f34ea45b53a99b62138074d453c7a72dab6df9c833f68b87922266088eab
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Koala.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 585461cbdb0c80391efb93472b801b9f
SHA256: c2e36142a99713409b227144c0cf98152fd8202113ad70cbd6c2899b20b6e6a6
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e2dccfbee61ceccd0966a1525045c17f
SHA256: 2441c3869ade582615c5f69e55bca17cbf2369db7b8636228fd3904e397fa82b
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 522c3d2c87aaae7bd7f06dc2286b59c0
SHA256: b9a0e31d4b2319435ebb14ee4564cdecf086c182cf7ca69a6d6477596a9bc43b
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
txt
MD5: c4384efbd8677db4a9c575b5b0f245bf
SHA256: 290e7c8bfd4311335ad818b8c943494d631e91a67b859a9cd5ecfc34f07e3a9f
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Desert.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 36cdd5f16790dc2ca134ce26409e4b63
SHA256: 4f358d30456bc0389b2ee838328e78100e17ac6e5b4f2e45455c05e02e0bfbc2
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Pictures\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 28590eb2dc1b471617d2ce42e0081df3
SHA256: 759b9cbb3fb5f9266f3440407a439a6d3eb5df45b6437217925dd3fe2f30a2c8
3484
jsworm.exe
C:\Users\Public\Pictures\Sample Pictures\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\Pictures\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Music\Sample Music\Sleep Away.mp3.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Music\Sample Music\Sleep Away.mp3
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4d29cf708ab6885ed787162b36319199
SHA256: 8ef17640ebabaded68ec0a002860d152f3e127becff05a12ef3253d158e3f2cd
3484
jsworm.exe
C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Music\Sample Music\Kalimba.mp3.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Music\Sample Music\Kalimba.mp3
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Music\Sample Music\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\Music\Sample Music\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 41edbe6892f88ebc75839d110df5d0ca
SHA256: c3db20d83890a1bb09271d3325b50dc05040754717b80d4fba417899fd135ce0
3484
jsworm.exe
C:\Users\Public\Music\Sample Music\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Downloads\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\Libraries\RecordedTV.library-ms.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0bbd2c2f8efe30e0dd8d451a0affbaa9
SHA256: 9726ddb5ed221ee4740389e20f7df1ee678ef2344a4d70bed97a78adc239b7bb
3484
jsworm.exe
C:\Users\Public\Libraries\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 407b21b2b545cf29de41d87a42ec2881
SHA256: f585ed95f6749e513643ec489e04600815cb13e2628578b4152407639b59ee78
3484
jsworm.exe
C:\Users\Public\Music\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 52bcfc33cc02a640e97bd8b8dba2c916
SHA256: 99ed806d6788ecbd2ad7ea916edcf3ad7aff228b3ce8a0c183010e77ef7de417
3484
jsworm.exe
C:\Users\Public\Libraries\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\Pictures\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\Videos\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\Downloads\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a40c1514e4858c2d31a80ce314b94467
SHA256: 8ea2600790d89d07692802474ec667d247d5a6d4f63ff66728d56759d05cb3f6
3484
jsworm.exe
C:\Users\Public\Libraries\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Downloads\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Music\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Libraries\RecordedTV.library-ms
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\Music\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\Public\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 18b3d189781a7b9990802a92b9fa623d
SHA256: ae6d9536635d77552835ff79f901eef43f76d4e9cc255e7a3b2325282f76ed5c
3484
jsworm.exe
C:\Users\Public\Documents\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 10875d47918934dd4f9669221e703284
SHA256: b3fdb403383e892850e21ae214c9343b8d498d9d37683495700e0ba6a333b596
3484
jsworm.exe
C:\Users\Public\Documents\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\Public\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\qemu-ga\qga.state
ini
MD5: f9da19a59831c9ff945befe5f1ba6e08
SHA256: 36fa37417b09800574777cdf84b6347d42d39810b929c38ce0f1bb331dd8ceb3
3484
jsworm.exe
\Device\HarddiskVolume2\ProgramData\qemu-ga\qga.state.[ID-D5WOCIX][[email protected]].JSWRM
ini
MD5: f9da19a59831c9ff945befe5f1ba6e08
SHA256: 36fa37417b09800574777cdf84b6347d42d39810b929c38ce0f1bb331dd8ceb3
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\state.rsm.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2b9c6aff4820805d09eada78d2fa0b19
SHA256: b3d73832a2e0a3948486008a041506c052b8fd831e1ebbe4c5f51757ffc34fee
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Package Cache\{49697869-be8e-427d-81a0-c334d1d14950}\state.rsm
binary
MD5: 2b9c6aff4820805d09eada78d2fa0b19
SHA256: b3d73832a2e0a3948486008a041506c052b8fd831e1ebbe4c5f51757ffc34fee
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a375a0facd5270ae2fb64a18080b2413
SHA256: 76189607e2a6503d24692f568edcaaa84d740235bac4d461bbde86bfffd1bb13
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Package Cache\{f65db027-aff3-4070-886a-0d87064aabb1}\state.rsm
binary
MD5: a375a0facd5270ae2fb64a18080b2413
SHA256: 76189607e2a6503d24692f568edcaaa84d740235bac4d461bbde86bfffd1bb13
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Package Cache\564F02E6419B9858949B0CD5A65E2C8C0944DD88\packages\Patch\x86\Windows6.1-KB2999226-x86.msu
binary
MD5: df859bc8a7a913097a85c2a3d98eabe2
SHA256: 3724610cd058b70be4dd3aff44c798c7f78920b6725a13261541c087776168e8
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Package Cache\564F02E6419B9858949B0CD5A65E2C8C0944DD88\packages\Patch\x86\Windows6.1-KB2999226-x86.msu.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: df859bc8a7a913097a85c2a3d98eabe2
SHA256: 3724610cd058b70be4dd3aff44c798c7f78920b6725a13261541c087776168e8
3484
jsworm.exe
\Device\HarddiskVolume2\ProgramData\Oracle\Java\java.settings.cfg.[ID-D5WOCIX][[email protected]].JSWRM
text
MD5: 962f2758cdd1843697da119f7ab108b9
SHA256: 8aa3fbde0887aa0b0c89a3f3ae56b5b6611023c21984be2dad84b9dee675d212
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Oracle\Java\java.settings.cfg
text
MD5: 962f2758cdd1843697da119f7ab108b9
SHA256: 8aa3fbde0887aa0b0c89a3f3ae56b5b6611023c21984be2dad84b9dee675d212
3484
jsworm.exe
\Device\HarddiskVolume2\ProgramData\Oracle\Java\installcache\baseimagefam8.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Oracle\Java\installcache\baseimagefam8
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4cd502718dfdc5f40bd8e86aa82b149a
SHA256: 6fc50a00b3e3d8ad34f7e03f86dd14fd9848b98ca400be285a3b9b352493db7f
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.WINWORD.DEV.14.1033.hxn
binary
MD5: 4cd502718dfdc5f40bd8e86aa82b149a
SHA256: 6fc50a00b3e3d8ad34f7e03f86dd14fd9848b98ca400be285a3b9b352493db7f
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\nslist.hxl
binary
MD5: 4fb8a0b18733dd5503241a6c7fd439e2
SHA256: dc6a886d38b017c1112b0aa8896e3797e536db41554f7c2e956b366450a7e605
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2b3cb6ec8bf82844f0606cb03c83b5b7
SHA256: 049aaeac1aa0e372586fb8061865f53f4171bb8f1a2d719e9f36d1a980248856
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\nslist.hxl.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4fb8a0b18733dd5503241a6c7fd439e2
SHA256: dc6a886d38b017c1112b0aa8896e3797e536db41554f7c2e956b366450a7e605
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn
binary
MD5: 43a85740da6dfee5f41a349e1bfed344
SHA256: 827cb3f238da55a5612763215653a90af4ca77cbfe40a05b54850b15bcd54c33
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.WINWORD.14.1033.hxn
binary
MD5: 2b3cb6ec8bf82844f0606cb03c83b5b7
SHA256: 049aaeac1aa0e372586fb8061865f53f4171bb8f1a2d719e9f36d1a980248856
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.POWERPNT.DEV.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 43a85740da6dfee5f41a349e1bfed344
SHA256: 827cb3f238da55a5612763215653a90af4ca77cbfe40a05b54850b15bcd54c33
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2072366d66707ef243adc6c25204f8e3
SHA256: 093fa03da842112a082d4c5f9ab3fe636fea2fd220f812b85d063da02b1eb74a
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.SETLANG.14.1033.hxn
binary
MD5: 2072366d66707ef243adc6c25204f8e3
SHA256: 093fa03da842112a082d4c5f9ab3fe636fea2fd220f812b85d063da02b1eb74a
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8137ff649b541ea7bfe4fbc99e93beb5
SHA256: 5741022dfe8ee88f90fab3552d2dbb4de281a90b24a6ee7b58917d9169acda32
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.POWERPNT.14.1033.hxn
binary
MD5: 8137ff649b541ea7bfe4fbc99e93beb5
SHA256: 5741022dfe8ee88f90fab3552d2dbb4de281a90b24a6ee7b58917d9169acda32
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn
binary
MD5: 9e4befff3b4ae661c0ff2eb4201d1a5b
SHA256: 0f461fb44ddd85b52bef9784d206e9ec5d3da7c7872ff993b1e92ddec88e7379
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.OUTLOOK.DEV.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9e4befff3b4ae661c0ff2eb4201d1a5b
SHA256: 0f461fb44ddd85b52bef9784d206e9ec5d3da7c7872ff993b1e92ddec88e7379
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d4649cede8e97b3e01d01308598a1ad1
SHA256: 30cd6187970aef23936555a7d583845070de1123199ad9963167f2501920cedb
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.OUTLOOK.14.1033.hxn
binary
MD5: d4649cede8e97b3e01d01308598a1ad1
SHA256: 30cd6187970aef23936555a7d583845070de1123199ad9963167f2501920cedb
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn
binary
MD5: 89900c08f0cbc0e156fa51ee8df31ff4
SHA256: 58eac67d76e086a5c09f4c8068eb86f32ee2a5059f1b5010eaedea8e3147ad0b
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn
binary
MD5: dab9690d66fdb595b3d6f0fcdf5eae3e
SHA256: 9d153631d8c2573fddc7f34125d4cbc2abfc6f8210f36c5ba15126b9ffed5407
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn
binary
MD5: 839ac7ecca32f52aa0c29520c63ebff2
SHA256: e626b4612fe8777c08a8fa5d95586a42c3204becc162977476a10e836da788a5
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSPUB.DEV.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: dab9690d66fdb595b3d6f0fcdf5eae3e
SHA256: 9d153631d8c2573fddc7f34125d4cbc2abfc6f8210f36c5ba15126b9ffed5407
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1734d9d592a22fafd0ec4ae4a22a5590
SHA256: 2f1b2e510d6d567dbddf45954be4982ebe1a14719694ba2998a98ea2096f35d2
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.ONENOTE.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 839ac7ecca32f52aa0c29520c63ebff2
SHA256: e626b4612fe8777c08a8fa5d95586a42c3204becc162977476a10e836da788a5
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSTORE.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 89900c08f0cbc0e156fa51ee8df31ff4
SHA256: 58eac67d76e086a5c09f4c8068eb86f32ee2a5059f1b5010eaedea8e3147ad0b
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn
binary
MD5: 6b0c08a3de3e20cd1ab15cbc1f7e17a1
SHA256: 1b218009381cc9baf22ad45288103a67807e308f3259a737a1997928c007be2b
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.OIS.14.1033.hxn
binary
MD5: 1734d9d592a22fafd0ec4ae4a22a5590
SHA256: 2f1b2e510d6d567dbddf45954be4982ebe1a14719694ba2998a98ea2096f35d2
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSPUB.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6b0c08a3de3e20cd1ab15cbc1f7e17a1
SHA256: 1b218009381cc9baf22ad45288103a67807e308f3259a737a1997928c007be2b
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn
binary
MD5: bf863b324efc3f73267c90a1cc74bd45
SHA256: 2a22e6ab4252be934a41539129734ba7783e1309d66d10f603d01c416b8a3e07
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSACCESS.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: bf863b324efc3f73267c90a1cc74bd45
SHA256: 2a22e6ab4252be934a41539129734ba7783e1309d66d10f603d01c416b8a3e07
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: bb04280965b2efd7f7d0998b1ec7393a
SHA256: 8dd401a8cfcf1de6d4813b89617f754d9e7dd71a06a098d600868ee361321544
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d9037f537db8461e52a1466fd983bce1
SHA256: 2693784c33dd0ae9baa00da39140778ece2c29bbb804a765f881e7fdd1fa260d
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSOUC.14.1033.hxn
binary
MD5: d9037f537db8461e52a1466fd983bce1
SHA256: 2693784c33dd0ae9baa00da39140778ece2c29bbb804a765f881e7fdd1fa260d
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.MSACCESS.DEV.14.1033.hxn
binary
MD5: bb04280965b2efd7f7d0998b1ec7393a
SHA256: 8dd401a8cfcf1de6d4813b89617f754d9e7dd71a06a098d600868ee361321544
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b5e31170e4b1625bae4a8ac06c7e384c
SHA256: 5d69e1b4663fba588b6c61976a54424f09caef57679388538866a06c01c47128
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: f4685ba7c76172184955ca81a1066245
SHA256: 54a033e20239bea72ae7b0a21fbda47a4c71d43d88f0f13970c566bda8fc2c51
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.GRAPH.14.1033.hxn
binary
MD5: b5e31170e4b1625bae4a8ac06c7e384c
SHA256: 5d69e1b4663fba588b6c61976a54424f09caef57679388538866a06c01c47128
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn
binary
MD5: f4685ba7c76172184955ca81a1066245
SHA256: 54a033e20239bea72ae7b0a21fbda47a4c71d43d88f0f13970c566bda8fc2c51
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5adac4df654a850c11c87e425248c18e
SHA256: 8a502dfb2f8763ddf720f1b81d65cdbb839512572fc7acb7ad7805e60a1e9c73
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH
binary
MD5: 168f127245c0fc2efe5a55616f014698
SHA256: a06a4f6c69e4f0c6cefc81a47c0eda598fec39f86ef8f14efc44d8778d17d1ed
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MValidator.Lck
text
MD5: b485167c5b0e59d47009a16f90fe2659
SHA256: db44b8db4f05d720ef1a57abadeed0c164d47b17416c7dd7d136d8f10fba91c9
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\MS.EXCEL.14.1033.hxn
binary
MD5: 5adac4df654a850c11c87e425248c18e
SHA256: 8a502dfb2f8763ddf720f1b81d65cdbb839512572fc7acb7ad7805e60a1e9c73
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MValidator.Lck.[ID-D5WOCIX][[email protected]].JSWRM
text
MD5: b485167c5b0e59d47009a16f90fe2659
SHA256: db44b8db4f05d720ef1a57abadeed0c164d47b17416c7dd7d136d8f10fba91c9
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MTOC_Hx.HxH.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 168f127245c0fc2efe5a55616f014698
SHA256: a06a4f6c69e4f0c6cefc81a47c0eda598fec39f86ef8f14efc44d8778d17d1ed
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e7443afcc155c851c9532d39a8e1cd40
SHA256: 1773cb8c6b48f390d1d86dadddeb71ff076ea047b3472d4a2315992027b48f3e
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MValidator.HxD
binary
MD5: e7443afcc155c851c9532d39a8e1cd40
SHA256: 1773cb8c6b48f390d1d86dadddeb71ff076ea047b3472d4a2315992027b48f3e
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 07130f6b40a6e7e9c51c81642ec7ddf0
SHA256: 82c765496f822988ce0d123f952d5986bf30d2f51b73281ee0881b2bc4ff91ee
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW
binary
MD5: 07130f6b40a6e7e9c51c81642ec7ddf0
SHA256: 82c765496f822988ce0d123f952d5986bf30d2f51b73281ee0881b2bc4ff91ee
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: f8c81e3ea259f3fe9988a5f8da9ab06c
SHA256: 75688da0afaca433d8047df65cc5f36e39f55d60e4804727e487550daf66cb0c
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW
binary
MD5: f8c81e3ea259f3fe9988a5f8da9ab06c
SHA256: 75688da0afaca433d8047df65cc5f36e39f55d60e4804727e487550daf66cb0c
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx.hxn
binary
MD5: 907481b4cd678f6b5212c38415547372
SHA256: 53f2f7544ad884d30e106e181e0ecc46ec8d67feb93c0ad25dffa0f76e5464da
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft Help\Hx.hxn.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 907481b4cd678f6b5212c38415547372
SHA256: 53f2f7544ad884d30e106e181e0ecc46ec8d67feb93c0ad25dffa0f76e5464da
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol
binary
MD5: 129d4621277eb59604af4efad95f7cf7
SHA256: 732f37a1fcfaac68ae7a86528d414729bc30c4389168ca74dfaa1ab6415eb109
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 129d4621277eb59604af4efad95f7cf7
SHA256: 732f37a1fcfaac68ae7a86528d414729bc30c4389168ca74dfaa1ab6415eb109
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 766e0fe1366d87c0aad99c9deb0a460f
SHA256: 3f726f51fbe5e3accf536190489688a8a05df84e27a57c0e15ed93dbb886ee59
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch
binary
MD5: 766e0fe1366d87c0aad99c9deb0a460f
SHA256: 3f726f51fbe5e3accf536190489688a8a05df84e27a57c0e15ed93dbb886ee59
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8d4956424a961b14dc77ee0d6b4c1ac1
SHA256: caa7c30b1da4d8bacd151e09550dd38d2c6a926173d31fc59b1929cbee557c2f
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch
binary
MD5: 8d4956424a961b14dc77ee0d6b4c1ac1
SHA256: caa7c30b1da4d8bacd151e09550dd38d2c6a926173d31fc59b1929cbee557c2f
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat
binary
MD5: 66b5d164a63a5197b1925e27672d1a68
SHA256: 11eb76fce9dae404fcea1c0bedb0538832b422d92c9f0ef0d5ca77d16da3688b
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 66b5d164a63a5197b1925e27672d1a68
SHA256: 11eb76fce9dae404fcea1c0bedb0538832b422d92c9f0ef0d5ca77d16da3688b
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\XLSLICER.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 64d9f9e19731ea0b8845ea0b6c3b7e4d
SHA256: 4c6d884fb090ed60ba524f6c05880ab2bb850025d473b3be846fd1e355c6a5cf
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\XLSLICER.DLL.trx_dll
binary
MD5: 64d9f9e19731ea0b8845ea0b6c3b7e4d
SHA256: 4c6d884fb090ed60ba524f6c05880ab2bb850025d473b3be846fd1e355c6a5cf
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\XLINTL32.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 20c4b16b0d4b9596f619a0de767e5279
SHA256: fcca60dd01242f3f5fbbf937724d807bab589c572cf971849070f34f9b080aee
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\XLINTL32.REST.trx_dll
binary
MD5: 20c4b16b0d4b9596f619a0de767e5279
SHA256: fcca60dd01242f3f5fbbf937724d807bab589c572cf971849070f34f9b080aee
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\XLINTL32.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a81fa8426638481e51362f5b155448ab
SHA256: 0f39fec5c116e60ec2d8a15882a8d793ce8712401528ceb6dd53208a575083bb
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\XLINTL32.DLL.trx_dll
binary
MD5: a81fa8426638481e51362f5b155448ab
SHA256: 0f39fec5c116e60ec2d8a15882a8d793ce8712401528ceb6dd53208a575083bb
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\WWINTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0e931dcb53ceff56c8d3b61ba017d28d
SHA256: 2b6c65a4d1df6f2abd8fe92ade3420122e1fc8c271c4c49ae03318ee114eeeb4
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\WWINTL.REST.trx_dll
binary
MD5: 0e931dcb53ceff56c8d3b61ba017d28d
SHA256: 2b6c65a4d1df6f2abd8fe92ade3420122e1fc8c271c4c49ae03318ee114eeeb4
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\WWINTL.DLL.trx_dll
binary
MD5: cf49d298a6245b7cc2d48e1d941b35f5
SHA256: b5e2db19920fff5098327cc6deb60a42fbba1d04dd7c12c5693c430e5dd2a59b
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\WWINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: cf49d298a6245b7cc2d48e1d941b35f5
SHA256: b5e2db19920fff5098327cc6deb60a42fbba1d04dd7c12c5693c430e5dd2a59b
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\VISINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: fa45906926bde4fbb9f0d854b4e357b2
SHA256: 41397d0fe2e073322bc8e49bbda4c54c598b040460b4bb49946f18b63ada1551
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\VISINTL.DLL.trx_dll
binary
MD5: fa45906926bde4fbb9f0d854b4e357b2
SHA256: 41397d0fe2e073322bc8e49bbda4c54c598b040460b4bb49946f18b63ada1551
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\VISBRRES.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 66d7b44e3e97696d60829c5c8ec9d322
SHA256: d71d2a34ffce047fde26bada949a5823816e6446f0f8876b5c434b0661f48c30
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\SGRES.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 7bfb937242456db3b79d8afa9613835a
SHA256: 2c6a3c6b1f611a2c4d4d0571fe69a7b7e8e30d0b781e440b6e5fa1958842785d
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\STINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 493f77e2e5e37d7c1895dd01f9decf9d
SHA256: a81852746d014ad50c85b0cb9635d62bcbd3457ec8fbe39ca3e0e1691787ded7
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\VISBRRES.DLL.trx_dll
binary
MD5: 66d7b44e3e97696d60829c5c8ec9d322
SHA256: d71d2a34ffce047fde26bada949a5823816e6446f0f8876b5c434b0661f48c30
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\STINTL.DLL.trx_dll
binary
MD5: 493f77e2e5e37d7c1895dd01f9decf9d
SHA256: a81852746d014ad50c85b0cb9635d62bcbd3457ec8fbe39ca3e0e1691787ded7
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PUBWZINT.REST.trx_dll
binary
MD5: 092289ca01c9b1e0c3e17c4f77bb1a58
SHA256: fd943db0a4404a9dd9e5cafecc7c45d09161d36948f3f4a2a37238bc4c0ec636
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\SGRES.DLL.trx_dll
binary
MD5: 7bfb937242456db3b79d8afa9613835a
SHA256: 2c6a3c6b1f611a2c4d4d0571fe69a7b7e8e30d0b781e440b6e5fa1958842785d
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PUBWZINT.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 092289ca01c9b1e0c3e17c4f77bb1a58
SHA256: fd943db0a4404a9dd9e5cafecc7c45d09161d36948f3f4a2a37238bc4c0ec636
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PUB6INTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 863c3811e9c9d47cb13bf7f2c626091b
SHA256: 9a927f98eccd00b71c887f6317d6017879b301eceb2d8eec5ba6d223f53f78bd
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PUB6INTL.REST.trx_dll
binary
MD5: 863c3811e9c9d47cb13bf7f2c626091b
SHA256: 9a927f98eccd00b71c887f6317d6017879b301eceb2d8eec5ba6d223f53f78bd
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PUB6INTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5383bb3fe2b09e3e5659b296eea0cf72
SHA256: fe799684ead97cfaed34c6009073d03bbe35d0f5b44bc1532a1fcfb4cff74313
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PPINTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 347edb9b029fe51230918ef4ea916b0a
SHA256: 6a4dad603ace222fb3b990ba6a8fb6ff5a0070dda73790b74431ce801f54ac5c
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PUB6INTL.DLL.trx_dll
binary
MD5: 5383bb3fe2b09e3e5659b296eea0cf72
SHA256: fe799684ead97cfaed34c6009073d03bbe35d0f5b44bc1532a1fcfb4cff74313
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PPINTL.REST.trx_dll
binary
MD5: 347edb9b029fe51230918ef4ea916b0a
SHA256: 6a4dad603ace222fb3b990ba6a8fb6ff5a0070dda73790b74431ce801f54ac5c
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PPINTL.DLL.trx_dll
binary
MD5: 0b379e639342e1a4f5656059cb6dba51
SHA256: cd20dbfbc65d607d98e48653d89a4790fc22d7a357a6d8e710a642fc9aa78b1c
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\PPINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0b379e639342e1a4f5656059cb6dba51
SHA256: cd20dbfbc65d607d98e48653d89a4790fc22d7a357a6d8e710a642fc9aa78b1c
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\OUTLWVW.DLL.trx_dll
binary
MD5: ae787954b4d1ee80a37b7b8a00e4b975
SHA256: 4ea87aeac90d13c87fda9cb114c316643bd229bf408c92fea1187b96e4b66fdd
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\OUTLLIBR.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: bd946a885eb1ed1c53837b2c9c583cff
SHA256: 3296235ee31c819f9f797309659794148032aef6e9c2309c3fdccb7aa4b384b5
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\OUTLLIBR.REST.trx_dll
binary
MD5: bd946a885eb1ed1c53837b2c9c583cff
SHA256: 3296235ee31c819f9f797309659794148032aef6e9c2309c3fdccb7aa4b384b5
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\OUTLWVW.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: ae787954b4d1ee80a37b7b8a00e4b975
SHA256: 4ea87aeac90d13c87fda9cb114c316643bd229bf408c92fea1187b96e4b66fdd
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\OUTLLIBR.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 7e1107359bb05f11b0840cb19ae8ae71
SHA256: 3c33502507627e6b47e24ce2b7db3a2a754f13f68267009ffb2c9f5b0790159e
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\OUTLLIBR.DLL.trx_dll
binary
MD5: 7e1107359bb05f11b0840cb19ae8ae71
SHA256: 3c33502507627e6b47e24ce2b7db3a2a754f13f68267009ffb2c9f5b0790159e
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\ONINTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5bcd6632a138262419121a7965b969fc
SHA256: 7ff7aaad6bac0da86e494aa169d8b95ab342a16d7cd8f2d3bdc3e4c51f548db9
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\ONINTL.REST.trx_dll
binary
MD5: 5bcd6632a138262419121a7965b969fc
SHA256: 7ff7aaad6bac0da86e494aa169d8b95ab342a16d7cd8f2d3bdc3e4c51f548db9
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\ONINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: c2e2e400ce15f97cc62cb4c006f7a436
SHA256: 4750b5734e04e3b9f7e55cb64ad6aa0906736adc7a49b885bee160cfaf23defb
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\ONINTL.DLL.trx_dll
binary
MD5: c2e2e400ce15f97cc62cb4c006f7a436
SHA256: 4750b5734e04e3b9f7e55cb64ad6aa0906736adc7a49b885bee160cfaf23defb
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\MSOINTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9406d65f3e27bf02e3c8318fb32a1d13
SHA256: dfc1588bfb891236ace1eeb763565eace844d5fb4e7afca69dc07b7f1b19dd0c
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\OMSINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2dcce2822f27bbfb9cb897a897dc2f0a
SHA256: ea6e0cc501d7911b188ddd998c3ab3c3dfe8052dc7ea7c3d76b8d992b9089159
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\OMSINTL.DLL.trx_dll
binary
MD5: 2dcce2822f27bbfb9cb897a897dc2f0a
SHA256: ea6e0cc501d7911b188ddd998c3ab3c3dfe8052dc7ea7c3d76b8d992b9089159
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\MSOINTL.REST.trx_dll
binary
MD5: 9406d65f3e27bf02e3c8318fb32a1d13
SHA256: dfc1588bfb891236ace1eeb763565eace844d5fb4e7afca69dc07b7f1b19dd0c
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\MSOINTL.DLL.trx_dll
binary
MD5: 1a8bbe99d3c7606a6fccd1f80dc16064
SHA256: 3510e613a7813a9854efd32198d7af01131ad276c8fa9cac914b9306c9665bde
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\MSOINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1a8bbe99d3c7606a6fccd1f80dc16064
SHA256: 3510e613a7813a9854efd32198d7af01131ad276c8fa9cac914b9306c9665bde
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\MAPIR.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4e0ab66eea155dc439cdadb9f5807cff
SHA256: 77be37fb9cff4246e87495745484ceab1b50b0185455837f59475ad05e23e742
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\MAPIR.DLL.trx_dll
binary
MD5: 4e0ab66eea155dc439cdadb9f5807cff
SHA256: 77be37fb9cff4246e87495745484ceab1b50b0185455837f59475ad05e23e742
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\MOR6INT.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 88afa7b16171722347b41a9e34373911
SHA256: 70acbf9f5d29eb25d8f8eb832c25259855519ea765dd73bea4b71f281e154dc0
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\MOR6INT.REST.trx_dll
binary
MD5: 88afa7b16171722347b41a9e34373911
SHA256: 70acbf9f5d29eb25d8f8eb832c25259855519ea765dd73bea4b71f281e154dc0
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\GRINTL32.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: cdc05fc3701916a4fda8d74681cfd538
SHA256: de1b4318af19a9e9d3a7f8aa4258fe29961302eff68360864bd046aeb0daa3aa
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\GRINTL32.REST.trx_dll
binary
MD5: cdc05fc3701916a4fda8d74681cfd538
SHA256: de1b4318af19a9e9d3a7f8aa4258fe29961302eff68360864bd046aeb0daa3aa
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\ENVELOPR.DLL.trx_dll
binary
MD5: aaa1ee3b302bca9b2dcf13d34dcb221b
SHA256: 9113f781bc7c5cf462676c76395e81b15f5a23e867296d210f5793c7b014bcb5
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\GRINTL32.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0eb8ea035d3161fe1aeef6672b30bdff
SHA256: fdd03d3a019458611ddc47835a05c5570155626289ba96f9e07cd378ae2ff9df
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\GRINTL32.DLL.trx_dll
binary
MD5: 0eb8ea035d3161fe1aeef6672b30bdff
SHA256: fdd03d3a019458611ddc47835a05c5570155626289ba96f9e07cd378ae2ff9df
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\3082\ENVELOPR.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: aaa1ee3b302bca9b2dcf13d34dcb221b
SHA256: 9113f781bc7c5cf462676c76395e81b15f5a23e867296d210f5793c7b014bcb5
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\XLSLICER.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0b96284a54b7501d4b963d993f0d72ef
SHA256: a1cb0af47d3befec683a8073ad79cdffa6321f6362bd2a7bd0cd4e1f3228e660
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\XLINTL32.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 76fb5ada320c0577b55482337b0f2327
SHA256: 102dca3fe0a5193037773c1746c8b543fea4c4ee7448886749163b2de0e7fb0b
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\XLSLICER.DLL.trx_dll
binary
MD5: 0b96284a54b7501d4b963d993f0d72ef
SHA256: a1cb0af47d3befec683a8073ad79cdffa6321f6362bd2a7bd0cd4e1f3228e660
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\XLINTL32.REST.trx_dll
binary
MD5: 76fb5ada320c0577b55482337b0f2327
SHA256: 102dca3fe0a5193037773c1746c8b543fea4c4ee7448886749163b2de0e7fb0b
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\XLINTL32.DLL.trx_dll
binary
MD5: 9631425274bbd547f4aac465043729df
SHA256: 9f90753494e98981f9c405c4c21e2dceadd825308a1db157c2c0a731964b9fda
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\XLINTL32.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9631425274bbd547f4aac465043729df
SHA256: 9f90753494e98981f9c405c4c21e2dceadd825308a1db157c2c0a731964b9fda
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\WWINTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 25b916e28bb4c686929448046b09c25b
SHA256: 6a39f249c28eb3fcdb068f910ab24ee2447da403d940d0377d064d762e02d02e
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\WWINTL.REST.trx_dll
binary
MD5: 25b916e28bb4c686929448046b09c25b
SHA256: 6a39f249c28eb3fcdb068f910ab24ee2447da403d940d0377d064d762e02d02e
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\WWINTL.DLL.trx_dll
binary
MD5: ed9cb0149599398af7e48e7a5b8fb921
SHA256: c61586a04e3eb940a50925b94526fe56258aaa1f120df4fce7e771c744619717
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\WWINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: ed9cb0149599398af7e48e7a5b8fb921
SHA256: c61586a04e3eb940a50925b94526fe56258aaa1f120df4fce7e771c744619717
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\VISINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3bce5432e2f87ff1572d4da95c3d58c7
SHA256: c78dde2bbe690656e6c16421db6db530e813b07360c59015883bd76de1f540bf
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\VISINTL.DLL.trx_dll
binary
MD5: 3bce5432e2f87ff1572d4da95c3d58c7
SHA256: c78dde2bbe690656e6c16421db6db530e813b07360c59015883bd76de1f540bf
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\VISBRRES.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 78e539f95b1ffd46f7189558c068d421
SHA256: 22c2e868fb041a5e4de7e53c4c69b9dfab6da8dacc7718168c78a478e0771ca6
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\VISBRRES.DLL.trx_dll
binary
MD5: 78e539f95b1ffd46f7189558c068d421
SHA256: 22c2e868fb041a5e4de7e53c4c69b9dfab6da8dacc7718168c78a478e0771ca6
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\STINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5c016c58a96a76c979cbc6bf41336bd1
SHA256: f18cb45428b236bc4589f04a9dbd35b77f4351daf0bea184319f7dc9098c9226
2992
mshta.exe
C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT
smt
MD5: 2b9bcd5c6af7072199d6331a1466c2f4
SHA256: 36555a8f2460e72579d9ff0a49be24553a8e5f50d3c78328ee0a291b0c7cd3a2
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\SGRES.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b6cc7cf46e5c2c0ea7496862f5202112
SHA256: 1090c9751816d8c52f0e26551deaf8c02251dfdf31d9693fbe130ab56ca9a734
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\SGRES.DLL.trx_dll
binary
MD5: b6cc7cf46e5c2c0ea7496862f5202112
SHA256: 1090c9751816d8c52f0e26551deaf8c02251dfdf31d9693fbe130ab56ca9a734
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PUBWZINT.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: efa959bce24b353fa59a0d9fdeb0a460
SHA256: b0d2bacfe14145511f1dbc22ee8ea7b0b219766231fdddfc02785ff1a4bd4538
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PUBWZINT.REST.trx_dll
binary
MD5: efa959bce24b353fa59a0d9fdeb0a460
SHA256: b0d2bacfe14145511f1dbc22ee8ea7b0b219766231fdddfc02785ff1a4bd4538
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PUB6INTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 71b29d05fdeebd4cf5bc0354462df1ef
SHA256: 6bda9890b52ed566a34e059dee9c811e96125a9f581abf5afca7a37100046d2a
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PUB6INTL.REST.trx_dll
binary
MD5: 71b29d05fdeebd4cf5bc0354462df1ef
SHA256: 6bda9890b52ed566a34e059dee9c811e96125a9f581abf5afca7a37100046d2a
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PUB6INTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 49402f2a67b523711c2596632fb0fc53
SHA256: 1448b999f29a2407c0d113cd292b6291e9c10b6cb45e18e1226eded6fc330613
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PUB6INTL.DLL.trx_dll
binary
MD5: 49402f2a67b523711c2596632fb0fc53
SHA256: 1448b999f29a2407c0d113cd292b6291e9c10b6cb45e18e1226eded6fc330613
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PPINTL.REST.trx_dll
binary
MD5: c8505b7a2876b4031ac4e69b80a5a151
SHA256: 27750b686b07ccdea233b126923b9916d0f56c288e80c0b40a0e7e2766bbe770
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PPINTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: c8505b7a2876b4031ac4e69b80a5a151
SHA256: 27750b686b07ccdea233b126923b9916d0f56c288e80c0b40a0e7e2766bbe770
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\OUTLLIBR.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3aff7db8dd74a36a77186d2805a4cc02
SHA256: 641e99cb9e6e34ec66735011fe3e996e6d3a7ab77818ea648befde1e1baa02c5
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\OUTLLIBR.REST.trx_dll
binary
MD5: 3aff7db8dd74a36a77186d2805a4cc02
SHA256: 641e99cb9e6e34ec66735011fe3e996e6d3a7ab77818ea648befde1e1baa02c5
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\OUTLWVW.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 777c996efbb4ee9a84453f36b9feacaa
SHA256: 7a80cdc694d0c04004ce347fd576260412d5c785ae65244ae28105f392b8ff1a
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PPINTL.DLL.trx_dll
binary
MD5: 28e741d57c7c06d675c823e51a262d2e
SHA256: 274dddc776896b73bcf0a038d20bd3509139e3203ccb7fa8a504908dda9d7110
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\OUTLWVW.DLL.trx_dll
binary
MD5: 777c996efbb4ee9a84453f36b9feacaa
SHA256: 7a80cdc694d0c04004ce347fd576260412d5c785ae65244ae28105f392b8ff1a
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\PPINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 28e741d57c7c06d675c823e51a262d2e
SHA256: 274dddc776896b73bcf0a038d20bd3509139e3203ccb7fa8a504908dda9d7110
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\OUTLLIBR.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e7e9293f9a56a62227abd55ce695f569
SHA256: e5e2112ed98e31e50e8f2d5a7cab299b23a5fcbe75b13cdc3fe3bb73539bf4f5
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\OUTLLIBR.DLL.trx_dll
binary
MD5: e7e9293f9a56a62227abd55ce695f569
SHA256: e5e2112ed98e31e50e8f2d5a7cab299b23a5fcbe75b13cdc3fe3bb73539bf4f5
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\ONINTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b7fc4a76b305a14a191c995f445d04c0
SHA256: e2aec268f27b3955628ff7be5d1f0192e9e90b62b3428722aed8a1c400af2f2c
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\ONINTL.REST.trx_dll
binary
MD5: b7fc4a76b305a14a191c995f445d04c0
SHA256: e2aec268f27b3955628ff7be5d1f0192e9e90b62b3428722aed8a1c400af2f2c
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\ONINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a416d395a613049652c0f6dd8a484c1c
SHA256: 4240b682d5fbb8d92b767bf80675e5f5f021c26910c0a4187ff0eafc33cdb4f6
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\ONINTL.DLL.trx_dll
binary
MD5: a416d395a613049652c0f6dd8a484c1c
SHA256: 4240b682d5fbb8d92b767bf80675e5f5f021c26910c0a4187ff0eafc33cdb4f6
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\OMSINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9803a2c063f0b06b8375a67477a9fbf7
SHA256: 4b1c05b2c6f401b3d2221e8e7cb6f70cab06f53003e8ac1c2931be8ec65d5f21
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\OMSINTL.DLL.trx_dll
binary
MD5: 9803a2c063f0b06b8375a67477a9fbf7
SHA256: 4b1c05b2c6f401b3d2221e8e7cb6f70cab06f53003e8ac1c2931be8ec65d5f21
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\MSOINTL.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b3176fc731eb0c7d5bf2b9ae1dbae2fd
SHA256: 020df33fcf57297c40c4ed04ad3374b29bb1f24c4b6773b451b9b65f35d6e3f2
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\MSOINTL.REST.trx_dll
binary
MD5: b3176fc731eb0c7d5bf2b9ae1dbae2fd
SHA256: 020df33fcf57297c40c4ed04ad3374b29bb1f24c4b6773b451b9b65f35d6e3f2
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\MSOINTL.DLL.trx_dll
binary
MD5: 3134e4c7f0623222f058b96386ef5b02
SHA256: 96cdd08cdd8090c8d61270485cc7e13c3d09adfa54c9fabb981906377cc62f56
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\MSOINTL.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3134e4c7f0623222f058b96386ef5b02
SHA256: 96cdd08cdd8090c8d61270485cc7e13c3d09adfa54c9fabb981906377cc62f56
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\MAPIR.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 073c8b553c7f551bc41e736e89d9b9af
SHA256: ac5fc63d2f07773a8b943fe6aec34e0d659650bfe804d9f9f852a34b312500e8
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\MOR6INT.REST.trx_dll
binary
MD5: a0b8a4d26227dd2463da97a8d3284d46
SHA256: 9392af7449294f339f3a5178d2cdfbedd0e8acf541e2542d19415eb07bd324f5
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\MAPIR.DLL.trx_dll
binary
MD5: 073c8b553c7f551bc41e736e89d9b9af
SHA256: ac5fc63d2f07773a8b943fe6aec34e0d659650bfe804d9f9f852a34b312500e8
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\MOR6INT.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a0b8a4d26227dd2463da97a8d3284d46
SHA256: 9392af7449294f339f3a5178d2cdfbedd0e8acf541e2542d19415eb07bd324f5
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\GRINTL32.REST.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 34a0ba2683d873c52a88501079ad672c
SHA256: dfec570dc9c91345155443fe3e963acd0a2856d614b3ef5e654a6bab3427f889
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\GRINTL32.REST.trx_dll
binary
MD5: 34a0ba2683d873c52a88501079ad672c
SHA256: dfec570dc9c91345155443fe3e963acd0a2856d614b3ef5e654a6bab3427f889
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\GRINTL32.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3609d47d18b43469cea78ef947cb3131
SHA256: fff7e5b3a0bb611a9d6066b2e1e5c230ed30b525ce993388a9fe46322608e00f
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\GRINTL32.DLL.trx_dll
binary
MD5: 3609d47d18b43469cea78ef947cb3131
SHA256: fff7e5b3a0bb611a9d6066b2e1e5c230ed30b525ce993388a9fe46322608e00f
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\ENVELOPR.DLL.trx_dll.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: fd4a0ce65ff6b9b9c33e50e42d829c62
SHA256: 6f4d3a699285f375553473c808b4d0a2716f61e759d20bcfe8cd87ff65daeefb
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\UICaptions\1036\ENVELOPR.DLL.trx_dll
binary
MD5: fd4a0ce65ff6b9b9c33e50e42d829c62
SHA256: 6f4d3a699285f375553473c808b4d0a2716f61e759d20bcfe8cd87ff65daeefb
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico
binary
MD5: 2328b84c396c18a20097bfe0ddf19215
SHA256: 99f8fb37d2a400560864c008b1d2a22c744ff48b897ecab3b57b509734b82801
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: fa2d7ddca1081ef0a6b1d6c5c05a0f00
SHA256: 0d061ee95501f31b46d95bbf52472d7043efc70ab717e4c9ac481406a9f62636
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2328b84c396c18a20097bfe0ddf19215
SHA256: 99f8fb37d2a400560864c008b1d2a22c744ff48b897ecab3b57b509734b82801
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico
binary
MD5: fa2d7ddca1081ef0a6b1d6c5c05a0f00
SHA256: 0d061ee95501f31b46d95bbf52472d7043efc70ab717e4c9ac481406a9f62636
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\MySite.ico.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a23b644825c3417d27cd9f9415e51f7b
SHA256: c9a8bc302ba0038aeaa137774be10f73d856e8c2017987722d4b9a7208f47b6f
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\MySite.ico
binary
MD5: a23b644825c3417d27cd9f9415e51f7b
SHA256: c9a8bc302ba0038aeaa137774be10f73d856e8c2017987722d4b9a7208f47b6f
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\MySharePoints.ico.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 7fd2a8ee614e32d66bc1b707ec7cb305
SHA256: 3d9c9214d0a11e71d353197a0ca428e8f0b3e437781fe9f5f3e56f837dfffd82
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\MySharePoints.ico
binary
MD5: 7fd2a8ee614e32d66bc1b707ec7cb305
SHA256: 3d9c9214d0a11e71d353197a0ca428e8f0b3e437781fe9f5f3e56f837dfffd82
3484
jsworm.exe
C:\ProgramData\MICROSOFT\MF\PENDING.GRL
binary
MD5: 6116aecb13f6fa28e457bcf80196027a
SHA256: 034c21f0bc094913001ce1d0d9dfd797adca8d541d969786f3b356c4782a51cc
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\AssetLibrary.ico.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e7cf09c8ad0241d5a47850ee95b212f5
SHA256: 82cc276c7d8dd3b375f7907c4cd6620c587c0d84b423c33aef7a28f69c9f7f02
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\AssetLibrary.ico
binary
MD5: e7cf09c8ad0241d5a47850ee95b212f5
SHA256: 82cc276c7d8dd3b375f7907c4cd6620c587c0d84b423c33aef7a28f69c9f7f02
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\DocumentRepository.ico
binary
MD5: b83ad59cdd17ad1f98d9f0f151bd8d86
SHA256: a548f36268732a9e84950963decb567771ea37e5fd7098a0076e950d512ec3c1
3484
jsworm.exe
\Device\HarddiskVolume2\Users\admin\AppData\Local\VirtualStore\ProgramData\Microsoft\OFFICE\DocumentRepository.ico.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b83ad59cdd17ad1f98d9f0f151bd8d86
SHA256: a548f36268732a9e84950963decb567771ea37e5fd7098a0076e950d512ec3c1
3484
jsworm.exe
C:\ProgramData\MICROSOFT\MF\ACTIVE.GRL
binary
MD5: 6116aecb13f6fa28e457bcf80196027a
SHA256: 034c21f0bc094913001ce1d0d9dfd797adca8d541d969786f3b356c4782a51cc
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Adobe\Setup\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\setup.ini
binary
MD5: 534cdca315dba82004d11b80f4524bd0
SHA256: a3c15ea39c2749179c5b8db601a0dfe37a054d865184dc000bb25d18f80507d1
3484
jsworm.exe
\Device\HarddiskVolume2\ProgramData\Adobe\Setup\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\setup.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 534cdca315dba82004d11b80f4524bd0
SHA256: a3c15ea39c2749179c5b8db601a0dfe37a054d865184dc000bb25d18f80507d1
3484
jsworm.exe
\Device\HarddiskVolume2\ProgramData\Adobe\Setup\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\ABCPY.INI.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d2c9a44f5cc5e119f748bc464a9e7739
SHA256: 351e19c1a4abd1eb681639cc545dac924d1ab6fbeadc45f7953310daf65114c1
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Videos\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: c95620a21a532b3e14165245beb362b1
SHA256: 17b9e76163ba7221457c9f9e7063bc31df8af73dc7b1e91b1e928ef1fcf0f7fd
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Local\VirtualStore\ProgramData\Adobe\Setup\{AC76BA86-7AD7-FFFF-7B44-AC0F074E4100}\ABCPY.INI
binary
MD5: d2c9a44f5cc5e119f748bc464a9e7739
SHA256: 351e19c1a4abd1eb681639cc545dac924d1ab6fbeadc45f7953310daf65114c1
3484
jsworm.exe
C:\Users\admin\Videos\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Searches\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d0248057b3319b46508edc7005a0f801
SHA256: e74fa582425500b3bb8d2ac5f10191eaaa0dd0c5422fe7d93e5671d541c9a54f
3484
jsworm.exe
C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 63224955957f98b9f878329da2f04728
SHA256: daf768fe3c8b9126bbef1ff461f631a760ea3e68e48704a90997f4ad5af9d5da
3484
jsworm.exe
C:\Users\admin\Searches\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Searches\Everywhere.search-ms.[ID-D5WOCIX][[email protected]].JSWRM
xml
MD5: 0fa26b6c98419b5e7c00efffb5835612
SHA256: 4094d158e3b0581ba433a46d0dce62f99d8c0fd1b50bb4d0517ddc0a4a1fde24
3484
jsworm.exe
C:\Users\admin\Searches\Indexed Locations.search-ms.[ID-D5WOCIX][[email protected]].JSWRM
xml
MD5: b6acbeb59959aa5412a7565423ea7bab
SHA256: 99653a38c445ae1d4c373ee672339fd47fd098e0d0ada5f0be70e3b2bf711d38
3484
jsworm.exe
C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 260014410d60b2d54c97bc9a5f4806d0
SHA256: 145549dadc9c4170b495d4e7d9a349c8519512dec70edbc29c2fe0a26e18ffa1
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Saved Games\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 052b8bd2eaa1852ab4418f0fec71bba6
SHA256: c96e6f7d331648c7bb6ce8c1ef60769cca8a719a6ec13501b88f110a3e5b7083
3484
jsworm.exe
C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Searches\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Saved Games\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Pictures\urlrole.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 395049827eecec718e12177c0fa038cd
SHA256: bc4b740610d40ffdc43b34f4a8846bb9c8cc63394c329962993dd8af38edceea
3484
jsworm.exe
C:\Users\admin\Pictures\windserver.png.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2436f7bcb27aaaa66529d18650d2820a
SHA256: f59ff73caab83502cd0be557a48f522b4c7386326a3550586bdfdf6dafd4c2fb
3484
jsworm.exe
C:\Users\admin\Pictures\girlsvalue.png.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6d89f0012960389b3b82916e71105399
SHA256: b8d4aaaa9a9dbf11a230bed687cf7ac01623bf0a0c2c56c6d2d8bea8e6326197
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Pictures\windserver.png
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Pictures\girlsvalue.png
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Saved Games\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Pictures\urlrole.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\ntuser.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 7b0efadee7873b756591827d1597bfb4
SHA256: 4754632c6b0e6c5ae441aec6d6aae4f83e403754affb93a95a6d846b5d8a6757
3484
jsworm.exe
C:\Users\admin\Pictures\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 899ef5af925c4585bc505547f0de6661
SHA256: 53735ae287ff83206ea8cdb9739c0f477c0e765c6f71e5020a0882fb95de1961
3484
jsworm.exe
C:\Users\admin\ntuser.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Pictures\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Music\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8feee30c955e150ca175ce257118503a
SHA256: de5bea53f5af58e05eab620092c576485703b8f9f2bb91f7abc18e6b2b83ad6c
3484
jsworm.exe
C:\Users\admin\Links\Downloads.lnk.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 13c75f65cd78d945567f4e326e30d9f1
SHA256: 7ca5c3bcddcf7792e3240fdec092df38da88fd4cdd9fb2078c14175aa7d61a26
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Links\RecentPlaces.lnk.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 432f5dc1a5b78aaa927af6af357b493d
SHA256: 20c4d03909aca3900bf714b0fcdb442439a8abede0cca444b18fbe78aaebf704
3484
jsworm.exe
C:\Users\admin\Music\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Links\RecentPlaces.lnk
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Links\Desktop.lnk.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 92034be4020e245d36bd5308feda5fa7
SHA256: d7a392ed45dedd5eaba3eb632372372af1132f54d8f044dde1a77eda43628587
3484
jsworm.exe
C:\Users\admin\Links\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Links\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 62eb7efcb900fe5899b15f53d166e1bc
SHA256: b540adcfee0ab666d312403b46d05acba9041525442aad6ac1ede95cf59dfe4a
3484
jsworm.exe
C:\Users\admin\Links\Desktop.lnk
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Links\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Links\Downloads.lnk
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 357231e555845f20dc502829a55ceed0
SHA256: e18d89c036ce9c277911aa6d401aa3923c6ba2f1cbdb9f84b38a5849d1a32bdb
3484
jsworm.exe
C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: cdc5c770228c38005cc873b31449b89d
SHA256: 9917bf63977b2b74e676781a16b52247d71ff060465b497afdd07dac7eb2cfda
3484
jsworm.exe
C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 7eb9afd8690adc1f3731cb38902a339e
SHA256: e5776255fe8676257aa3abf703219f8a571e5bce555788d14f2c6de18ef7df61
3484
jsworm.exe
C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN Sports.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b20a7a39f7d2e9f7ce4b8599698f13e0
SHA256: 54f08029132c8b514a640b5f9486c7890c33f5a736bd756004e1ff32ba0c955d
3484
jsworm.exe
C:\Users\admin\Favorites\Windows Live\Get Windows Live.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5dce56628161ed131a3af4249c3814e8
SHA256: aff8f09397a26e384002c9cec773ce34b810788180cc2ba663d24d3f403aabc0
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSNBC News.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 86d99f14b1cb987214f15f15f38f04c1
SHA256: fb5a6f45b5b49b564163254b0ec64a1075fbc3c559efebf9f3b455950e183e7c
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 181fe32800c41bffdba7b0215e5e062c
SHA256: b01cd76631973d5610d471fb8d59c638bc0e6b8363e0fe5350789f694d42cb07
3484
jsworm.exe
C:\Users\admin\Favorites\Windows Live\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN Sports.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSNBC News.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Windows Live\Get Windows Live.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN Autos.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a5b3d927baaab03c28bd0cd9e84de415
SHA256: 152b954412fc409de34a854a780ae7641312401d59657db831c3368590c2d973
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6b374e9b329cad97e41544308afa9a81
SHA256: cf611e619a185fd7deb4305ea79b0c57fa3c1d137de6a985a4187c130937b5fe
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN Money.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 260b32dd4172d8c961a2b661f3341603
SHA256: 0455bb8f3fefc811d69cbd1d0fb4b793ad04bdf7d7bdf4efdf2a1feb45e9595a
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url.[ID-D5WOCIX][[email protected]tutamail.com].JSWRM
binary
MD5: 275f17e88dfe3090bb31e3017e8fc84b
SHA256: 4bf455afcd4077170041f2a7cc6308500a1249936c6216449b722dfded60c8ae
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: aebc22d2bde568642bc2e5135b396038
SHA256: 5eba37a599293c3f418e97849d62899d29aebdeda4a18456316283612564c8b5
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: bf35267dfa7a640904c2ecee09285ad4
SHA256: 99bd875b6036d938d3de2969b038500930c70c368e45a7e3a658d0fb0ed3f365
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: bc3b5d17810c507205da208ca5cfa1f9
SHA256: 37b7428374e5682fdd5191d62bbff887387117eec995f2b301702192bf284a58
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN Money.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\MSN Websites\MSN Autos.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Links for United States\USA.gov.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9cc0fffa759ebc90f68316950cf90c84
SHA256: b8919571b393464e28e29c4cf89a0ae37fb5548c2f09bfa2e4b9b4ca867aecde
3484
jsworm.exe
C:\Users\admin\Favorites\Links for United States\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 7239fc3ac1fdcf55789c8a6ebd621141
SHA256: e450314d61621e8531ed879a246911b4be79ecadfc5097f2f77ec34f0ff86428
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2af30e00b1ddf1fea09a5c9ba8318336
SHA256: 064d6d3bf0eab472250b266c53dfa532bc465d1d33c97cf1a353c22c37714cf6
3484
jsworm.exe
C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1a504d92846129e488cdfcb07e9275b9
SHA256: 7cc9c992118f10e25d4f48dbecc3765713a7e8487c725fbf6f24338078003170
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Links for United States\USA.gov.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Links for United States\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Links\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6dc68ae25737499208535e1902add2e1
SHA256: c076f864cf399a4ef012df3adba5f0c479d87cc96a1544f9d836e46a544cfdd9
3484
jsworm.exe
C:\Users\admin\Downloads\marpaper.png.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8236f9219b3a531cdb3e010728c51162
SHA256: 8f6bad709c93fec64c976425643e163e2867210159ee9244c5ce3d5e0b934b25
3484
jsworm.exe
C:\Users\admin\Favorites\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Favorites\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4790986e47ae65f89c7ea36a84e1d4d9
SHA256: 57afc38096b9ea626259a48570b7eb68513620f122c9b1ad9e8c879c7fee91a1
3484
jsworm.exe
C:\Users\admin\Favorites\Links for United States\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Downloads\policeover.png.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b76580f618e8b279835db71057ffb483
SHA256: 45c017f8ce4d295f668035204638f694abbebabaaee3b3e639c7f938aec95652
3484
jsworm.exe
C:\Users\admin\Favorites\Links\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Favorites\Links\Web Slice Gallery.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5fd068e0bd552b6db795506b24446c73
SHA256: 9880babe4ce0012e21119af68ed21923e303f3a32094a1357aa078231c703b6f
3484
jsworm.exe
C:\Users\admin\Favorites\Links\Suggested Sites.url.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 162cae31afac2c9b6689701fd3ca0d0d
SHA256: 01b9a70f4d6cc119600f40c38ffab14984dea48d947de747f5118a52f92a266f
3484
jsworm.exe
C:\Users\admin\Downloads\policeover.png
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Links\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Links\Web Slice Gallery.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Downloads\marpaper.png
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Favorites\Links\Suggested Sites.url
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Downloads\heartlike.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3a5ea98fe3280ff8475eca8b33aeba78
SHA256: c817299269f0d0b1f55c5ba0148b48e35f013381affa67e82780c7861359458a
3484
jsworm.exe
C:\Users\admin\Downloads\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 41e21126efbb6801a2000acb71f5dce4
SHA256: 6c7a441f713c436f8ec8fe2619f01c163094ea017628301a140eb2d91db5814b
3484
jsworm.exe
C:\Users\admin\Downloads\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Downloads\easilyice.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: cc5979870854ddd8a4b02cb830fa3bcf
SHA256: dc2e691b4c2c5e3aa714814fb72d31b990b7e1efb48a967299192220c0caea91
3484
jsworm.exe
C:\Users\admin\Downloads\heartlike.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Downloads\easilyice.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Downloads\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\pastbelow.rtf.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5cd11914a24777777957858075d83604
SHA256: 87bba06e0646eb17522b23b72137c03d84eee651dee313cb2fa21bf41d158e65
3484
jsworm.exe
C:\Users\admin\Documents\Outlook Files\Outlook.pst.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: c0e19a8e8a3952ca287013dd3f42a571
SHA256: 57a531276e1b4f68db333d1cae9bbc3043ff46c21a34425090e582873c7a892c
3484
jsworm.exe
C:\Users\admin\Documents\Outlook Files\~Outlook.pst.tmp.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a060dd4f4fbbcaecc1737e67ef7ead8d
SHA256: cff3fefd7904bf51fdbe23b1973fcd874e5254148ea9ee22a97f5959b55f94ed
3484
jsworm.exe
C:\Users\admin\Documents\Outlook Files\Outlook.pst
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\Outlook Files\~Outlook.pst.tmp
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\pastbelow.rtf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8581a8ee2c22d6bf55649195c0cd74ad
SHA256: 969fdcd515858f68c6840c94d4c09387d336ec2efb6dc702052006292380de69
3484
jsworm.exe
C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\Outlook Files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Documents\Outlook Files\[email protected][ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 101109c78266efd40c317eb2107ff204
SHA256: b49a6bc1ad9fd3cc3188094c386d17c777c468e7e99fed0486551c5f32974ec3
3484
jsworm.exe
C:\Users\admin\Documents\Outlook Files\[email protected]
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8bf53141bc2b359bcac0c17e38dcf2fc
SHA256: ee374ba334976bf6e54257f060a425c70d8491c9fcf5d49cc06e9a43de29d461
3484
jsworm.exe
C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9ea4717ff75583f7c0857587a18cb587
SHA256: 7b3ea38bc4e4b439783bdac87d9fcd1c739d6592604e1f71c48a64f4fb6fce78
3484
jsworm.exe
C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 604c76663c87a06f873a8f663af3e4bf
SHA256: 1cf53e9c16003065d9e6b85062fb492cd3514522ee39cec142d2526b9f92c5b1
3484
jsworm.exe
C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8bf7423af27bcf7c3634b6fff9e0d2ed
SHA256: b9bf538e0bbf9dcd83cb0439cf8b231d2fe5edb1565652a3699488810b69a00d
3484
jsworm.exe
C:\Users\admin\Documents\initiallake.rtf.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: fd16bea277237186d69b4dc284183879
SHA256: b9ef6f7a3ccdab1959c7f65cd45ed1e3c0849c0231d2753be6c7b00adeaa333a
3484
jsworm.exe
C:\Users\admin\Videos\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Documents\OneNote Notebooks\Personal\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Documents\OneNote Notebooks\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Music\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Documents\deviceapplications.rtf.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2596ec5f1c3923ec815b7e3a18e02bb8
SHA256: c155121e6b0067c3fd405aa69bddb8d02d9652d19b24a205013019ff83fbb51e
3484
jsworm.exe
C:\Users\admin\Pictures\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Documents\northernpay.rtf.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 91b190fea2be21654c28ee7954b29446
SHA256: a99fff846e15f89ae8e13311a2a94c4c9effa3b212b79ad259b4861e7339a171
3484
jsworm.exe
C:\Users\admin\Documents\deviceapplications.rtf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\northernpay.rtf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\initiallake.rtf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Desktop\songsher.png.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2bcc8ac759e08eb5763385016fcb3358
SHA256: bbf58a607c4dbb8e582822d2b9214a58246256363ebe2e9ccb4961d713c33da6
3484
jsworm.exe
C:\Users\admin\Desktop\rentalssponsored.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 75ca72156b8d1cd3e36051854274701e
SHA256: 3d86a69453c859881c1f3a55c1e0784ef325a0acdfe0d3468eeb7eaaee7a321a
3484
jsworm.exe
C:\Users\admin\Desktop\privateannual.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9a648a6e62deb4902d4378d2f2a33155
SHA256: 7ab4ed886407c887c945f37ff31734a7b7ff687606ba7a3a0c139a133c1ec37c
3484
jsworm.exe
C:\Users\admin\Desktop\worldwhose.rtf.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5e775b1de508dcc351206065b4a6a1b8
SHA256: 9168ad22887ee811d1b0f090a1ef5c0426aa5713017d3b0a5d159d5d9282f96a
3484
jsworm.exe
C:\Users\admin\Desktop\repliesthinking.rtf.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 665911220fa070ce56e8bc0920ecf65c
SHA256: 5ccb807046f42a92a41d6f152e76eba2159974c2c3868613d547b36edc5cdc3a
3484
jsworm.exe
C:\Users\admin\Documents\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Desktop\songsher.png
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Documents\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Desktop\worldwhose.rtf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Desktop\rentalssponsored.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Desktop\repliesthinking.rtf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Desktop\privateannual.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Desktop\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 306aa022ff1407edadbc0fcd1c52fe49
SHA256: 3019de6f9f328ae7911e84f579444b3904c083f77c5c09df23569ae66ef4becc
3484
jsworm.exe
C:\Users\admin\Desktop\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Desktop\dancesponsored.rtf.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 77c4b03f2b764a06dc8ffdaf22c2aaf2
SHA256: 9e1f9d1a89b3ebfce8237c850fe4ac28cb84a84185c5900f0b4e94d433295299
3484
jsworm.exe
C:\Users\admin\Desktop\datingchair.png.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6e87f88ed0d1dc3ed39de96ebe351549
SHA256: 19b2bdaba5eef6c154e95e128f1e601db7c33e31a4221d7fe3e0877b023f40b2
3484
jsworm.exe
C:\Users\admin\Desktop\capitalmodule.jpg.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 506887f50b74e84c5c3dd6f4add3d68b
SHA256: 3bdb851c873bfce36663a164a268b6a7f5d6ef5dc96da7fd8bb485bbdff94443
3484
jsworm.exe
C:\Users\admin\Desktop\documentationlower.png.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: f878c466aff24382da01ea390d9365cc
SHA256: 9750858df53495711c0a1c52745506fed91e9010e085c9026761364520a8dde5
3484
jsworm.exe
C:\Users\admin\Desktop\capitalmodule.jpg
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Desktop\documentationlower.png
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Desktop\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Desktop\dancesponsored.rtf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Desktop\datingchair.png
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Contacts\admin.contact.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b7c8ee0b05db8f24f953462731545c24
SHA256: c5246f52c67b26f0f996f2af7b9f22d08f729759ff0a574a4f246b60227267c5
3484
jsworm.exe
C:\Users\admin\Contacts\desktop.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 7585047d18e203d7c41e374d1161e6b7
SHA256: 441535b39791bbc35a7b3c15e46b21d80b671b98ee383b7be8669b727618c10a
3484
jsworm.exe
C:\Users\admin\Contacts\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\Contacts\admin.contact
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\Contacts\desktop.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Sun\Java\Deployment\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf.[ID-D5WOCIX][[email protected]].JSWRM
fli
MD5: a3e06e6adc9edd3c54547f94e3e4d3a1
SHA256: a622e249c54291e102e44927d7679862274baef8d32320c77886643bbf8df62a
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\WinRAR\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 42923a253f0a6578328810eb22436458
SHA256: 13021709ba34a976c7a12e60f78f4920707082c3ce9eed5a5810af57294fd14e
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Sun\Java\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Sun\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 29e6ecb0685aef0732b11dfb856aa67d
SHA256: f4b932db0593ac88861304af71e360087bd8d476c3d1b6863337d52030daf0a4
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\WinRAR\version.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8725f9c30ab0972edf38eea97e2a0d5f
SHA256: e4e2f298edccae9e6edce74b413975817d807a4ee9f4e71f9146dd26e5309df6
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\WinRAR\version.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\SkypeRT\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0f3d9e49c39db1b9779b5334354cf262
SHA256: 609cfbb9c9fadb4654a710f60fbe9639d358fcea437b878e409cdd0e247caf5d
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.lock
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.lock.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: fe2a43e51782db3e2258524ed41fde07
SHA256: dfb3e2a3669e4e65252715727b9d2d15ade3058fe294cfdf11ce48730537c391
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e335aa18671d484cc9567cdbfcdb29cd
SHA256: 838d671c9e6ebb3f7518bd8fb33be0765a813638d8e9305b23272fee46bfe270
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.lock.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.lock
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared_dynco\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: fa667261c15ea9ef69e23ef9dfee8ab0
SHA256: b2100c04bcfb7fc0dfdc01008b219a71c6f35b5b3d0c31f5972b51218201a878
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\DataRv\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b957c74e556869f499f885d89109a0f1
SHA256: a37cee62e62b93f7340d1e64c05dfb3db892d0266f3c9e824dbb5fa0743debf0
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\logs\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared.lck
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\shared.lck.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 596c9f742970d0e4dec3e1e10109e22f
SHA256: 4e5fbf76b7099eed2d79fcd45825ffa91ad0b4804a77de7dea0f3996b39caed7
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3498413f28387a20b024c7baf01e0f5f
SHA256: 4fb007f379f603bf40e2165443ebce1a4327819b5d94e8589db91a9eee39ea9f
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Skype\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: af09276a7f0ded3a704e4f36bed88fd6
SHA256: b2035c018d0a4a7be634595e6a1a08688b7d26111f7fccfae19436818cc0b48c
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9e19981ed46452c1a4b98956ca88f796
SHA256: bbecc76771aca3e9905e3f6b065d2cbe625707a8d76bdc4bef91327b758886fb
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: cfee3c08c8f2d48d6bcbb66ddcbedd65
SHA256: 4d77b965199b14b005294cc02c89c7a70ae40d3789c36946bde37e9687a9fff9
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: dcd0ee5db0aa8abb0ed5df0e8930ec56
SHA256: 5ebc7cef518fae07f34add6a914be262cc92a3d4be68be9e534595676201685c
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 850c296eb6daffa0386424e4ca34e9a9
SHA256: 8dd4568a2526eb2ce23998efc35e93d5ca82131b5d3ed653b25870e9498a9cdf
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: cfe2a8dbf6b4990647ae04d4da465f5e
SHA256: 3578f96ff065a71d9ae694d8fd06ade91371957968667ce64326681b673488a2
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d4dd59bb37240aa0f53c596c2c90e0b4
SHA256: 1fa0102bedf561823afa4d5ab439b327e8f384cff8236c43b0ea169cdb1a7e8c
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 65ef9b94971e4d5a58710165f7a8284f
SHA256: 7a915db1817cd6d160d403450f89b92df3820bbdc5ec8b49b2a5e14635339b2e
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a0ef51de808c6efc78a7f7e53d8b570e
SHA256: 855e85e256686ee0524ded265dcaa6996e77ccb1b4d3dd9d309b81e0cfd62322
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: bbe96e0aa3826f2886d6ed7245341317
SHA256: aab7856cc7920e14ffba44202cac00e12612837a5e076e31bb555c6ff6702307
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4dba0aba92e57b3b91e6bd28494abc22
SHA256: 3049d3ffbb10a034d623dbddf7ea553846b2569d318380dae08dc7775cff56b4
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d91accc2392ba6265e5668a8beec6d82
SHA256: fa984efb8d1aa974bf3ff06ca2f682c7dd4bf18b4471c9ab3f23dbd99ee53bb7
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: c74316b925d3655c017ef48e7531d4f1
SHA256: ad28b00d9e6b0ef0035cded5b040ee63b69a6d8fe8d11c6d96e9e8108c9dde42
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 567fa660adbafc0040e910767b5d8441
SHA256: 0915f999858225bc2a1cd7b66e0c400f4d1a726be4ce36ae107dce57d7e4f44d
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5d38111de0b16fe0803147cc4069458b
SHA256: 4f85be736585ff21974e7ab52af529c0b1c70722db0b2d9e9ddddf3c986453ce
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: ee54158e053e90b189637128fac02fde
SHA256: 751e9a5678b8fdd9a59a38ab519cfe27b86c7bf41907b00031e69072b8e88ed2
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1b44c3736ff3a86d548c5703178d13ee
SHA256: 65f44e9bd0eecaa86aba3d5200962752d92bd18d9c5903f9ad42d109c45fc1d8
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e20531037d9a6e8c5b9bc7e03fc12404
SHA256: f13fc1b678ca1b1125a4a7f96a4a8c15bcaf56363d9f30a6f449587308447d4a
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: bd212d7773bc3404f9139f34c54f88b4
SHA256: b45d48bc557dcb7721a2b2a2dcb50ed70f5ff7ca9f53c9c9895268b032a0e3be
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1aa8644c9261dc10f7247f6a145c1dd2
SHA256: 58a8933f65361633c6ab194000d312dc9d566f717b1a16814a0dbee24a60ebe3
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 58bc5e9076f7133fef0c6a7503eaf06e
SHA256: dd35b9f68f366037ef86d5227dcc0478284337e451825d717c64a7eba82380c2
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4f8de1fc3ded9e7edbee6d4e1fc01d5e
SHA256: 31aa775572a11ba6da3065182e96fafcb69fd3a0de388c149ee4815301f6d817
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1aa8644c9261dc10f7247f6a145c1dd2
SHA256: 58a8933f65361633c6ab194000d312dc9d566f717b1a16814a0dbee24a60ebe3
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e1bc729f097c5b90b2d2276e0d970a61
SHA256: b1a8b743364fb0606d17ac75f7356f75251a68805b4153371e5888fbd4c1ac51
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 47277ced5958f88c1293ad06093d421a
SHA256: 64844ff5e92bd13c26cf07391b44d4b3478de78b8d97d9a0a3c7b67cd79deb72
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\optrb.dat.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\optrb.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1aa8644c9261dc10f7247f6a145c1dd2
SHA256: 58a8933f65361633c6ab194000d312dc9d566f717b1a16814a0dbee24a60ebe3
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: aca2af69cc8856c008fa25b9206a6ae3
SHA256: 2e65f77d894a79c2c152edf8afd5d470b55d9794a5d506e5cd14dfb3489a96da
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: ce95baeb0c80f2a5cccc232b386699b5
SHA256: f17b98f97bd5aac58f065b6dd2008602892073ae7375ef2f33cdb607527fde44
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3aebbd291a335003e3f5df67e92f72ec
SHA256: 8a5acaf2c5c02ed3f82de33480818770c566c0fffad1c6973ab9906560657937
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d6e209fce64ffe77da3a49894a6e79b2
SHA256: 071d7f1fdce456c384ead37333c7a74ed7d88d88bb02f3995117191047c68729
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: f8f1abb5a51912ef13a3f4e944f5ee01
SHA256: 6275ead00a733e30583c20dc9233553407fa8a0fb9b42a9a11008a5dfffa405c
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: aa639cac2e5e6634e57ad4a188a82e04
SHA256: bd80e27fc9bcef924df4cfe28a4ca0a354d804a040088aaf2b092075b23f0451
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Opera\Opera\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 38dba3a6e9301bb8cdc8bd3c9d3032b7
SHA256: 4980e8bff9293b9eaefd229700160a87a31ca7356d94e0bd8c1ab521e3703d48
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: aaf0d783b748bd5613a99ef700a4624a
SHA256: 568d70a8d7ff6fba2f5bb7cb5df623dca376c5ad3f06d4f2016db005e0aa6981
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 75ad681806aeeca14a44ef31b9473983
SHA256: 55aad0d20dfeac0bcc3dad5d7be9713e7e582970fd42b8f09d0120935c1d504d
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4f2c761a5584610747e29286473447a4
SHA256: 21c3427d5d49408f643825f18b9986da01f9bfac466dd23e5f8d99c8684b7742
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 29938a81cd2957b2cec25cd838c2d8de
SHA256: 14e340a8a113bda1f2f2eb9ca10a5d31ca8912af9cdd13c5d8edebb76f4b9008
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1089530583703a5c97fd4b0dadf64e03
SHA256: fced641044733c502706ec0c278f10d60d8c82b7b2d9343396c45738dad134ef
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 21d81d60364eb13fc878e04a18a4b77b
SHA256: 611d9d48610520ed9ae71faa8babb570fea515010bea06b5af066fe9fe6d22fb
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 15de776e2ed688be73b4994835391073
SHA256: 60b2b8fa52af5c452825c44ed766a154f816c8f42c62de223fbba2177c85a543
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: eaac340310c5ff1ea99b39754743c939
SHA256: 99d9343d1fd51d26498431c05064e9946a440667fb2e4040f4fa8beb43d11b77
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b7b6121023d44189b02a68cef72fa136
SHA256: 59fb9578868e364918b71cdfa634d1cc4d47e8e5db7ef490af4c222194408b0c
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 662ed6bfc5eeff4ff203df5f9703aa75
SHA256: 63d62fd4745810082c0b76e6f4ecdd7779ae9b89cc92f9181d42d9582bb401fe
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8bfe748e350df73c3a648c0c1ba3e426
SHA256: 48a04f7b4f840754c5697b447f2cd330b0c582a56e20b317f7befbfd934667c4
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6518c958b3a7895e09eb8c991b573d35
SHA256: b70df1707606680c7cc68a55f7243f3b2091ba705b4e6fcbf76150c86c4d463f
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 81394bf60c7fec474af09cf98c5e6919
SHA256: 38d3a693fdec2af325c74a0158d29a031623864be1aecbbcc51f1aa3b8b13fcd
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d8cd324e02b97d3b97185714f071521b
SHA256: f04c5df5080d13cde8f928bc2271f5bb4e9b83a50eea566902bb3cfd14786550
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e04988c85fc774b42029b79d4e2b3582
SHA256: 179064aaf4975e6c73a74c822baf36f202c578294d771776432f438365ee5177
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0b34694a646ed9d65764b9ae0d58adc3
SHA256: 4ceaf0b9e56ac8d479c0de12661b6d03339d8b71d4f9241af59bc47f3f267000
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: af6e5697e72b5754683a84d3304c53a6
SHA256: 2ababe96b6acd5957752d987755fb9d31fd84e35984cb662a07dedcc2a395f85
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\plugins\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b43c19dc608eb67f5be9eaae9449aabd
SHA256: 44e553b5e24532d32f0695075dfefce42c5ce83ba6287f3b2fa714354aa283dd
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\plugins\config\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2c583e31ee9e190b2d935d3b9bf8f4ef
SHA256: 69c7c538a92a805e28a3658563f030cf5c62b6ee88a4187e2d1e13549dfd6c44
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\SystemExtensionsDev\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 42a6f19a953c0f65f39f9b9e29e13b78
SHA256: f532996b6a1f59becd7f729772fcac16a01a82f0019ea72ff710751c13e86daa
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: ccecabf9515719c1497e8e6425fda577
SHA256: 088343459ab93e4bf3edd0c5e225831406a0516989c8efc7804c75e9bc40c620
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 77d8a1dab7fb4cade272d2bc3a8da7c7
SHA256: 1150ed70b8adddb5d05ac77ecbdde25bd74d6ae054c249dc365d059434228839
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 81c5179c54205a886f884b23dc1d812d
SHA256: 62c6b51c10c2cb51fb0b61dda023c8f015624a982d27704b556da7e8e9454a4f
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json.[ID-D5WOCIX][[email protected]].JSWRM
text
MD5: f20674a0751f58bbd67ada26a34ad922
SHA256: 8f05bafd61f29998ca102b333f853628502d4e45d53cff41148d6dd15f011792
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json.[ID-D5WOCIX][[email protected]].JSWRM
text
MD5: f20674a0751f58bbd67ada26a34ad922
SHA256: 8f05bafd61f29998ca102b333f853628502d4e45d53cff41148d6dd15f011792
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6f259ae7a25fd39e306da8639e32b021
SHA256: 9b1796e973a720cd3a2725a0a603c4c2f24046500fcf5829ee603c24318603e5
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 755df3ec5c09af6424393d3b2b3365ba
SHA256: 2d22a192ca49695153775de810f7c4e98ce6477c43049c32add12f172805978a
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5ed3e9c4da3c1da79ce5b42e49742d49
SHA256: 6b8bdb363f444978eb1c016fdfe39e3ddc8b667d52ac6de60a166e544640ff62
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\temporary\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\TRRBlacklist.txt
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\TRRBlacklist.txt.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 02b2652c1edc4db1fbc9c2b879e0b8cc
SHA256: 7e199e27a896597ac02e3c2c6a0b70028f9c01b8012ff1d9d3d77eff72873c0f
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: c99c5b04d5d3764dab893393a39201a4
SHA256: a7734638df0bc6e829d211fbcf3616d1471683a359eb5b2c5150e0a52f0d9a09
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 34599f76b758b838509e1bcca5c309eb
SHA256: abab6d66d3d8e9490708b9ff32c6d49655b45f74369492e7a990f4734b815cec
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: f97c493d561f456fd15c41877cb43efa
SHA256: 95860997e11666ed67e16611fcf06e4ab4e1a3b16906c13e1fc8b7a7223032f2
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2312d50e210112a05a1d82adc3c7cfcd
SHA256: c3a6c73509d4f1d3d0b99b22e72c8fcbf59039641f63c482b7282424356528a0
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\journals\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9ab4b4d3f0df5081019eb113409bdda0
SHA256: d3369c79e0281e02cb67a580cab633f51b9ff303793d956de2889da75cfb6a2f
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3a572c3d3201b824a5804aba6086b34a
SHA256: bbf521a9b97d59723254a515b199ff8c6ab8bfa2de4a44bcfa2e99f4d31fbf03
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: cad2b739544f67162a76b59789a82902
SHA256: 8b0798e6c3ba7dcafce45896d188354ac666fbecfa54b780711c7fe938ed5ed1
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\2.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: c79f080b5c29886f51f9e2a1f4a15f75
SHA256: 50917a393bbecf3dfc3648b10b396125071bf420de5b638c397a256461579e7f
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\2
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 359e6cb067a8d7d605c1c0b723c019c4
SHA256: 83a1666c88c8f591e72d071dc07eb95fde4f24b62fdc58e930493d7696133fb0
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 97e7513ecf83f5ac0a8de7afb74de32a
SHA256: 64fda161bfaf759acaabc8ec3fb40123319f54b791d63895d18e69b1f3bed54d
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: eb491140193f134aa895b1b5766e3ba3
SHA256: 2a13f1e418de8254550b8f114c2c9fac156535aeb79d1aef7bbe9bbea199ba2c
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9b5b49c3a21dcc9f3b27a0feb95e3ca6
SHA256: a77f36343d00ac5e4e697eb28b6892b579d55a492938fc3ddeb673c6b9bf8185
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\journals\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 948f1e99ecf2ae73a79e1fd44a9e8e0d
SHA256: baa1991d365b4fb40b2784c31dbabacbe7235e5f0b1c6389cf333d689ff1bedf
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 141d7e8f319bde01f320443eb90f6f53
SHA256: e815bd1789ba501a1e5c8f63c0180d8c39d1be6e7b272d073f89e5769ed89c97
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b33c1754be3ebece55c004ea8cb192c9
SHA256: 6d436877d2175c3be754d84895c1d5e7008816973e4125b7ea7c51e7299fb5ea
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\2.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8792eb1fbaa9e6cd200cc70cafccef3e
SHA256: cd3223ee65272d40a31fa3d891370c660f0dcaaae5e427db12ded4615b8bd80f
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\journals\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\2
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: a8a16f192a3e924270d26213f5cf6694
SHA256: f9de557fea94d20190486000edec283715ad7d241d764fb393cba605c2a6e52a
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\upgrade.jsonlz4-20190619235627.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1868ca34b514c5b22937a8e2eb810ff5
SHA256: d177aa5aee68768ed5aa35c542bbe70ce13808e6b61e607920196aa6ab01d217
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 972947e6b6fbbdbba2703828e6da250b
SHA256: a0b53bcd20544b298d2725359e7e3f5adb82944456b863a7d8f18ac22a0de124
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 1868ca34b514c5b22937a8e2eb810ff5
SHA256: d177aa5aee68768ed5aa35c542bbe70ce13808e6b61e607920196aa6ab01d217
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: daa089e988fcb60819556ee7b57c3e9c
SHA256: c32366d4a7991524d0fae26ac7bb26e1c5da8c4e273875d90649fbe26515aac6
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d29aebd1260c5d5d30bcb5ebec531f6a
SHA256: 5320cdd8b31ad5fd5d38b0300879c31891ea4298837c534e68ba24338db975ed
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\upgrade.jsonlz4-20190619235627
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2619eaab0cebac66fd6b8cd87c1414c4
SHA256: b583b09e584dfc0a66c00dda9e2d8442526547e4fe321fe7665a17b15574588e
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\7e9b65a8-bbc0-4c5d-8cc3-e71a22fd8f53.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6ae3fee78cd1639bf337a76401616613
SHA256: dc9c152d4ff5e993a76e37874a353364b3cbd3b9afb3ee0473b2b7719bf083fa
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\0183b830-ea0a-491a-997c-8b9651036b45.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5f1bbd89acd12f5491a36a0a7a52e44f
SHA256: f9928dea76821100d924be57300e0dd76c208b30b91a6a5cb3bd9f21861c7d10
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d076fe0ed3a08e3da03163cb928d70a2
SHA256: e1982853f27ce47a5c5c48114a3c2b69ad81d051d5bfbd0db68060fd7382dc4f
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\4802db1c-08fa-4dd6-86ed-b549a554341f.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: acde7fafb307fad80b87103cdc7326fc
SHA256: e56b3deb082deaff1a4d1b91143c241f6ced2d7a289396c3d9f161a497c516f1
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0f95f8eb076fa06568aa73f336c69cc6
SHA256: 6fa9873d5b15ee6157a6769a7de033a84b00f2eb9d70b24ce99fd8c248165910
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\6c8d38fa-8188-40ce-822e-2249c9316ad9.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0a75ae2d5037a3f454c2865e057b3e16
SHA256: 0326d935dbac44a293c0f41f72869d6d6fe7a9f663d2099e179359e5be6c7ea3
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\0183b830-ea0a-491a-997c-8b9651036b45
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SecurityPreloadState.txt.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\4802db1c-08fa-4dd6-86ed-b549a554341f
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SecurityPreloadState.txt
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\6c8d38fa-8188-40ce-822e-2249c9316ad9
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\7e9b65a8-bbc0-4c5d-8cc3-e71a22fd8f53
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3ad3a0e518c5aff295cf3133e9f328aa
SHA256: d45ec83c85cfad783162ed998b4d144cf2b61e1a448a6637291c68311c7dd0a4
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e32112299c460c707c94ed8dc387b03e
SHA256: d5d60fd2eac913986d982aa34e4bf75fd659e882dcb4453dd7db7007bd1a7892
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 4c5c8b4340210a7549d6e841a6e9893e
SHA256: 1416bafad722926f43ef8e9e60a0a5f1f2f77d34f6d1e92129fd372c47e7f18e
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 9bad07ba900d903857840c25e914c131
SHA256: cef62291668f1119a58993686ca5a515370e3dfef7807bbc04d6f74d4476600e
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json.[ID-D5WOCIX][[email protected]].JSWRM
flc
MD5: 056e1994b6e164a3bdca0ff1d67880da
SHA256: 1e9eec4cff121df1e05eeec2a2f8f9ed2e0d1f0e844deda971292954c11e9ec4
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\minidumps\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b3266b292dccefa80df436a73705292b
SHA256: 19e3a23bfc4dd430cbaa5eb20544bcc3925914fe4038c1b74494d72c55c5054b
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\parent.lock
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\parent.lock.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 12fd294d1241949bcb3869eb625fbf82
SHA256: bf002eb90df14725e69366c51595b08e6fe62e70d3092431a254e2c870530023
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: f0a95393101589566dcc3cc00bb880c8
SHA256: df5b9e4ae29b5a5bd359a414eb148ddb8ea19f2dbed8e188d04ba9ac4de170df
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json.[ID-D5WOCIX][[email protected]].JSWRM
vc
MD5: 3804ee9f24894bbd582b838a6cb2e325
SHA256: e667d875cf75c7af5de377a092d91b07973c26eae845a517c16a06f83e5f2632
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8f938a5bea389ff20565a36d65861ea5
SHA256: 26151a3fb285123673c95471c1bf004fb138c864c8fbb06b189fab72d115c6ec
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8204cf02c2a89249d99658675c63b04c
SHA256: 9bd765f21142cbb8b5744b0d8ca76a16367e9b8fce8c7ffc25507beab6eeafe8
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: df1fdfbe980de53a055c1459420b749d
SHA256: 90b9345bb4ebfb99ce8b5d1d9259c456ba8f9c4ad6b23bde33e80f0d5c44eeb5
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\WINNT_x86-msvc\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: eb2b591db1c369b30d45086ffb29fbb1
SHA256: 8462097c799eaebbed4a86d0d43e1f37757246ead8d5c4e69c1af2c9c7756001
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extension-preferences.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 342ac7e7ca9766e63387b5b7fc186928
SHA256: 7328ec4f09d751ef915a9a15f0891e75270b1f1ab1ca41a40537d420b6b0f46e
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: c2f75d943369d07f54e35a1098f0c103
SHA256: 82052ff12674cae8de412c026b7ceb9f50c4d1fa520d19b3fc3d3188c7135aa3
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extension-preferences.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367040859.0194ec90-9aa2-412d-a21d-de074d2bda44.main.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: f23fdde1ec7a294f25f7367ecaadf384
SHA256: 2025cc367b95450e9398a7ae3227b7a15ad2e8c742084b647b24c6f1bb1d9504
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e7d24237b8aee413152e94cc0616141a
SHA256: 45a2c582d33978e4d8a85bb7196ef1c13e3158c174c70c1d2b4da277fc65ffc9
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367764215.0183b830-ea0a-491a-997c-8b9651036b45.health.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8aabc70ccb226f167df25972307fe4f8
SHA256: 346c56a5b0d1f032e3c0b2aee0871abe8cbc08c40fb7c227108ce480ca3490ec
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367764269.2d6bbe78-addc-4984-97e2-6e350d949554.health.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: c6985fb1a4a80ff64f09fcb1d062d1a1
SHA256: 2b2a2aa5cc2b936da8066742aeefcbd29c6d62489e486cae31ddcd2b69e470eb
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3bdca3eb4ae44f9f0645a3fe47518f3b
SHA256: f986c2447ca994e689a3b3f336e554f67639e6754f21bb390f01cfbd5eac9e87
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367764285.1d323382-07b1-4a8b-b981-ed8d8c71e028.main.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 86cec893e037e0ab5979254a7572e5b1
SHA256: b378e1d8688c834e421f41a93a3bf0f21963228b2bccb2220ce28f239fae6a1b
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367764251.daa0792b-f60b-4009-b24d-235cda393514.event.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6528501166f291022e99ab60a627e8af
SHA256: f8ac4cdece2e60b25fc52a3127211864597f84eb514d026d73543c854ac4779a
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367040812.7e9b65a8-bbc0-4c5d-8cc3-e71a22fd8f53.health.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: bfae39c7f834da34b462a1414a03bddb
SHA256: 0832c33f30abd0ec9498168071753aab30a6b6f79b70633bf41c7a658bc290f6
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367040843.64e19fd2-09c5-457f-b7da-c6beab032106.health.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 2a2b8a40ffa87b5affb70b91997e793e
SHA256: 3f666007e0b81a4a8d7908e6c98be38a6e7e5a18567303a19697b9d1102e33f8
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367764215.0183b830-ea0a-491a-997c-8b9651036b45.health.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367040812.7e9b65a8-bbc0-4c5d-8cc3-e71a22fd8f53.health.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367040859.0194ec90-9aa2-412d-a21d-de074d2bda44.main.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367040843.64e19fd2-09c5-457f-b7da-c6beab032106.health.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367764269.2d6bbe78-addc-4984-97e2-6e350d949554.health.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367764285.1d323382-07b1-4a8b-b981-ed8d8c71e028.main.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553367764251.daa0792b-f60b-4009-b24d-235cda393514.event.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000646892.6c8d38fa-8188-40ce-822e-2249c9316ad9.health.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b77b08151975c367621e10f027c0fa03
SHA256: 49177a5619dc8236bd0a6fc145f85b597ca39b7ba35afa9362f61d5de643ef08
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000620729.94b06a80-a39c-46bf-90b5-264680171d04.main.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: ee02a045696e61063c542cf4697c05fd
SHA256: ee95f5c8abdaadb8ac5f8377b075e6bc625f5d189e8efeaca8484f673bf6c419
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000637968.4802db1c-08fa-4dd6-86ed-b549a554341f.update.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: b721eb6f42cfb8051a74075b290bb5bf
SHA256: fb7238c6d1027cde6aacfbc07184a6c34b2cf0dcf12d86eeba754e5e3e41a752
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000646937.9c1d5aa7-8417-4152-b187-6829a20b449c.main.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 0cc6e5fe43d5cb8fb73a42d59901ad08
SHA256: f896275784a994ad03aa971adbaf55d31e81142bfdd628eadc39cfad2d0d77d3
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000646916.428022fd-1128-47e0-9128-82697384584b.health.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 23ee0733fdacf356242902bca9cb6502
SHA256: d26b51f9f02b837977dff470d694d2c8597ce3fe92badc755baf3708a77c8d84
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000646916.428022fd-1128-47e0-9128-82697384584b.health.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000620729.94b06a80-a39c-46bf-90b5-264680171d04.main.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000646937.9c1d5aa7-8417-4152-b187-6829a20b449c.main.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000637968.4802db1c-08fa-4dd6-86ed-b549a554341f.update.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2019-03\1553000646892.6c8d38fa-8188-40ce-822e-2249c9316ad9.health.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 140912a330bbf7435b595818c0eadf18
SHA256: 11ed019613146f68899f6c0e4a8439a3ab2445567c88821fb085835c5daef8f9
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d5303c9fdafd9d2fdd00e2de2d064fe5
SHA256: 299435696fd93f04d7546b85feb63a9976b62ca8c223c48fe870dba0fb219964
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\events\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 6d93f2109f54a6720716c58c17b08ef5
SHA256: 4939c11308bfcad42e44f3bc45cb8d91f602ac02e23d38827aa3c28012d66073
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5c2fe44481718cae80457c3b289b73be
SHA256: 786051aafdc48fad48b47410eafe2a615f8203105aeea8d5c5b0cb18ad4b3367
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: cc5573dbd848b4aedccc66954d477b5a
SHA256: 880a0125347c3e57b4547041bc6d760afc160b7ee5888975102b2b6ef3d1efdb
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 07d58372957b986b906cdee025259a90
SHA256: 2c607182df2e4a79841ef4342e2a133ef8fa4aab6646875f270a7bf610646ade
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: e520a06ea1f97b623f010c59a87f4a6c
SHA256: f7ea571baa2d91ca4cfa53614db7db7a6b48a48a280531b0a9985a358ec57aae
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklist.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: d7c8d06528163502218ea55b9be38f79
SHA256: cf555a9bd67fed347fa0e588327c9981570d63aa86946523ff794a0cb4a0c1e6
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklist.xml
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addons.json.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 5790eced930725aa2e6090b025062e6a
SHA256: 6307739d0c2fc8db25b496c379e35323ae4a83a01206332a56c22d8426f2c2e5
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 3c211952b202778c514fb018ab7aece8
SHA256: c0edd976b64d94665f1b1cab51dfda61d476c6f8e8132ab4079f3652cfa0491d
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addons.json
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\AlternateServices.txt.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\AlternateServices.txt
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20190225143501.[ID-D5WOCIX][[email protected]].JSWRM
text
MD5: 19020d0522c87d420ed64cb8fef9edfd
SHA256: 7502cf90602e749a6b20c8ce3af2ad4025de4733c0881e48c926b0e7ddab25a7
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\installs.ini.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: ff5b61d9c32e39ef011e8b5f35153ff5
SHA256: 9530b4bb6e194641d2557da4c2e9a66d79985d100eb1bb330c4a5fae3406c93b
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20180807170231.[ID-D5WOCIX][[email protected]].JSWRM
text
MD5: e1f4fc51a3e51dec6f80034f46ff7d30
SHA256: 8e4d51b70e7bc6159417a762adc54482cdb009630d802c3fb2becaf029b6e29f
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20190619235627.[ID-D5WOCIX][[email protected]].JSWRM
text
MD5: f7b943b98d5d90e8fd572a596301da04
SHA256: 96e62709bd38788da20ecd3fe3f3c4ffb8b898de0a8a85d8cf48a0124941f231
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20180807170231
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20190619235627
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20190225143501
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\installs.ini
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Vault\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Word\STARTUP\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\Extensions\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Word\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.[ID-D5WOCIX][[email protected]].JSWRM
text
MD5: f3b25701fe362ec84616a93a45ce9998
SHA256: b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\UProof\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 88d59f7959eb5a455af87621684330a3
SHA256: 634d2e140d759b7d946980e8020906626b6d8b1db39b62898eddf1f54aae05b1
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Mozilla\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Templates\Normal.dotm.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 324baf5723d2d7c1630d5da7ada5dbd1
SHA256: bdf59d2c798bc20c3f6c8bfdbc85a29c810d55d80d3a1a35d372810a9ec956af
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Access Parts\1033\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Access Parts\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Templates\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 295b1162cdf668ee0111aafae15e0898
SHA256: d29693d71339be0ce3cc0391fd47da961ec5959d37968b7f800305168feba20c
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\ECCD4BA46722CB4F92060701865DDF09D8AF68B4.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 8225e306df8f702a2482099d8f0934dd
SHA256: a8e2c5b993ed25b0b0b977d77541b2db107458d3825a6f1f66d6629347ee7a7b
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\ECCD4BA46722CB4F92060701865DDF09D8AF68B4
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\shared.xml.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 11b8480a787a34e92aeec7f5f47fdf69
SHA256: ca0ec0bc7248e71a03f47a7115021e45f7048882f778e697aed40db7f3a40509
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Speech\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Stationery\JSWRM-DECRYPT.hta
html
MD5: 5119f1952e0f50308c416b3dcf361356
SHA256: e11819fd42eb715e1d2834eb6b18711024c1e557e6a6a44e3b3aa532e296b838
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\slimcore-0-4223384469.blog.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 43f0236610f95c3e2dc7499a63191736
SHA256: 43d259bcc4480aae8ca3814d9f36e954516546249e73b2d7213596f651b479b5
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db-journal.[ID-D5WOCIX][[email protected]].JSWRM
binary
MD5: 952afb9ca3288af2b980b10cc6c5c689
SHA256: 9d86d90b8d090c551c4e831165e17b1606513269a11bd027afe2b3102b091222
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.lock.[ID-D5WOCIX][[email protected]].JSWRM
––
MD5:  ––
SHA256:  ––
3484
jsworm.exe
C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db-journal
––
MD5:  ––
SHA256:  ––