Edit tour

Windows Analysis Report
1n8xsH3cmA.exe

Overview

General Information

Sample Name:	1n8xsH3cmA.exe
Analysis ID:	795684
MD5:	f9369d1c7fe1d2797d23f20ca19059a6
SHA1:	16e378519bbd97467f751064b17276f2408441d5
SHA256:	b30ef4dbcc89cd4bf0da3e7787f43e42023ddc2b5f0bb4f24937538e10e17533
Tags:	exe
Infos:

Detection

NoCry, TrojanRansom

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected NoCry Ransomware

Multi AV Scanner detection for submitted file

Yara detected TrojanRansom

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Drops PE files to the startup folder

Found Tor onion address

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses TOR for connection hidding

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Writes many files with high entropy

Machine Learning detection for dropped file

Queries random domain names (often used to prevent blacklisting and sinkholes)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

Detected potential crypto function

Stores files to the Windows start menu directory

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Creates a start menu entry (Start Menu\Programs\Startup)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Classification

Process Tree

System is w10x64

1n8xsH3cmA.exe (PID: 5552 cmdline: C:\Users\user\Desktop\1n8xsH3cmA.exe MD5: F9369D1C7FE1D2797D23F20CA19059A6)

OpenWith.exe (PID: 6056 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: D179D03728E95E040A889F760C1FC402)

OpenWith.exe (PID: 6100 cmdline: C:\Windows\system32\OpenWith.exe -Embedding MD5: D179D03728E95E040A889F760C1FC402)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 1n8xsH3cmA.exe PID: 5552	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security
Process Memory Space: 1n8xsH3cmA.exe PID: 5552	JoeSecurity_NoCry	Yara detected NoCry Ransomware	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 1n8xsH3cmA.exe	ReversingLabs: Detection: 69%
Source: 1n8xsH3cmA.exe	Virustotal: Detection: 49%			Perma Link

Antivirus / Scanner detection for submitted sample

Source: 1n8xsH3cmA.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe

ReversingLabs: Detection: 69%

Machine Learning detection for sample

Source: 1n8xsH3cmA.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe

Joe Sandbox ML: detected

Source: 0.0.1n8xsH3cmA.exe.240000.0.unpack

Avira: Label: TR/Dropper.Gen

Source: 1n8xsH3cmA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_88df21dd2faf7c49\MSVCR80.dll

Jump to behavior

Source: 1n8xsH3cmA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Code function: 4x nop then mov dword ptr [ebp+10h], 0000002Ch	0_2_00007FF8198F04F5
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Code function: 4x nop then mov dword ptr [ebp+10h], 00000057h	0_2_00007FF8198F04F5
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Code function: 4x nop then mov dword ptr [ebp+10h], 00000070h	0_2_00007FF8198F04F5
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Code function: 4x nop then mov dword ptr [ebp+10h], 0000007Fh	0_2_00007FF8198F04F5
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Code function: 4x nop then mov dword ptr [ebp+10h], 0000008Dh	0_2_00007FF8198F04F5

Networking

Found Tor onion address

Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003492000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003409000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003784000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003755000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003755000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003460000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000002931000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: TShttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003365000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000000.305718930.0000000000242000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php
Source: 1n8xsH3cmA.exe, 00000000.00000003.315503925.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000037CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000037CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.000000000302B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000036EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000036EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \|{http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E681986A=wpghlZrYJgisx3j8bZm9x
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: FEhttp://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe	String found in binary or memory: http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php
Source: tvaYCy1BcKESHqnO.exe.0.dr	String found in binary or memory: http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php

Uses TOR for connection hidding

Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: unknown	DNS query: name: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion

Queries random domain names (often used to prevent blacklisting and sinkholes)

Source: unknown

DNS traffic detected: English language letter frequency does not match the domain names

Source: unknown

DNS traffic detected: query: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion replaycode: Name error (3)

Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003492000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003409000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003528000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003784000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003755000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003460000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003365000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000037CB000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.000000000302B000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000036EA000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003286000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion
Source: 1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	String found in binary or memory: http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003492000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003409000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003528000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003784000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003755000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003460000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003365000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000037CB000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000036EA000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003286000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E68198
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 1n8xsH3cmA.exe, 00000000.00000003.386487007.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: 1n8xsH3cmA.exe, 00000000.00000003.388596831.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388789997.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.389522705.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388741820.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388557662.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388972226.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.389409636.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: 1n8xsH3cmA.exe, 00000000.00000003.389547413.000000001BF54000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388819911.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: 1n8xsH3cmA.exe, 00000000.00000003.388557662.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 1n8xsH3cmA.exe, 00000000.00000003.388789997.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388741820.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers0
Source: 1n8xsH3cmA.exe, 00000000.00000003.389409636.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers0.
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: 1n8xsH3cmA.exe, 00000000.00000003.388741820.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersP
Source: 1n8xsH3cmA.exe, 00000000.00000003.388681438.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersers
Source: 1n8xsH3cmA.exe, 00000000.00000003.389014537.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comF
Source: 1n8xsH3cmA.exe, 00000000.00000003.388972226.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comTTF
Source: 1n8xsH3cmA.exe, 00000000.00000003.389522705.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comX
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.385807403.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.385724591.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 1n8xsH3cmA.exe, 00000000.00000003.385724591.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnTFF
Source: 1n8xsH3cmA.exe, 00000000.00000003.385724591.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnm
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: 1n8xsH3cmA.exe, 00000000.00000003.385364077.000000001BF49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.krF
Source: 1n8xsH3cmA.exe, 00000000.00000003.387292812.000000001BF4E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387208920.000000001BF46000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387525050.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/(
Source: 1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/.TTC
Source: 1n8xsH3cmA.exe, 00000000.00000003.387292812.000000001BF4E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387208920.000000001BF46000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: 1n8xsH3cmA.exe, 00000000.00000003.387292812.000000001BF4E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387208920.000000001BF46000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387525050.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/S.TTF
Source: 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387525050.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/X
Source: 1n8xsH3cmA.exe, 00000000.00000003.387292812.000000001BF4E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387208920.000000001BF46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387525050.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/F
Source: 1n8xsH3cmA.exe, 00000000.00000003.382923944.000000001BF3E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.376890499.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.382879502.000000001BF3E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.382835365.000000001BF3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: 1n8xsH3cmA.exe, 00000000.00000003.376851056.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comar
Source: 1n8xsH3cmA.exe, 00000000.00000003.376851056.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comr
Source: 1n8xsH3cmA.exe, 00000000.00000003.376890499.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comsX
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: 1n8xsH3cmA.exe, 00000000.00000003.388011725.000000001BF49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.comJ
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: 1n8xsH3cmA.exe, 00000000.00000003.383054234.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.383035683.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.383073090.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.net
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: 1n8xsH3cmA.exe, 00000000.00000003.383104345.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.383121295.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netF
Source: 1n8xsH3cmA.exe, 00000000.00000003.383054234.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.383035683.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.neta
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: 1n8xsH3cmA.exe, 00000000.00000003.388502848.000000001BF52000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388476713.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388557662.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.dej
Source: 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	String found in binary or memory: https://www.getmonero.org/resources/about/
Source: 1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	String found in binary or memory: https://www.google.com/search?q=how

Source: unknown

DNS traffic detected: queries for: f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion

Spam, unwanted Advertisements and Ransom Demands

Yara detected NoCry Ransomware

Source: Yara match

File source: Process Memory Space: 1n8xsH3cmA.exe PID: 5552, type: MEMORYSTR

Yara detected TrojanRansom

Source: Yara match

File source: Process Memory Space: 1n8xsH3cmA.exe PID: 5552, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File deleted: C:\Users\user\Desktop\NYMMPCEIMA.jpg	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File deleted: C:\Users\user\Desktop\JDDHMPCDUJ\NYMMPCEIMA.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File deleted: C:\Users\user\Desktop\JDDHMPCDUJ\GLTYDMDUST.jpg	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File deleted: C:\Users\user\Desktop\JDDHMPCDUJ.docx	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File deleted: C:\Users\user\Desktop\TQDFJHPUIU\QCOILOQIKC.pdf	Jump to behavior

Writes many files with high entropy

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.tor entropy: 7.99732727365	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.tor entropy: 7.99734236084	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\MSO1033.acl.tor entropy: 7.99581183683	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx.tor entropy: 7.99995191594	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tor entropy: 7.99949627356	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL.tor entropy: 7.99943372244	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL.tor entropy: 7.99933162913	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL.tor entropy: 7.99931716378	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL.tor entropy: 7.99926587434	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tor entropy: 7.99923343248	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl.tor entropy: 7.99933347614	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL.tor entropy: 7.99932006238	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL.tor entropy: 7.99911514202	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tor entropy: 7.99927824007	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL.tor entropy: 7.99927534941	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL.tor entropy: 7.99941170207	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.tor entropy: 7.99248368008	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Desktop\1n8xsH3cmA.exe.tor entropy: 7.99974642796	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\edb00001.log.tor entropy: 7.99968499389	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\edb00002.log.tor entropy: 7.99965528706	Jump to dropped file
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\spartan.edb.tor entropy: 7.999918951	Jump to dropped file

Source: 1n8xsH3cmA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Code function: 0_2_00007FF8198F04F5		0_2_00007FF8198F04F5
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Code function: 0_2_00007FF8198FCADA		0_2_00007FF8198FCADA

Source: 1n8xsH3cmA.exe, 00000000.00000002.570896438.0000000000739000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs 1n8xsH3cmA.exe
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.000000000302B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 1n8xsH3cmA.exe

Source: 1n8xsH3cmA.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: tvaYCy1BcKESHqnO.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1n8xsH3cmA.exe	ReversingLabs: Detection: 69%
Source: 1n8xsH3cmA.exe	Virustotal: Detection: 49%

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File read: C:\Users\user\Desktop\1n8xsH3cmA.exe

Jump to behavior

Source: 1n8xsH3cmA.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1n8xsH3cmA.exe C:\Users\user\Desktop\1n8xsH3cmA.exe
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding
Source: unknown	Process created: C:\Windows\System32\OpenWith.exe C:\Windows\system32\OpenWith.exe -Embedding

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe

Jump to behavior

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File created: C:\Users\user\AppData\Local\Temp\Cry.img

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.adwa.evad.winEXE@3/226@33/0

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File read: C:\Users\user\ntuser.ini

Jump to behavior

Source: 1n8xsH3cmA.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\077cf2bd55145d691314f0889d7a1997\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Mutant created: \Sessions\1\BaseNamedObjects\tvaYCy1BcKESHqnO
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\OpenWith.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6100:120:WilError_01

Source: 1n8xsH3cmA.exe, 00000000.00000003.386582714.000000001BF44000.00000004.00000020.00020000.00000000.sdmp

Source: 1n8xsH3cmA.exe, check.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1n8xsH3cmA.exe, check.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 1n8xsH3cmA.exe, check.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: tvaYCy1BcKESHqnO.exe.0.dr, check.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: tvaYCy1BcKESHqnO.exe.0.dr, check.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: tvaYCy1BcKESHqnO.exe.0.dr, check.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.1n8xsH3cmA.exe.240000.0.unpack, check.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.0.1n8xsH3cmA.exe.240000.0.unpack, check.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'
Source: 0.0.1n8xsH3cmA.exe.240000.0.unpack, check.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformFinalBlock'

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File opened: C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_88df21dd2faf7c49\MSVCR80.dll

Jump to behavior

Source: 1n8xsH3cmA.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1n8xsH3cmA.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: initial sample	Static PE information: section name: .text entropy: 7.742473588286994
Source: initial sample	Static PE information: section name: .text entropy: 7.742473588286994

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe

Jump to dropped file

Boot Survival

Drops PE files to the startup folder

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe

Jump to dropped file

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\desktop.ini.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\desktop.ini.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE (x86).lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk.tor	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	File created: C:\Users\user\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk.tor	Jump to behavior

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe

Jump to behavior

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr

Binary or memory string: SBIEDLL.DLLMHTTP://IP-API.COM/LINE/?FIELDS=HOSTINGTRUE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\1n8xsH3cmA.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: 1n8xsH3cmA.exe, 00000000.00000003.434694241.000000001B29A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: 1n8xsH3cmA.exe, 00000000.00000002.585506926.000000001B2EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: es)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC423
Source: 1n8xsH3cmA.exe, 00000000.00000003.391838274.000000001B431000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42
Source: 1n8xsH3cmA.exe, 00000000.00000002.587300927.000000001B50F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42H
Source: 1n8xsH3cmA.exe, 00000000.00000003.476857450.000000001B308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42J
Source: 1n8xsH3cmA.exe, 00000000.00000002.571843116.00000000007FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42B513
Source: 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000002931000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %DetectVirtualMachine%
Source: 1n8xsH3cmA.exe, 00000000.00000003.475773861.000000001B506000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC424\|
Source: 1n8xsH3cmA.exe, 00000000.00000002.585506926.000000001B2EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42
Source: 1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	Binary or memory string: %Emulator%!%DetectDebugger%#%DetectSandboxie%-%DetectVirtualMachine%
Source: 1n8xsH3cmA.exe, 00000000.00000002.587300927.000000001B50F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42@
Source: 1n8xsH3cmA.exe, 00000000.00000003.434456532.000000001B3E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r(dard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PPCIComp0 x 1024 x 4294967296 coRWPC42
Source: 1n8xsH3cmA.exe, 00000000.00000003.475773861.000000001B506000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_Comput
Source: 1n8xsH3cmA.exe, 00000000.00000003.475773861.000000001B506000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42\|}
Source: 1n8xsH3cmA.exe, 00000000.00000002.585506926.000000001B2AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42==
Source: 1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	Binary or memory string: DetectVirtualMachine
Source: 1n8xsH3cmA.exe, 00000000.00000003.434694241.000000001B29A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42
Source: 1n8xsH3cmA.exe, 00000000.00000003.476250772.000000001B7EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42Y
Source: 1n8xsH3cmA.exe, 00000000.00000002.585506926.000000001B316000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42LMEMp
Source: 1n8xsH3cmA.exe, 00000000.00000003.477308142.00000000007BB000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.571843116.00000000007F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 1n8xsH3cmA.exe, 00000000.00000002.585506926.000000001B2EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_W
Source: 1n8xsH3cmA.exe, 00000000.00000002.587300927.000000001B50F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42string
Source: 1n8xsH3cmA.exe, 00000000.00000002.587300927.000000001B50F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42n
Source: 1n8xsH3cmA.exe, 00000000.00000003.434694241.000000001B29A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42m
Source: 1n8xsH3cmA.exe, 00000000.00000003.314786415.0000000002440000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: DetectVirtualMachine0
Source: tvaYCy1BcKESHqnO.exe.0.dr	Binary or memory string: vmware
Source: 1n8xsH3cmA.exe, 00000000.00000002.585506926.000000001B290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42a)
Source: 1n8xsH3cmA.exe, 00000000.00000002.571843116.0000000000803000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ontroller(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42
Source: 1n8xsH3cmA.exe, 00000000.00000003.476857450.000000001B308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42%
Source: 1n8xsH3cmA.exe, 00000000.00000002.587300927.000000001B50F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42
Source: 1n8xsH3cmA.exe, 00000000.00000002.587300927.000000001B50F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42!
Source: 1n8xsH3cmA.exe, 00000000.00000003.476857450.000000001B308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42\|
Source: 1n8xsH3cmA.exe, 00000000.00000003.475773861.000000001B506000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42f\|BK
Source: 1n8xsH3cmA.exe, 00000000.00000002.587300927.000000001B50F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42ONT8PUBG
Source: 1n8xsH3cmA.exe, 00000000.00000003.475773861.000000001B506000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42%}
Source: 1n8xsH3cmA.exe, 00000000.00000003.476857450.000000001B308000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC423
Source: 1n8xsH3cmA.exe, 00000000.00000002.585506926.000000001B290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42x{)
Source: 1n8xsH3cmA.exe, 00000000.00000002.585506926.000000001B290000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42p
Source: 1n8xsH3cmA.exe, 00000000.00000003.476250772.000000001B775000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42/
Source: 1n8xsH3cmA.exe, 00000000.00000002.587300927.000000001B50F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42t32Avai
Source: 1n8xsH3cmA.exe, 00000000.00000002.586365081.000000001B3DB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware24XSWE6_Win32_VideoControllerFOTLZ_62VideoController120060621000000.000000-000687798..display.infMSBDAONT8PUBUPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVERWPC42n32_Compute22

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\Windows\Fonts\segmdl2.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\1n8xsH3cmA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	111 Windows Management Instrumentation	12 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	12 Registry Run Keys / Startup Folder	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Multi-hop Proxy	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Process Injection	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	113 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	2 Proxy	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	3 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1n8xsH3cmA.exe	69%	ReversingLabs	ByteCode-MSIL.Ransomware.CryptoLock
1n8xsH3cmA.exe	49%	Virustotal		Browse
1n8xsH3cmA.exe	100%	Avira	TR/Dropper.Gen
1n8xsH3cmA.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe	100%	Avira	TR/Dropper.Gen
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe	69%	ReversingLabs	ByteCode-MSIL.Ransomware.CryptoLock

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.0.1n8xsH3cmA.exe.240000.0.unpack	100%	Avira	TR/Dropper.Gen		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/F	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comTTF	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.typography.netF	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnm	0%	URL Reputation	safe
http://www.typography.net	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/(	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/X	0%	URL Reputation	safe
http://www.fontbureau.comF	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/.TTC	0%	URL Reputation	safe
http://www.sajatypeworks.comr	0%	URL Reputation	safe
http://www.typography.neta	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/F	0%	URL Reputation	safe
http://www.fontbureau.comX	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.goodfont.co.krF	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comsX	0%	Avira URL Cloud	safe
http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E68198	0%	Avira URL Cloud	safe
http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comar	0%	Avira URL Cloud	safe
http://www.urwpp.dej	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnTFF	0%	Avira URL Cloud	safe
http://www.sakkal.comJ	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/S.TTF	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comar	1n8xsH3cmA.exe, 00000000.00000003.376851056.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/F	1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387525050.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	1n8xsH3cmA.exe, 00000000.00000003.389547413.000000001BF54000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388819911.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.comTTF	1n8xsH3cmA.exe, 00000000.00000003.388972226.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers0.	1n8xsH3cmA.exe, 00000000.00000003.389409636.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	1n8xsH3cmA.exe, 00000000.00000003.386487007.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersP	1n8xsH3cmA.exe, 00000000.00000003.388741820.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	1n8xsH3cmA.exe, 00000000.00000003.382923944.000000001BF3E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.376890499.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.382879502.000000001BF3E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.382835365.000000001BF3E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netF	1n8xsH3cmA.exe, 00000000.00000003.383104345.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.383121295.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersers	1n8xsH3cmA.exe, 00000000.00000003.388681438.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnm	1n8xsH3cmA.exe, 00000000.00000003.385724591.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.net	1n8xsH3cmA.exe, 00000000.00000003.383054234.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.383035683.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.383073090.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search?q=how	1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	false		high
http://www.jiyu-kobo.co.jp/S.TTF	1n8xsH3cmA.exe, 00000000.00000003.387292812.000000001BF4E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387208920.000000001BF46000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387525050.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/(	1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.com	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.getmonero.org/resources/about/	1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	1n8xsH3cmA.exe, 00000000.00000003.388596831.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388789997.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.389522705.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388741820.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388557662.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388972226.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.389409636.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/X	1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387525050.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comF	1n8xsH3cmA.exe, 00000000.00000003.389014537.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/.TTC	1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comr	1n8xsH3cmA.exe, 00000000.00000003.376851056.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.neta	1n8xsH3cmA.exe, 00000000.00000003.383054234.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.383035683.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.comJ	1n8xsH3cmA.exe, 00000000.00000003.388011725.000000001BF49000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/F	1n8xsH3cmA.exe, 00000000.00000003.387292812.000000001BF4E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387208920.000000001BF46000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comX	1n8xsH3cmA.exe, 00000000.00000003.389522705.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	1n8xsH3cmA.exe, 00000000.00000003.387292812.000000001BF4E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387208920.000000001BF46000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.krF	1n8xsH3cmA.exe, 00000000.00000003.385364077.000000001BF49000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.385807403.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.385724591.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.comsX	1n8xsH3cmA.exe, 00000000.00000003.376890499.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	1n8xsH3cmA.exe, 00000000.00000003.387292812.000000001BF4E000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387760929.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387208920.000000001BF46000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387680083.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.387525050.000000001BF4B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003492000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003409000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003528000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003784000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003755000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003460000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003365000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000037CB000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.000000000302B000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000036EA000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003286000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	1n8xsH3cmA.exe, 00000000.00000002.591548266.000000001D502000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cnTFF	1n8xsH3cmA.exe, 00000000.00000003.385724591.000000001BF4A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php?user_A8B4E68198	1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003492000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003409000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003528000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003784000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003755000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003460000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003365000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000037CB000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000036EA000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.0000000003286000.00000004.00000800.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000002.573057203.00000000032EE000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.urwpp.dej	1n8xsH3cmA.exe, 00000000.00000003.388502848.000000001BF52000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388476713.000000001BF4C000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388557662.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers0	1n8xsH3cmA.exe, 00000000.00000003.388789997.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp, 1n8xsH3cmA.exe, 00000000.00000003.388741820.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/	1n8xsH3cmA.exe, 00000000.00000003.388557662.000000001BF4D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion/connector.php	1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	1n8xsH3cmA.exe, tvaYCy1BcKESHqnO.exe.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	795684
Start date and time:	2023-02-01 07:39:06 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	1n8xsH3cmA.exe
Detection:	MAL
Classification:	mal100.rans.troj.adwa.evad.winEXE@3/226@33/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 96% Number of executed functions: 33 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, VSSVC.exe, svchost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Execution Graph export aborted for target 1n8xsH3cmA.exe, PID 5552 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:40:10	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe
07:40:29	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.tor
07:40:37	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe.tor
07:40:38	API Interceptor	2x Sleep call for process: OpenWith.exe modified

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	7.317098391653457
Encrypted:	false
SSDEEP:	6:WKJfsGQSMd4FoSfUyI8TLoFlP0innpdod0trILIBl58bIRbkQmdW8:W9GQS+4qSsyI8Tk9zVI8Bl59VDm9
MD5:	D1AC49C0D7811C66AAA38F5F881FEA80
SHA1:	4332562E309CD43E7D4CEDEB874F5E36501DB275
SHA-256:	6CC23F370DB069884BC8CF5146F7659E9D6C80C4B826529DFA9991A78AE84ACB
SHA-512:	F1DE4764D6F7A8949F43BB8AD584EA2D77B4B0A24E30420B5E714874B46620764E9DA86EEB4A7C99970705678E3C1DB509B121FDA7AA6FE6F522DFA490A0AF96
Malicious:	false
Reputation:	low
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>..........."\\..iS..w)....m..._C"....!......<...a.........M..1..#1..a..7.wB#8-.N..Em....5UO.b...>...A..=...(...9./..7..z>..`........M.J...\|...\|6.Y..3.^x......=.......n(.Y.Y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Reputation:	low
Preview:	....\%R.fg.tF.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Reputation:	low
Preview:	....\%R.fg.tF.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\container.dat.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Reputation:	low
Preview:	....\%R.fg.tF.

C:\Users\user\AppData\Local\Temp\Cry.img

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	PC bitmap, Windows 3.x format, 1920 x 1080 x 24, resolution 3780 x 3780 px/m, cbSize 6220854, bits offset 54
Category:	modified
Size (bytes):	6220854
Entropy (8bit):	1.5349835895142694
Encrypted:	false
SSDEEP:	24576:kd9UX9spYOsPmxGjZQMN0WrRXke92c8yrqY/v:s9UefGjXvrV/v
MD5:	5C969F9723A65CE72086E80B21559598
SHA1:	4AED2784566F36310169DFA17BFCD1CAA912AA83
SHA-256:	478D970A12C87E214EB50EF784DF4DDBA4B7A425E70F7E96DABFE8A9886DFA1F
SHA-512:	7EFF24D90A881496326B07B6DC239CB1BD315AD22A51632F3DCA594BFF09DA2C69ABECF30712577D71C2DA94FDC02815F5B5070A8132EA1BD3B88C21334A0C7B
Malicious:	false
Reputation:	low
Preview:	BM6.^.....6...(.......8.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.9375
Encrypted:	false
SSDEEP:	3:TN5tM+RIGxlBeVP:B5t/RIGjoVP
MD5:	DB115FF73CE6D14AFEEEF053CB6B3A93
SHA1:	95F9D5AE52D45A876E987A0E36C3FEF675102F5A
SHA-256:	CCB1FDC93C2C43C10B4143B5E093366C4855C266C3D9C61C75C735A3BFDAEF0B
SHA-512:	F9F35527A95320BCDC1C7A359660F602BF68ABD3A50BE1B45C0CDDA7953CE1CAEE3F72DF0C06AEF9549352C3C6E810FAA115EFC56401DD32E43A54B017CB09FB
Malicious:	false
Reputation:	low
Preview:	.m.d..M[`R..[.<...#(..U.{?$..gf.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.875
Encrypted:	false
SSDEEP:	3:WtB2JtepYbZ:YdKZ
MD5:	971EFED0099C66E2ABA934866FC76894
SHA1:	4232676ED9E3FE49D40976842193FF06CCECCCCF
SHA-256:	C68974226F98A7EB043D43D4C609E513DC6855BC8AC89F7544646CCE088C7A50
SHA-512:	204C67F1C807BE22AF8F85FDF96020F30DC9F2604B35D01D8B79E2ABBD92C46D8D2FC1B5CCDB6716B18080B61F138CC7E4DA29C6956C26D2AAB19E7FD8B4DB16
Malicious:	false
Reputation:	low
Preview:	...N..,Hi..<....vI..\|...^.H..mA

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	640
Entropy (8bit):	7.681021818967464
Encrypted:	false
SSDEEP:	12:YoKtnYzMyLwaak1PGX65S8XG4t5yKemCogw6qlia6cXJV90MhCgPWnFKEK8mrBh9:Yn8MyLZak1PGWSZmdt6sianxhCgunVRe
MD5:	A8BBFFF9A8E15CCB1B7AFD654DB31F5C
SHA1:	02346AE51E8CF1A1556E0C6D3A9F2CBA098CB665
SHA-256:	E0900EA974178BF425563F2159F82221255A5CB4D14923AECB8970A067051B90
SHA-512:	64DEE73C64FF81D5DFDF9ADA9F84B9728CFCB07084A5DAEE72D516AA1013B5B849E961D4E7A44430F8969635B474A577E6462654E74FDF1758A8D427587B9BDB
Malicious:	false
Reputation:	low
Preview:	...\..Ou.......+.t.U..t......M..._.^......L.V...eR..d..../3.. .".,.....}.s...h.'4>0..w..{.....l!...w`P...&5...ov.d.y.Ie0..}...)......c.~yN....5.+...X..?R....\...m%..o.In.....o..STUEek.jr....;z..w...g...\|.]WL.k.\D..)......wI.>..{.+#u....%......@;.:..zN....S\|K....q..%NZv..=.s..O~a4..F?O.R...paC.. ..K.].}.Y.......:?.'LOT.Q.r6^.Gv_=D.2.u/...d.}..MV.la.....70.....2.B...$.5m...jsR..w....$.g..g4...h..V.....Bj..E.!..}0..Y..).iN\ue....8..$E../J....Tf\|\..uN}....~..?......!.J.u.Q....f.t.9B.R..3..G.fj...l.(.H..u.V{.x.+Y.l}....2...Jo..a..q;..?.t. ..,.......h.}/l.......5...$@.A......^.<P.D:..;.6T.Zf...hT.d

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	432
Entropy (8bit):	7.482198428470789
Encrypted:	false
SSDEEP:	6:+Cvew+fRimhKClMRXjMKyXrkx83l/AQkg5jUGuHz4jf0GWamQtjaE4TRgviLXIUl:+CvLocmhMRqdBG8gnScGWNQRBDUXZE4n
MD5:	3C25D5F307A6C610C0416BF9A39B56E3
SHA1:	0A1D259D373F20A241E8868400F500D880BDDF9B
SHA-256:	E7932F1EC3D6594BCC27F74BBFFCCABBADB3D3BC288198A8BA66279439B61932
SHA-512:	25B9468BC848741DD721DB55B37627A80FD4ACEB5569139349D5D6DCFA88664E94A3436302B939BDD7AB7F8C0EEDAF95DBD5B7F553221F84ECF303089A4F6D2A
Malicious:	false
Preview:	(......H..$'..\|NJ.j..c......l..2a..S.m.5....ucC..#.XT4<n.Htf=W....b..0.....i.D@Icb..(...ko..N..S....<.!'R1...A....Yal.acn...L.........#.%..?t.,.....6X.q+.\(....$.K..J......[...Y.....`-.3......>..........!..dc.q-.y9Y.D..'.[.....D%..........A$;..h.......I5.J.m.c.$K...Of..f.....\|~.65..:.......y.....4>.3.8l!.PH.~DP.......F;..E0.fzJg1..].j..`....i.."..8%.(..........[...=./6..>+xD...".):...@#..{..9...dQ..$.#

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	10256
Entropy (8bit):	7.982209580911694
Encrypted:	false
SSDEEP:	192:Pt1YoRSr12K7GQoGl888g7sov3INulETjrbYzIsDUmKD:PkoRw2K7lxFJlijrbTsYHD
MD5:	76752F07C8246DDBF1EA3D8BF2D91B4C
SHA1:	A95C1B26790C32A523C9E54048992F7678BF6B10
SHA-256:	B3E049A594FDB655377664CFE94DE172D23E52707AD634A2CF014C9FC72B5A0E
SHA-512:	237AE31E1B912CE90DCDC9D6E7C0E4D7FC9449823FDC86F7DA4E155464B981397E6EE9CA97EFB979B7309A5BF3F53FC056F13890D72C846C36E22831D5F367A6
Malicious:	false
Preview:	.]..{L....m.q'\|\\|.....q...V....7.Q._..<i.g.m.Aj>.#Z.@.i1j.%).........V\$..8Lj..8.....v.X..P..8...C.1.=.w.......4.........}_!+..Ta....k.&.>.f.....7}'C..\|FcF...(t.:%..N.6..9..E.sk.(.......]...V.r.viO.....hB!...........R.S..3q...P3/!$....^...N....r.xU."."! ....&.T...gL.F...F.^.....<..U.w..P....W...>.&:l.g..X{..E'....d.8.....Ui.CN.G..o.~g...A.>gc.I.a...j..;.0.R.3..p...`.RnS...Y~.,<..R..,....rA...4L7wz..={/.3..Qu..km......tBE..6.=o..........`.%~`+........4}o...U?4..a.u.....F.dN....g..>..nE...R.C.. T&i..=.6..y..F....a....J....i.K.2..I.......}.4+70..&.[g.Ce'..% D..H...xQ...:.h..`..T.,s..>.zM5......E........o...`..W.K..Z...Ao.}....N.Aa...../.Sj.?..BG]J.........]J.k..@.....`NC...H.. ......v@t......(..*..4z.]x..8...u95...T......\B....{.xu}5...h.....rD;.p.w-a2.w...:K%^Fg.2.....o.........e?m.....7.O...t.....;..\...H..>......Kp,...{.4..=.G..J......#.q[..4.dl.F......"....y....M..kd..f..JK.-.2],OF..'Zh...Z..a`q....s.0[j"...k8.e..a..........S.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	24160
Entropy (8bit):	7.992483680077554
Encrypted:	true
SSDEEP:	384:jXjN4W/JYoEhVIg4WxZAzc9Ls1kX00Cf8Jc1aq9wU37DHJ46vt+46+aEhcjd00C7:DjN42EhVI4wmLtX00CfVkquMLJ4Ig2aq
MD5:	EDBBC0AFD3CBB77E213612B4D42FFA3E
SHA1:	7D75BFC577917FD1B923218CC27092647134B95F
SHA-256:	3D51BE494D59982B14A0D3A75F8A7E29D4A21EF9948ADDF11CBB9FFEC596428B
SHA-512:	E534D484E65FE9FC399D4FF6FEFD835C7E8FF43CFD7E19C700C8EB99C6BFCA233AB5B284CCC20BBC3034BCF2EE6CE234D0A4FEC688761CE29502A422AFFA8353
Malicious:	true
Preview:	./6......K.Y.._..4T.'6..V.-...D8&".j...$./.9A..Z...+O. m;F...^2......J..2....,)....+$YW...%..lAsi{S...+.i..O.-R.../&.N........F..p^.V..".W.`.5Cu.c.F..x.#.....lS..ZH..=<./..V"..v..1.....w..eq.W....K..:......#RQ.$E........C....R#2d....A...-.R.#l.v.&4..Q..E.F. D>....cB..C~W...N...E.......&d....q....(.6...O.n............d.:..L....U...bT..c0.{.H,.......'.....0f.SE......d.Z......J.....mD.r"..'.2.wM+.j...T`ul.z."u.........%....O.......C...g..p=..8.{f. .2f...{2J..@...g.).k....V..V.QF......=....x....I....d.&.b..97/.\...}..+.9.G.G'QJ...n%..#.I........+..a.N.7.."...I....B+.."..0U.m..l...."..1'....^8.6../U.`._.sF7...M.._F.3.%...Y......s....W(~4....[+....Co...`.m..?W.Ye.....-..`Wd.e......K....5...z..k.T,V..lPZE../s.z@...v....[......!......HV..=...3.4FI"3.W......v4...I....&...ep.....C..L.T,.Fg..".,.~9..h.c....H#".U.<C.~B~...[.,.......j.U.....@J....Lw..z...f...1..1R9.5;..&......<......o.I77.Ild...^<...Z..F.....L.....!I..f.....M>Y.........;@...1.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	7.198170299157433
Encrypted:	false
SSDEEP:	6:N5cL/tNxnn9iqBQ2j6GmZGbv5RF6qk1+0zmzNu8fh:oZNWqhuGmZixRF61bzmRuKh
MD5:	AE600392CA4D2E19430592F816A38528
SHA1:	41423AB5C559F40DE679567A5AFF5425EDE34E82
SHA-256:	791D1B053A5FF23604937D0256C6615CE2C04182889ADE8F1E7B780CC1422576
SHA-512:	0A0B7E2432EB5026F97DFDA35D661D72B3BA48F4BC4DB1A0FA2C0352692F12CDC77F804EFBDE8F8695EEA38C02E1DDEA48AEFC82192C4D893D1944C861F96745
Malicious:	false
Preview:	N..I.\|.dOd%....@.I.k...)....{H..].D....w....;....+.P.:\|...N.mV.!.."....\...@..AZ... O..$..F.O....H..,...u'.....<,...MZ_.y....,.Y.%o.G..w@.L6.3.E5hJM..X.BZ....... m.u.Jb#..~.!..F./v..F.$.F\x....fT[.hqT..4..j.X..4#...Z......:.I...`...i.Y....a._].U.l)...,.

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	14464
Entropy (8bit):	7.988732178395845
Encrypted:	false
SSDEEP:	384:APq2pC8vrdn6REknBPwf4NxeQj1JVvXd7:8pCq4XFkaxtjHVx
MD5:	4B6E35E16A9FD155FF1C2032E8FE3D10
SHA1:	D40934110F158E7D0F92CE2DBD9A2CE3C057C9FD
SHA-256:	227E9EBB751D23EF7888FFC6D684F0F453FD3AAE55B8A431C5469F173D84D2EB
SHA-512:	E293ECE8E0BBF3D1B01ED871825D80C5046A9D876186D101525A3E2F93F651B8B6C8F8CDE0D873C22B92BD9929CE379EEF456086B2CE57C972582BE5879D87B7
Malicious:	false
Preview:	C.7.5.D..............oc.......f.w.......?U4.s..@....X....... .C.g.%...f...._......]gm8.}3...U...k.jO.,..._._J.Y5........!...\|c.b..P.:(..........t4T...C...u...{...>..2.w.i".?M....X..Q...u.'..s..l.^Y.!P...9,...Q.......)..I.w<...QR........T......7.v_%w...6.u..(...X-hF...W..L-j5k..8.F../.A.p]..q:LD(f'<x.a...H.Z;....e .....[]D."...sg..U^b...q.!bZ.C...~.N.....d2<.....C...P'.u.^T.pMF{..Q.1&]."...Xp..7._...o.;....`..L...kF.....F......y....i.+.Q.~.....<.'O-......g.Q:.....6....M.......)t.a...d.l.....N...sg...rzsk.~.5s.;....B7.{...:....>..._L..dHeG..2...s......=Z...0...N...dU.....B.&.L2....S./...w.A..C._su.s....&.x..ym..7.%.t.Ao\|.DJU..v....x...$...^.&..lm.dz1iM.....LL.-..N.@.~....Iv.A.6.-.....;G^.......3.d..Fj_k\|...........<.M)...7n.......i...W.Ha..q....YA ...h...P..P..f.......P0NLp...U.F.nO.\-.....Y.......#...\|8%..-..C.e..i..i2.o\.t.c4..Mf.....>.!.!...Ki!.Sp.Yn2I..m............dHI...N..t..=..?,....:....\|^.3h...j,.s.........1.S...

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	333616
Entropy (8bit):	7.999496273558955
Encrypted:	true
SSDEEP:	6144:ebs6Q2irjNe1atQGm5rTQ1+mv856EAadNMqg6bgB72:abQpd1m5Q18g/kNtuC
MD5:	AAFDB24F8E6B3E7ACEC9A45DD2479735
SHA1:	5841A34A37492D8D7488C2421615FDF61A296F99
SHA-256:	1B6DBCDEAE83F126E9EDCB300A1F8E3939861853A9C0D9CA457E2DD11DD30C73
SHA-512:	4827AEBAE39392DECDF3BD49C9FA7E8062E7FEB53EE2545A2EA8C3D5743798197A9E37B4A795481592998C8DD575C9B393B79894A7FDD3F234EC853CF95BCA90
Malicious:	true
Preview:	C........?V-.../..+....$.p'......J.UkH.1.T..sg..Z...9...]O.Kq=....o.m.b...!._w.=.0.W...Cz?V.....E"Rh.".M8.v.=C...%.B#.$....S.tK...'.'..E.=..,xQ6)^..>b.+m?Q..x..GD......#1....\|I.......j....D.U.v.>( ......0..+..O...J"a.}.9.....w0.cs..U.v..E...+.D....]6..K..T.._).u..'@j..cRg..^HN6.y....6..,k..!..x..6......f...$0R.....5f..:...6.d.f.UO..".,.,..C...y..O.....&!.....~R3-F.z..k....C.D.S..><8'........E....."...[...v.Md.c.Pg.1P]..\.&,HO.=..7O\|".~...+..3...f...........Z&.Z.(J..U...Y%S......]8..W.......I18(....^.pA.3.".s.wS/.#...w'......T..5.d.h.q.99..7.:.#......X.n..v...]......2.at.]P......A....]U...D.MU...j{.....>.L......."..BYn.......GeD....3..0....e.s!n.\|._..E.N9f....Q.#.P]...Z....Y"N&D.E..:z.T..m.?..._..Gg./3y........B..2.j...XM&..n..Xs..A........,x.R,...,..\.l.j.o.....9,...+X.........,.Ti...F&.....-~.....V.ESxe.+.H.S....kJ.\|......._...&v.\.o.rU.l..Q}....Jm....i"B3...7...........DW~.+.vf.).O.q./.>.......Ka#.*..w..(..^.%`ZK..K.U...[{.

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	297024
Entropy (8bit):	7.999433722442055
Encrypted:	true
SSDEEP:	6144:J7OqZo5pf0KAW5+nTAiSI/c7yOloOXC5x87Ahom8xn8xbMkpQXwdqa:t9ADAW5+n2WCoOYyxjkQa
MD5:	3361843B5FC79A1BA0DC00B0DE291AF6
SHA1:	B22AD9817A101AC5A2B144AF4A4EA6A845E0EF92
SHA-256:	D92A7E642830BA3AA075B40F23DE7983023928DCB7C8DFCC08B6341EF8BC95E0
SHA-512:	366717A3245DA09F34EC4C57FCDAAD84936CF2023BD7C61A03656A58BC62DCD60B0C1DE8A19A6E841E8B92DA98EB1B7C1E55C8C6451A58F0C9242C69659FFA51
Malicious:	true
Preview:	.{..c ..c.3.f.s.&k.X..0.~..FN..LR1H..IF... ...3P\.j..M...EH...OK4.o.!md.tv./...S..0<....&.,-.... ...YHK..u....h&..7.(...x_G.-Pi...#.o.)O.Zbq.i..p ...PDO'..K....-.2Pb...V...}{..UI.#.p.._.m)Z.....G.......N.L......@bO.6a..)D..7.....S.X..?!./:n...4\|...{.&...k8.t9.#..q.k..R...T.......A......l...@..<.?.].2K.\...2..c....A_.Q.o.wY-.....s......f.-?..gM......xd.+.p..B.vd..L.=.,.. l..t.lI".V.....;.y.i..i..Y...-....V-.a....L.5Z.6..^]6...#..4.....lV+h;.....].b]....x.6i..S.P..F\F.wp...a..D\|..s..??.....T..1@....&...$.Hb..P...x...`..s9.=..B1..I..?IE.2...O..A.?6...2P...A0.-...a..a.... ..Eu..3..[~..G.=..'..1.V".2.t.0n.Zh.MD..#.N....HZMx$.....\|.B.......py/t.F.vY.@.....Mb.`..wn......(......`..I......-k.K..C+..3...m.8..X@....P..N.R(....=/1\|....O8.3.w.W.<U.."....[.?.S.8...q.B.....ASs..Nl}$^.........B.,.q..,.4.....5#........wP.L.5l.S..;#I. .....\..v?......;^....*..?.P.:.V.z.A.{abq'.M......s.....fe.n-9,.9v#...Oc..~.d.K.E.W0J........CrbL..&8t:.5.<

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	268672
Entropy (8bit):	7.999331629126782
Encrypted:	true
SSDEEP:	6144:5qF9tiZDeblvLh+qmIgL3xv+D9qlOE/Q6s3F6G:5q7tiZibWgOBa9qlVQNt
MD5:	6C0FB38E1E902F989D2D0D25E441110B
SHA1:	EF0A3A3D98DBEE4F97835DD20C95929B1331B841
SHA-256:	EE820F8E9D70C183DE6FDFD77AE49D0D6975F0D424F85AA17350B393C1A892A9
SHA-512:	4DF0C6B735137C68D89D54DBF10C106A21607D5FA0A75E66325BDB82415849FD5609E53A35B883674C4BBC4221D28B023BFFADA3C012F5DC47DAA597518F3543
Malicious:	true
Preview:	C........?V-.../..+....$.p'....Py8...w..5$Xc....z5.b.Y.>FG+O....q..f..z..!.5^.d.-..&.1..x.u8R.T.....FG..?.d.HCzR5...$S)Y....f].....71...!.......R....I..%lb.....BU.......\|.X...#>.J.m.\|,....VL..!&.]6.O.$.O6......\......\|#n.b..@@...+.....Y.,>Ml......;r>..45.y...:..;.ko.w.@B.b.A.Gu...u-@..9.1`...S.c.9D/.E..q.X$.j%..K~.....?N.'..Z.?+.K+.....a%..3B.Z.2.....<..G..)k2.....?.1.x.....)u.,.h.pVM.w[Rw.N..J;%.k..MNsW.o.\..e...y.w.... 8...-........T..E..M3..W..3.C..H..ZP@....AnAa...(.q3...@$..#...Y<....Q^.(.x.+'.7..{..1..,p..zd.T.v..u.CX..3.vg@.?\.1.Ig.a..x..!...L`......w.$."....L.....".....I{hu.5.6ItW..K...Y.8.`].[..>.....A..jj..p!.-.c.S.[.@...u}.......A..h.)5.....U.{.sI...M.E..H.....X.>~n....0.?....1..\....$.m.-..`C..n.o$.0............O3.u..W...&..lh...~I..y...k...\|......$M/umz........;..........e.J..]....m?i.....F<....[.QN4;..).....l.\.....Nm..).<E.G....../J2...ox. .#.E4cV..6kZ..\|.1.Rn...${..9Q.$..fjf..D2...O.....V.1....K0.[!...U....k.9.8.u

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	256368
Entropy (8bit):	7.9993171637796765
Encrypted:	true
SSDEEP:	6144:KiXn4usKRVHUHtv1jUrQfAfW+k8ruudICg8mbGcR7MjWOh:z4kHOtvd6QfAuh8rDqJ8voMjW2
MD5:	13859B4716738DDD7DA1C281874DA35C
SHA1:	148D3752EEF951B19246F40F7233ECE1DE69D8C1
SHA-256:	A5AC9E3E6C1B78EC7C03A75C3603BE3F079D63048B1FC00ABB90E989E00069A4
SHA-512:	D0BEE4CDA7E93AD724C9EDB323872FDFF9EDA1DD5455CFCBEA28BE28220896444FF4EB62DC9466DFF79FD6BC280E3A8A314C24FD978EDD228043D35D0E36635F
Malicious:	true
Preview:	C........?V-.../..+....$.p'.....W..i.[^..5>.(.>..[gK.]M-... ...iJ..@.{..... Z. .r.n.....jy....2...RE.p.j.....x.F.3......J.ldM..2....T....DT,..~S....G...^.....F,.cx...%/X.....M2>....l...-.n...oy.......s.Z1e.AA...h..S..Ww...>..{..%.A5.>ae.0D.&c...~....W...D1.H.aa.3.m..D......"..Z./......./.....F..9..E...1..Z.FJ.Z.#.u..;.Z1.......T....5..s......0..+0.&.3n&.q.0.Z.N.,.....y... ..y..i..}!..T....,.q5j...%I.w.F.UC;-...^o..$.852@..-.%.9.B.S....!V...6...i..o..2.O.!...{.m.....~../....!.m+.C\..k...T.9.]......N.M.m..m..<7.ok..6...~......:...y.L..D..@i...e.....rJ..p=....s%c.r...`.M%.....b.K.6'.Q.....M0h.......[.%..-..We.I.p.....r.....0.c.. .4..._..4..I$.....@..1m.W..&.....hB..N.....%...<..7.q..O.w;..[-...Gx...B.....y...o..w..6%+.c>.3.n..g....J.b...('.opo..bTQ...lm....u6.&Uk.7>Q...Lj.M....Rv.S?@..D..~....x..)..T.....>.u...a..Zz....gIp...;V~..Md.<....f..z...;.P...>..cE..Yb..(....`(J.i}.^..Q.xJF\|.*.MwG.h.Lo..0 ?....O)O.4I.^..\;.=.U......>..Q..

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	251456
Entropy (8bit):	7.999265874338529
Encrypted:	true
SSDEEP:	6144:KnaO9fQjab3HTF6OyP+1idmHi8vkgsofkj3gR:YUaFE+1dC3gL8kR
MD5:	7C7527DAE87ECF002EAD092EB7DEDED0
SHA1:	6E703C8CF7B0F206EB5CF832CEE67B777FB46162
SHA-256:	D636EBFF3FC908E4103A0FAFC9B573D339C5A88C90254D0246FD96887AE624C5
SHA-512:	527B5039219C2ECE17D239EA0F93050317FA0016E49EA7BCCA2C33742F90DAB1BFAB8D18F2EA76BBCC14CDD44024DB585F0BF722112484E02A4D17F55A749E1E
Malicious:	true
Preview:	C........?V-.../..+....$.p'.....o.V(....Y..'L..Z..!...9tF,&..........v...t.Lp..........f..........Z..I...)wR.........d!.:x....N.uM..l.c.........\3i%.[..5._h.....yj...8..7...$).bL...MXd.HoE[.oi.....t..o......KLf.0.Y39K[....b.L.$..AI`.J...:...t-(:ej...:T.9o....E..W..F.@.PM.....ZKY"=?.r0.........P)..y.eY...$.].........GD...%u..ZW.......m...N..h.../Ie. .T q.2[.u..L...Ff\;.6.s...s.t...UF.^...>..i...{.^.{QV.y...........n.y.w,.r...q.@.z..M?rq.._...t.x..L....w...@^...eC_..[...;..E....BNW.<.},n....u.B.......8..!...81..a..r.#..+.@...5k..~.dHS........k....i.H...(.]..mT(=....g...7v?.Caj...w..-.Xj.0..D..8M...P...Ej...Li..l.U1b<...r..\..9.OuW.....X..V.q.ji@.3...q.x..8U.. ....^.FJ....%.Vy.E..{+......WG-G.....z7#JG....>;..47@....)..l..%...@..._..'.._.*.s.o&.}.....V.~..4i...v.-'f..f....{@...\|.:.>.........M"g .iym...\|.Z.P4f@...n..f.:..^.rC....g.8&...BT..M.J.?........H.1F......H.xU...........r;..8..N.ij.cPJ.V....`1.(4i.........D.....T...?.H..{..]

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	284816
Entropy (8bit):	7.999233432477005
Encrypted:	true
SSDEEP:	3072:ojO6Lut39EcdFhnKF4xLD53uQ6JARxRHZZnKCfCdIKbpUM8J2Aee8OyQnYQnK/vd:yGNE4keF+Q6avfoIYGs48O7K/Kh4NwW
MD5:	0F20BDC94BEC10F9CA154732FE00E5F4
SHA1:	6025C9B3B5C5CDC1118CECEC6602F162CC26E593
SHA-256:	50FF89EA3D3D05B42AA6A503C93A957BE5A172DC608499C09D900430E9C08092
SHA-512:	8D89EB72C3DA5244F07B674E153987FAFE72F695ECDDF9D617D69A3110908E9533CCCF84E545BA4A8726E204621EE24BFD27E8901465613EAB71D2490B7909C0
Malicious:	true
Preview:	C........?V-.../..+....$.p'......J.UkH.1.T..sg..Z...9...]O.Kq=....o.m.b...!._w.=.0.W...Cz?V.....E"Rh.".M8.v.=C...%.B#.$....S.tK...'.'..E.=..,xQ6)^..>b.+m?Q.......<+.-.)...n7.6t.[m.3.._f.O..Lp....p,.P.`sc.j&`.h.......~..#.KQh...V..&.TB..J..9i=.........\{....G.p.."F....2.1.zN`.ig..;y.:rD6.....z...5...<.N.yo.M...i.$.....r...m.Vi+i=G.>.n.J..vl.......... $x..k'.n.G.....#.ts.5ED.$.#.2.R..6.....9..Q3....FI...^I....,...\..8.h]..5....J...G.{n%e..O.w/.".>.. ]...yq../.Fd"...y...$..8d.u?7,2.I.RX..Tz.myA.....<G..'...j?.kw.._..M...."...k....L.]L..........._.(..F%.by.rQ...fR..R.4;.......).`.s}d.O,.......r}y ....{t2f..h....y...p..#.V..O.k".]._.{vi....Y../....>.H}.k.f.7../.r._.~...:.V......H,V.H.......f.R.^K..@..l..<.=.......7#..OG..+...f...d~.......\|...&M..'.~. zE+=#XD....W'(...e&D.\.m.5....!.Mk...x=.. .E9UH./....d.._...A.HW...9..,.@c}b...t..).f.PSa.H...9P....h..A../v....x."..m...f..4PB.!}t...F;.54..(Q...F=W.l,..... ..[.a..2..}.ZP%.0...E?.*}.o9..z...@U........>..2@...

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	294528
Entropy (8bit):	7.999333476144531
Encrypted:	true
SSDEEP:	6144:FylmUc476YkgykKFsaPuI3WSrIrzU1jSVW7Tk/uAKKnwjmUfeo:MmP4W2ykfaxrf1j8W74Tvnmeo
MD5:	C2EA21F9BBAB14DEE7AF20BF971EC48E
SHA1:	BE00B07FBF45D717E271634BD4486C6FBD918270
SHA-256:	8E0ED526B61665D46FA2721F2889CABDC034DDA4534E0A8AF3E88CC60110B376
SHA-512:	E74AE5A67BDDA1B11CA1621609C7C74603D7667748F34892972F32945D7E740A48D5471292483159BA522B46F193F6C49D91561EB0BB076BDE20DFF91A6F9636
Malicious:	true
Preview:	C........?V-.../..+....$.p'......J.UkH.1.T..sg..Z...9...]O.Kq=....o.m.b...!._w.=.0.W...Cz?V.....E"Rh.".M8.v.=C...%.B#.$....S.tK...'.'..*E.=..,xQ6)^..>b.+m?Q.......<+.-.)...n7.6t.[m.3.._f.O..Lp....p,.P.`sc.j&`.h.......~..#.KQh...V..&.TB..J..9i=.........\{....G.p.."F....2.1.zN`.ig..;y.:rD6.....z...5...<.N.yo.M...i.$.....r...m.Vi+i=G.>.n.J..vl.......... $x..k'.n.G.....#.ts.5ED.$.#.2.R..6.....9..Q3....FI...^I....,...\..8.h]..5....J...G.{n%e..O.w/.".>.. ]...yq../.Fd"...y...$..8d.u?7,2.I.RX..Tz.myA.....<G..'...j?.kw.._..M...."...k....L.]L..........._.(..F%.by.rQ...fR..R.4;.......).`.s}d.O,J.`1).....U.w.N..5...1b...-.....A...X.c..q:T^.v.;/.../&....(Q#.Q.d>.fG8.RGi...1....._.\|$b..`....Jr....Y..5.x.%......%(#...6..T..b0.].2.e7.....-k.._.@U.J@.3..0jIE<,...D..Ua..a..k............O.f.h.u..@RX..+...6cV..4.k..2...\|.R=C....J(=JNI.A/..>....QN.........Fg..I.GE.w...j_......&...4...Q.Gq.jd."...;.....Yk.[z.w.HQg...6.:~]..[...s.j ...u.(..P..M0.+..S..~.q.f.V@a..

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	270656
Entropy (8bit):	7.999320062378222
Encrypted:	true
SSDEEP:	3072:b60f4lG7wxk3hFMtiqcabaTKUeblHm6ps6J2S7cDQEg9XYpzu95elmavH1uw9B6v:5qF9tiZDeblvLh8P3zu95+mcw07k
MD5:	EF8A0DCEB259950231CA4CE7469600B0
SHA1:	02CCF0833053017AB2871D735F79B2B5CD88A88C
SHA-256:	C646F93F52C8C60F189ED737D40729E9F3058FBE9DE37FE81F7AE12AE3A61355
SHA-512:	5DAE802EC0E413991C6EA4CA036FEADED30CA832EA3D5BADB57D6AAC31E9F138C77954EC6B3A82EDE462333868EB95EAC215F6CB993E5277F48A37F60589BF8C
Malicious:	true
Preview:	C........?V-.../..+....$.p'....Py8...w..5$Xc....z5.b.Y.>FG+O....q..f..z..!.5^.d.-..&.1..x.u8R.T.....FG..?.d.HCzR5...$S)Y....f].....71...!.......R....I..%lb.....BU.......\|.X...#>.J.m.\|,....VL..!&.]6.O.$.O6......\......\|#n.b..@@...+.....Y.,>Ml......;r>..45.y...:..;.ko.w.@B.b.A.Gu...u-@..9.1`...S.c.9D/.E..q.X$.j%..K~.....?N.'..Z.?+.K+.....a%..3B.Z.2.....<..G..)k2.....?.1.x.....)u.,.h.pVM.w[Rw.N..J;%.k..MNsW.o.\..e...y.w.... 8...-........T..E..M3..W..3.C..H..ZP@....AnAa...(.q3...@$..#...Y<....Q^.(.x.+'.7..{..1..,p..zd.T.v..u.CX..3.vg@.?\.1.Ig.a..x..!...L`......w.$."....L.....".....I{hu.5.6ItW..K...Y.8.`].[..>.....A..jj..p!.-.c.S.[.@...u}.......A..h.)5.....U.{.sI...M.E..H.....X.>~n....0.?....1..\....$.m.-..`C..n.o$.0............O3.u..W...&..lh...~I..y...k...\|......$M/umz........;..........e.J..]....m?i.....F<....[.QN4;..).....l.\.....Nm..).<E.G....../J2...ox. .#.E4cV..6kZ..\|.1.Rn...${..9Q.$..fjf..D2...O.....V.1....K0.[!...U....k.9.8.u

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	217584
Entropy (8bit):	7.999115142018359
Encrypted:	true
SSDEEP:	3072:l7Fy1clv3p8XV7Aa8SxWENmGfITMkl4NrjIKGIifLlFuE/vXlUhLef/:li8vZwV8kyinIzVlFueXe6/
MD5:	1E74BDA7725FC6D194D50E2E107D53C1
SHA1:	CA7A7505F5E093DC9C89D39A437D812E4D2A6415
SHA-256:	A09FF19EF7F987DC1D882D7C0ABFD6706883D9D1A9DEDCBD72E0B304B35792E6
SHA-512:	E340992BF163C9C6EFD0667B2402ADC872A6F90F692EB0BEF93DD9F862D88035046B7B1327A4C457D238DA5FC098588257FD40DD9F7F5EF78D9B3694B6D43440
Malicious:	true
Preview:	C........?V-.../..+....$.p'....Py8...w..5$Xc....z5.b.Y.>FG+O....q..f..z..!.5^.d.-..&.1..x.u8R.T.....FG..?.d.HCzR5...$S)Y....f].....71...!.......R....I..%lb.....BU.......\|.X...#>.J.m.\|,....VL..!&.]6.O.$.O6......\......\|#n.b..@@...+.....Y.,>Ml......;r>..45.y...:..;.ko.w.@B.b.A.Gu...u-@..9.1`...S.c.9D/.E..q.X$.j%..K~.....?..3T.........-..A.-I..h.`.....oUxG.~.O@@....1.......7MCm.....Z...6.8SX...M!..@./....:..+..Ko..0R...e....n'}C,..v.3..."o...\|......t..}.....&...){c...;w9%.....+.T4:INt.;..J)R...M.T.......C4d^I.je....P.".f...eZ.vJ..gk.@Avq..qR.gc.....o.~u....6..X$R.../.D%:..K..%>...PCt....._..H..#.........%.}...(.......G......\..H....D>-..1G7.rL..lNH}.%......H...A...j..UI.....j).sc......4+iH..2.T..:.Fd..e'^%..c..........[x...O.\r.....V...9<...j.{\|C.HF0..0e8..p..8.%.....Zu6..!....n.p...6........._.u8.G4.....`@...).l.ep.p....PWw....<Q.Z..?..<..TCP',...BZa....nB.v.g.j(s.G.k....b...%.>.$.v..z\|..F..I....z.d.....=.._....J...\|R.-..S...'..L....,.}..

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	255232
Entropy (8bit):	7.999278240066483
Encrypted:	true
SSDEEP:	6144:Yjny3acRFSA1ouk5IFoPzH4fv2xWRSP0jMypt:CUaWoA1m5IiPNxWQq
MD5:	E1FF7187A02B228581CF778EB77CCFC1
SHA1:	B133873FDDE19897C387A89076B262E185842C2E
SHA-256:	3BA06FD62F41B5F37A4D3AC85C91C4D5A1159DBDEF1FCF2CF08ADD3D9FDD8EF6
SHA-512:	776B3C37AEE81DE645952FCF366383321E9DEC98CD003599859BEB707413579C87EAD4690587108452B95E9534085A33A6142DBE9C9DAD0ED0D769B08F5E29C3
Malicious:	true
Preview:	C........?V-.../..+....$.p'.....o.V(....Y..'L..Z..!...9tF,&..........v...t.Lp..........f..........Z..I...)wR.........d!.:x....N.uM..l.c.........\3i%...7..}..6....5......t.{<dp<..\......U7.Mu..m..>.WT.W.aB9.;Y...D.gM...@zd....L.{.p.?x....(./..b..Awk..<........z.%3.......7.{8S..<......o'..#=0@..R.I....H.x.E......[fvtMO.9%..`.#.4.....(r.V...f.CP.#..%..6(...'......Z..S?.JP}...f.q..X...fj.I...d.b.eVH8..6..7...9...e.......W].K.RD........T#...:M.i....=!.Y.#l-.9S...".g..`L..j...NZF}.]...g...&..rsj....~..7..\|C..gM...8....CU..e...8......=<.[p.{[.M.....?....h.s.Z..l6.v.X7F$\c...Vk.p..,..J..#...-..{n......t..{..HZ3...;[/.....s...<.h.".)k..0.>.@/z.......g_..4yp.v(..&...^0.P.>.......YV.J.?..e.^B.`.L..U..vx6..0....I.4Rti.h...#.x.'7D...C.%"1A.%,$@<...-6.F.....~.)\O.1...]..K\|...5oAY.G+wB.r...../...4{..w..U ..0.1dU0.}.....lT[9.Gmh$4_.n...C.ep.OL..G....G../....Q.hw.3.:..=...#3.k..O..$#cr.....:25W...+.~......E-jE.[8U.....H[Dl....g.......O..XtDf..

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	251344
Entropy (8bit):	7.99927534940574
Encrypted:	true
SSDEEP:	6144:5qF9D3cx/RyLnuS60dvQEKXrE7j3BSPWXDJX3AQ:5q7D3cJRsul0AE7T7TCQ
MD5:	96E59DBF9ECA05107747BFD025078E9E
SHA1:	6B2E73C39E7627986F8EFFE6AF43C233EBC487D3
SHA-256:	CBBCDACB81C372A094D38F20CD1E0D66CBD07D85C7FAF8B2DBB9402B425D5C6B
SHA-512:	FD5C6B6B77EAE8CDB3AECD59DB02ADE750C07FA0A09C40AD93B4B9C54A43C743FD44717FEE0EBF6701C8B7B0D56F191EBA1D770E047019FDF638FBDAF6A21DCC
Malicious:	true
Preview:	C........?V-.../..+....$.p'....Py8...w..5$Xc....z5.b.Y.>FG+O....q..f..z..!.5^.d.-..&.1..x.u8R.T.....FG..?.d.HCzR5...$S)Y....f].....71...!.......R....I..%lb.....BU.......\|.X...#>.J.m.\|,....VL..!&.]6.O.$.O6......\......\|#n.b..@@...+.....Y.,>Ml......;r>..45.y...:..;.ko.w.@B.b.A.Gu...u-@..9.1`...S.c.9D/.E..q.X$.j%..K~.....?N.'..Z.?+.K+.....a%..3B.Z.2.....<..G..)k2.....?.1.x.....)u.,.h.pVM.w[Rw.N..J;%.k..MNsW.o.\..e...y.w.... 8...-........T..E..M3..W..3.C..H..ZP@....AnAa...(.q3...@$..#...Y<....Q^.(.x.+'.7..{..1..,p..zd.T.v..u.CX..3.vg@.?\.1.Ig.a..x..!...L`......w.$."....L.....".....I{hu.5.6ItW..K...Y.8.`].[..>.....A..jj..p!.-.c.S.[.@...u}.......A..h.)5.....U.{.sI...M.E..H.....X.>~n....0.?....1..\....$.m.-..`C..n.o$.0............O3.u..W...&..lh...~I..y...k...\|......$M/umz........;..........e.J..]....m?i.....F<....[.QN4;..).....l.\.....Nm..).<E.G....../J2...ox. .#.E4cV..6kZ..\|.1.Rn...${..9Q.$..fjf..D2...O.....V.1....K0.[!...U....k.9.8.u

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	344672
Entropy (8bit):	7.999411702065475
Encrypted:	true
SSDEEP:	6144:50weK7Wc740zxQYEDB7tIxqewDX9fTgG8MCQ1nZc/Q6r6I3iv/CYEYdU0f0yPYWL:+wNWck06FpFrXCeZ2LOISv/CeUVyP9+k
MD5:	36F28BE1AAE12CBCDB022843C6BF745F
SHA1:	AD014D7EDC14CE80FF38519696640FEAD914D890
SHA-256:	8BD2075E113E76C6F7148D194C80A63E0552A2BE744032597813E9EB1405EF65
SHA-512:	A329B0CAA7FFE312C824ADB3927BC3094411E47727C16DB164267668FCA0EECC7C9C373EDAC492BB040A3D1D60D88FD7BA64F786F764DB5F98FB05F3460EB741
Malicious:	true
Preview:	C........?V-.../..+....$.p'.....o.V(....Y..'L..Z..!...9tF,&..........v...t.Lp..........f..........Z..I...)wR.........d!.:x....N.uM..l.c.........\3i%...7..}..6....5......t.{<dp<..\......U7.Mu..m..>.WT.W.aB9.;Y...D.gM...@zd....L.{.p.?x....(./..b..Awk..<........z.%3.......7.{8S..<......o'..#=0@..R.I....H.x.E......z./..x.2.Y9o.......\.ctE..1....S...,.Ik......R...o..F5..f+.W..f..).D.n.....B.@(...%........g\.O......p\|1I.......O...9..v....0P.2...a......q.a.(.....G..zJ..&o...c\|!..OI.....F....,.nyh.8.......[-.)..2.).g...P. FU.n.........x.km...VN....x.6..}YJ.W.F.5...!..J....a.V."...G..t.X.dY......>.0.c.7.i3[.e-..].....5Y.p.n.....q...M0.WB.U.SX...?....!...~_....&5?V@..9...}....{....s8}.j...1-{.Fp.w+.y...b.(5G...3....E.!].'...$J.......W(.6<..k.b.....?.A...=/...?7.......#6.....8.N.Y%?.XV._....e...@S.......-N..NGK..!......cR.1\..;...k...c..S.......L..N..^.]...L.3..=.....m..K.!.5~Jf.N...l.Hw..E...%.#....#..=...........7..q?..B..+s..Q.(.`b..

C:\Users\user\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	3706064
Entropy (8bit):	7.9999519159390875
Encrypted:	true
SSDEEP:	49152:NseBxZul8aiTEXIsXlEiarUjb34V0Vxnd75IJCBszXYFKi2q7ko3xS+/axMm0UwA:1xnIYsnVdxyJosDYFx7LBv/miGcCb
MD5:	85FFD5458B77930478BF2FAB21ACDD64
SHA1:	C95AC0646A6C363CE10930D53CE645F82A8969CF
SHA-256:	4E615F6A4A0AAE8B12F6F54DD86C78E7B5C4DAF6F7CB94A803B9C1D19311B9DE
SHA-512:	C9E968EC209747C514AD25B075CD3483AC6AA1206F086453B4DBF3ED68A8A9AA0D0DFF2905622A3F744495D30CCF032132996F7DC8825A8C2A5C0431D095B6E4
Malicious:	true
Preview:	...m(b......-.B.`U.;{.k.A.9.]..n.S7.9!.&...v\..l.).w46...V..........W...?.....c0j..J1.......v....V.+.^7..K.D.........7.%@..=...[4Y......xP.3>7..N.u.a,..4g.......L".......I''........sF.H..$.......J..^.t>..8:.^{.l...W..&7=....P.1..:R.TF..T.....;.`.3..J...8.....]n...PD.Z<.G.x)[...G......F...`Yg.`F....v._[%.Oh(.!..m.,.;.'.A3....L.=.Tu.....},........n>q.]T)C..:.X...I=#...;]G.......EU...'<.zc=....N .n.y.q0......?$FkM9..>~~..M.A.u._.(....is....`..z.S3....`m=&q.{.j..).f.T...........'F..9wi.W..-.+..Z..V...S.<.d..7..V../h....tX2...Y.2...:.AH.....p.v....a;...P.R..eK`...Gdo>.. ..w.p.A.....aN.i..jY..l)Vb..5..,...Z...y...r!..;8....Zc..t.!.I...O.u...M.$bN...e...8B..lh...]....4.fI.=.........)7x......f-4u.qD.H@.?..).C.N..b.1...O>..4l.......#t:v.?...f.peD.'.=.k.......EA.. :..+....}..Q.........t...Ov...)..m@....J....._...{.F.T.......*...\.d....a...L...E.."9.}..H.-9..~...V..t....G.....s....#0E...#.I..@.+s.......j..f....._..9",..,a.c3...0.E.m....E....}Lz......

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.927392571232213
Encrypted:	false
SSDEEP:	48:Alv93ZpGsafvE4RQ2zIT31k/X9v/ozXeVCvwXJknr6EVqt2RzpwoLZNpiBy:s9yZfvxRITlkfZSjoXCr6KqtsFwoLZHF
MD5:	80EDFB0712D15EBB7C5AD7F1A8701EFA
SHA1:	B82A9DBE4245EB3F9523B76A8488476F85E67E23
SHA-256:	6088D4F01D70E66CE28D8B9214EA31C67E63B6ACA1B0B271588FD3EE539D59FA
SHA-512:	6CE5B3AFEFDA7A40DF2F54A881D02C3BDFB491A9374EC185ACCB06251494049E6ADB75983BFDE7AF6C264B5F2DA96F5A947C241F4604B25D708AEA7B9E307AE4
Malicious:	false
Preview:	..:..-%....cz.:... ~...FY.32X.rBB4...;....W=........p)...X......;..........:....j-..."..[..D#..q!.W...]$....)R...^l...y..~.d...9...g5......I.,..7L.....j..r!.e.....8.G.Hy\..Q ,.....4..t.~.........7y`.6l..MkE_..&......A./%.@.x...t.5b./qc..K[...P...G...S..._.)..@gj......!C"..]...-/n75...g..y...7 e8..0..}o>"N?..nS...j....OT...Na u..I~...\...E.WY.J.........2.3.....(...U......;....w.&.D6...Lo...7....f...o'<6.y.L..~.1.....>...<..6Vl.......w.).xg."d.ryF.8Q..S...2P....O;.Tz0.....4.X*..9...v..vc.j.........(...9..i...v........r..^N.nrj.^...g..p.4...B.-.b../.f...d......o.n:........B...a...yYxH....&.q.I... ...........k.........G..wOh.7...w..........%,.Z8.j.Ya.".....).5..%.....-.0...a.X..+...=.........9~......a.X._.u..].?......@r....m9...;..o$<S.Du.,Fv.!=..D.....(..,.{.@_...R....!)x....xe..M....Jjg.'......j.8{.`RD..;_.N....L..TC..3MwwR\|....Vt......2.2..}..j..........#8..Y....$...5......w.pP..6".\8]..F8Z.../.L..=Z.+Pl.w..z......{..P..`..8..+......H

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	368
Entropy (8bit):	7.381631428909273
Encrypted:	false
SSDEEP:	6:6PGNfQUQnCwOGlAwYOFRBVl7AIF5/1NuFbKBEDZl2GDd5GZNTV2Ev8/vn:AGCUKCwOe3RZtL1Nuh7tEGJ5GXVQ
MD5:	87508F4A4980D9E85331DA0E84145EE7
SHA1:	0C893617D597875670E5948A0746A123ED8CDB9C
SHA-256:	14DBCD34069E040241EFD02EBA8625EA87F74A88E1589A9F3FE4F7DD973D5FB3
SHA-512:	B685E644CFE8D7B880B31D7904CD1290600450B14A5CFFFE5137931228BC66475C9CF32DAA1D42AE969BA4D9BFF5B9DAAB0839458995E2FCF8989CDDFB3B268E
Malicious:	false
Preview:	..:..-%....cz.:.n.Nc.c(.k.GI...uFX.fo.R.pOV.O@.?ojORy'....m.O.v.4'.;(,.Y..$...s@G...P.hs..$.0F..p....7...G.m..E._"vn.JR.,.b.gQ9q-.nt.][..QU....g......Z3S..q..s...(-.yH..0F.....-_...q\\|?j.S...Z\|o...Y...d...r~..N........dL>.A..~4gV......UQ.X........,HF[.p....!..O.=.V.A0...}}.2X.)..y.\|.PN.........J;Q\.b...T.E\|=.Fi.&..B[0.R,...h.O....R...W..Q<..A.gy..k.v..V

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.4697982517683625
Encrypted:	false
SSDEEP:	12:AGCUKCgetmqcDidxzhixlbxq8xL9cxAFHf+tF+uGpY1:AAqqkiD0X88FeM+tk1Y
MD5:	7068063628DA26A52E28E60697213D4C
SHA1:	6ECC81C3602764A063F38B9929CDD881CE9243A1
SHA-256:	4FA252A584C675D8E80A9E0B78933378C3ACE7B4D5C7C8A49610DBCB6A1E2B92
SHA-512:	98B910945CE6EAEDDDFB304EA2A0C3A519B4C7A5F23BD3C0022B375DFF76467BD5A7715C2918C2746C6F244CE1FAE55B656C88318BE4F966FC585BB8818C4160
Malicious:	false
Preview:	..:..-%....cz.:.n.Nc.c(.k.GI...uFX.fo.R.pOV.O@.....kfW.R...=/L.u.=.]r.<......x.K..:...R..H.6..q.....d:.}.. ...<....s~....I..N.s....:.)n.^.F....b.4...s.C..!..2....\V..\..9.....}..o....y_jK..D-.fb....3...D..{V....6.:\.....E...x~<-.....>:LDh.6%\|C.ci..,.......&......3..tc........r..G..=.8.(....+..sKT.y...?g.k..-Ec9Z'..+.w)..h^......2........{.d.0\.....F.......<.vK)w#21u.....;2H..9...f..?1.9O......

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	96
Entropy (8bit):	6.389599089240291
Encrypted:	false
SSDEEP:	3:JFqcoWYnMn2gdvxpYBgF/y6WyWHpu:/noWogdvxpYBgw5/Ju
MD5:	F6879061C1050644386EBD26100CCBFF
SHA1:	A3F6BC8EBCE5A1F4C2E6AA3BD76C262718F7B69B
SHA-256:	CD054EAFD308D0CF40378C1B826701A59A2919E2955CE65E21FE0611C54C55A6
SHA-512:	13AAEE1B344A0435916302DF3AEC534BBFBD24A31F37BFC10DB8693C2BF3B898CE01415A31A6924C605B56B825EAA260F2104EF77639B5BBF561B30EDF7E744A
Malicious:	false
Preview:	..5G2.......9...Y"b.uvj..IJ.R.g<.B.....y.(, o.ump..m..T..7..E....u>...e...BM.AHn.:.6.....qo

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	7.4153642515307485
Encrypted:	false
SSDEEP:	6:6PGNfQUQnCfly1HZvBx+PWhPwnegfob6W65DvF6vjO6BXL0gKm29NLdpxc:AGCUKCSvHmQY/ob6W65DN2x9L0429Fr2
MD5:	07C5D005002C56C3C5320E5B047CEF28
SHA1:	7D3765447F438FCC576619D5E86EDF666A25DACD
SHA-256:	08B51590AB54716BA11E49B01A5EC497C0D420D35D8CCA9B3FF45DDA9DE2F6A1
SHA-512:	08AA88423B8A70ED465A6B5B5C47BB2B5F65EFCF2E101D5F4C07985DF268E422BC3A17E40F9EB8F40195F75235667807174ABAE4EB74EA9EF3F07E9B8D255AA3
Malicious:	false
Preview:	..:..-%....cz.:.n.Nc.c(.k.GI...uFX.fo.R.pOV.O@>.";H...N}4>....0..l..P.>j.\.dE?..P........y.6...Tl...^..<c0...`....T...............,".........G!...Qa..>Rh...}.$...t..h-.Y...b.4...}:7,.G. $..Y.y.Mz...(..4.....V.A=q~Js..2.gF..d%...G)..v.W..F.4c....I.s....3x.......&S}.h1m...-B..R.(b...l.ils\N.P...=...#.....inW....+$..,.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	160
Entropy (8bit):	6.738901766667713
Encrypted:	false
SSDEEP:	3:/2INSmiguKKkAqSW7bP5eFGA/Lq0mHcmZ4aAzbp2RIsKKOs0WS/QqFI/V:/JSmzFKkuWbcvrwcu4FB2R/7OsKIqWd
MD5:	D56D87CEDDFD1406095BBF867FD60380
SHA1:	0E341D9D0BCA94BFDD4146AD81A79B97F00EC42A
SHA-256:	355F0934A0F8788FA3B35ABEEBFCF6FF7C1603C6C0E49D044FB28CEDF84EF3A1
SHA-512:	59B9765D65AD8F4DF07A163CE0745FFDD14C9172E25AD11C442BE62B3B22AED43FE0FC3DCF937A1ED3E390F30E7C41652145DBC19C0DF2AD4E9403AE97CBEEE1
Malicious:	false
Preview:	x._*.R..].. .SN..$...K/.\.......^.W....y...`...C.s..+..M.........%..yp^...x$...eX..u-5.q..?.......'.......zb.E.1c.....s.E....En`..R...."..`......7T

C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO1033.acl.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	37744
Entropy (8bit):	7.9958118368320505
Encrypted:	true
SSDEEP:	768:/ax+NJexj18Ly9K5SI8SsND5jJUpJx+zw2KMHlyqHiG2GK:/aANJe11qtSI8SsNtjJ+Jj2RCGw
MD5:	C33ADD43AC2DF5B4F5301498640A0BB1
SHA1:	E2CF271C9F56802FB67C84123A9A689865C9336B
SHA-256:	113A2816016D5C14F124DF97FC7274D5B1452654C8F0DB6D3FF34ECC589BDEE6
SHA-512:	E6054AF44C7CE6C5755A270251B3E467B969D64BF06035F2F06265450784D1643B5CAE55B567C82D9A12F25DC92C03180B70B488EFD228C2D56D6233B83D38A9
Malicious:	true
Preview:	....y...."............t...t.p....6.../.l.;/.@."JU<...Q.p.;...w.<^.0..u..4..w.A ....U.cf..X...}.h.;..K.%6......N.kF..";.....6....?...!+Zy[cV`A.G.......u..$.x..I.2.........s...J%....Cd2...m....:w.H....\.^`.H..............J`.....r......1U.`.i8..S.*Dfu!..O+8x....W..\|.%...@....5K..G.8&..l]=C...,^cy......G...b........."...._....nQPm...........{C.c..D.f..R ..N"B.&.u{Y.x-p.j..7...F.O..#>2Z...0.6..[q.....=....y.`m.q%..{..b.p.Z.......HN../...wew!@.1.4?.,{....9:R;.....,...t0bk.,..1l..Rcs.^7..b.&.^.5$;...<.%.=(&.3{...s%..<...6......g#....yVWb.%d...E....hs..,}..d....t.K...i0k.M..f"cX...J..aN.rW....k.GG..&..<l(......."...i...\..........`....xX.7......(.T..h....K....d'....0]...y....} .v.5k....U.......z......Rd..%.O.B8.gmS..T8.:$S...dG..x-...5N.M.x.K..RH...<.../.b2...U.G..(r\|...kWG-d....t.r...U.o..~e....M..fY-.4,....L.g.zm.V...>..!a.6!b.B7.;...7Ey.?.].....>...........{..q.d......>&......w../......k.q((..?.),)3]5C.._......X...@....g....F,.AQ..$4

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	7.846434780731951
Encrypted:	false
SSDEEP:	24:Ac1ddkNga9KUOvgBBhExSrtERz6wH/rd/z1HqBpk0fh8wgPXsyV+NfFo1VcMj:Ac1ddkNgFUegBB+ErWpH/Zz1ifV5yVqq
MD5:	4A96A4F24A27933BC6E94A6A7DB0FA41
SHA1:	4DE50AB02D77282DF0B869C8A642F9698EB07266
SHA-256:	E75405310F82B45212C9F6F4643581F41142ACF27305BE2CFF9DEFB73433F09B
SHA-512:	D45D22D758E73AB9352223E4375E2C352FDF0E9C5E954EB48E8BAF3936C538C7605CEF178FA06A7D0F58FA539C948E5D487E495D779135ACF1F56F0C94F69FF2
Malicious:	false
Preview:	..:..-%....cz.:./..E....T.;.../.........U.......}.A.'..."....P"R......Aa!x\|.a$oLn.n...Ja.M.V.a.....-.....U.f....J..>#K[. S.\|.q7z..FI...8...W.x..+up.T.:.V...U.H.?.b$......../LCV..P..$N.9..S....<.nX)...v...t..........K.......F.2(.p... ...q....LO.....Q.r..F.....E.....#%B<.Ey..C...vZ"?..@../....V^68..\...g...~C..d.2.0.f-..1....?........,...R..V...2.N.......W...S.^J.y.\.P.........A44...}&2(X..jG..{8..,.[..x...!....q..Nd.......]B.~v....\....}'V.O.[./..H...N9)......./{.8K..Pk.l.zQh6U`.....x[..6...E....:6..$E.G..s+..=...tt.t..O<~..\|.<q.j]...f....v....X...s..BR;L.......b3/.2.^.:......=....xNl....8.O0/...S.M.N...L.(.B..m......p....(k...7kJ.'....}v........4'W.a.\.......JR...p(...G.(..^....Dzn$......._y.]...?`.....D.5..INBy.R.P.=o..).H..9.Y..+C..o.eZ...{.VawY..lx.s..V...jz..R2f..!.......=2Wg.).....!..5..........lh.u........n.d.......".E.............y.2+X.gdr.....h.I.#..GmRy)^.l...s..e^.n..d.T...p..?...5.0....k...\|.rv~.T.m.<bD.;.....~.t..Vp..f

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.875
Encrypted:	false
SSDEEP:	3:xH3yV3TWAGP4CoX9:kV35GQCK9
MD5:	3DD7890B3AB2BE3720BFAEE7112690D7
SHA1:	EB09B7F887F9C6E22366D41242CE86A9B4414FA4
SHA-256:	FAFBB06036CC6988A1FC2FFD266F94A13D4000AF0EF4A38BD1973131416E830D
SHA-512:	54D2D832D760FB0EA08C58B9275773C13BEA8045D30221846E98A7991325E7D13E593DE3AD7812B2ECEC9DC148115E8AABE24540259916B55F737240E06D08EA
Malicious:	false
Preview:	.b..W.Q.+.6."pE<==H#..6..B.2.r.

C:\Users\user\AppData\Roaming\Microsoft\Protect\CREDHIST.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	608
Entropy (8bit):	7.651616481131165
Encrypted:	false
SSDEEP:	12:j9fIIBDNhE2Rag7MRelSl7B1R+ah9F22zIqCAjqr9vocso5C9JVZ8:J/BDNhE2RLUelSlN1RB9oyIJNr9vXsqt
MD5:	209F43E5C926F6E786ECBC639D9A544C
SHA1:	55CAD4365DD42EDDEB1C84C5E50F98B649E26D2B
SHA-256:	DDD3D7221E10D314A5235BE72C79146EFED5D094304DD41025CD2ED7D2D969E4
SHA-512:	A7E65E9A7793B2CB74AE5D01250CE5612B94F55C284DF5F2E6818EA01984B7BD5F030B4F5B3A7DA36F2731372A3774F158B6707C4577C9952C368B9B869DD939
Malicious:	false
Preview:	I.j.I..@.. ......V..S....1u..._.!...-.7....2PB........#Ivm.@..t.Z.-....q../.9Y.'...8.9..s.N`..MP".7......=.>...<..V...!...T...A..%-...>9.....jC^.}T...\|&&HX6........\........OH...~.l.;{k...2.<.......r.....C$...v.^...B.....^..x.D.)....J..u..5'...VE.....\.....=.....c.f+.s&!.yZ._.@f..U.K.^$Y....i..^..]?...._7.nkW...0$.v..L....D.~k.g.A......cIb3.}k.:k!T.L...Vy...;..E....".qa..W,..DtyA....,..z/.(....d.2PCm..M....].R..{?3.p.s....\....X6..ix<V.1......$..k6`.B...>..D...nCl...(.m..:..............O^\...5.[@....1.+Y.......s....x.~.V..?Gk][Q./.A.....-.0V......._.<e...

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-3853321935-2125563209-4053062332-1002\085c1e5a-76a0-4025-a670-bb05bc574cb1.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	480
Entropy (8bit):	7.500281242791577
Encrypted:	false
SSDEEP:	12:DmbH8TKR0H4ChiY8y/Bm4wZLHTndPmq8p:DNwzChiRCBm4sLRPw
MD5:	1D5F98A33E8DB54E96170134B773DAA9
SHA1:	C98567EF1197F5829EA4D4A6F93B863D971E06C1
SHA-256:	C8AD788C909A4CBEBD70D050ED2DA1827018B4F461B7B061E37C65F1C55BAE7F
SHA-512:	4E0478B9BABB192BC312BB8A594FAB9C02D1883D98ECB943F60D8E3B056DC3B3BBF963BE6484DF60019F37988087A9C56AC7CF282CE6B8F1B5D7A15172BCFC05
Malicious:	false
Preview:	..m.!..t..>...w....Y....K..R.j.g...r...\|.tc.#..vRE9.....p.ES.V.r.4.2...vkmo1~..o.P....8.f:\|....Jn.A3.#.... ..i.T%H...zx.w^....n.BR.J.6)n....e-eq.r....6.E..g..T......G.{~.....(.KH..}..N....XS0..xe..C..........)...R.....A.,tS......5....z..>87.:....@....^I..1...6S..h5I.....@.....<4..zl#(=.!.....f.n.n.....d.di1L.....<.\...`.S7%..s.....b^$7M.we.G...i.hQ...!.h._...D...8.d.e.....<3...DW.%2....Y.Iw.JdI1L._.^dC....*...k..]......a0....y...^..{.1...+<..e>..dQ.

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-3853321935-2125563209-4053062332-1002\1d2409fc-23db-45b5-95bb-0e4ac68936b8.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	480
Entropy (8bit):	7.5407041583292616
Encrypted:	false
SSDEEP:	12:lqBFyxfWxqxzcgR9w5t1ZBto+9/1UHVHMNLX:0zOfWxqZhotbBV9IpMNz
MD5:	C21BD09561E247138F6CE693D119055B
SHA1:	885BA6BEF2475E1F760E1FBF0506A1243C20582E
SHA-256:	08C7F90D29FA2F316C40A1D7450A2D310389F77EDAE708CB799E9321EA237227
SHA-512:	C03FE514DBE366756B6E2146D0791F8FF1C91A0A4EDDD1B3B35B56FAE0A3365C003472C8967CF3A03E42721CBC1D2072BCE27245451F3E1E776871EBA581F980
Malicious:	false
Preview:	4.S...8.e.&l....f.ml..J...e.....6....R..I`;..Q-.6..x....G...e..Q.=...jcb7Y3.....O.n=.J`..........T(y...6.iO.L.\|..Sq&....e.............6..E'..O.L..S]....]}X..^...7A.30....H{.a...."..[..V....1.5'.J.]@.4....Q.2..^..-..;....n.4%.4.^2.~.v.-?H.?.{..Z...B]...{3y....\|.......T. Ox;.aS...u.......r ..p...".8..A.Y.a...c.d.0u..0`.b.&..F..E....=&.`...)...{......"..\|.ipum.U....z(...op..ok.N.....%.5bs............".....0.Y..9t."1...N.;V#*....5/.U.$..%.zq..H.HFmF/.RQ.

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-3853321935-2125563209-4053062332-1002\Preferred.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.8125
Encrypted:	false
SSDEEP:	3:JC/PHHW9g/Gn:EH296Gn
MD5:	00AA3EFC4E09251E575AA83BABF32DAC
SHA1:	775CA017EC6E4C4AF1F0D92723FFCCA7896E781C
SHA-256:	EBF72FF7FDD270D01F50D70AC54628C2F3AAC4C497F7EBD09413AFC460EC98F5
SHA-512:	6A095EB958EB80E4815E5BEEB2EDB08604F3B9C98F8ABBE0AFE17A0036B6E99B4A979C3602AFC867D5A61463DE83BA47BDAD29B1EE55E35A752B126CFAD52AC0
Malicious:	false
Preview:	..O............S.J...~....]Z..

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-3853321935-2125563209-4053062332-1002\ca8b3b75-86f2-4edb-b016-ef7ebe8beb9b.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	480
Entropy (8bit):	7.605333937436163
Encrypted:	false
SSDEEP:	12:aErwLWLYq+cvZSRT/62YFdikOWqPoONB6jKcOZI8GZovu:aKwgISZiT1pWIoCBUKcKGGvu
MD5:	424E262F27EE593E850BE0D9C3F2A632
SHA1:	40917CDEEDF3B319F4ECF6A1FDB10633B9EBEF3C
SHA-256:	6BE578AD37D285A16E6B66BEAA984F9E1279B642FC58EDC5DF8DD0289B63BF10
SHA-512:	582D05D3CD2C3C84CB9A7A918745F96004959FD20BB6EF83E3F18B49A526B54788472A7B6284EB3713EDB439881352BD057787087291F7D92942A27299D1BEC5
Malicious:	false
Preview:	^V'tW....E.n....#'.....2..w......KZ.OJi....(6o) g..hl,..Q.`...4....0.0.n....E1,..{.....!.:.0...nV.}....d.6}..#z.Z1/..7.;.S.Z]..]v.N......2%....a.....p.+"/.El.8.m#9.=...p..w...^.....G.y..BT...O.Mu.+.Z.c.......C...h....Y{...2.&....hLT......^4.~.x.jQ:..Vp.L..00.....i.R..\.sAsg...K......j...<..c....owl1.A@..[.i....ap..[5.2./E.~i.RE...?....Woa.t.'-.q.@I.C....n..Y..&...B5zn....f............_.@..1T..".L'L&m.A.6T...+..0....3.#..9./.......,D..3....B.......#)E]

C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-3853321935-2125563209-4053062332-1002\d1aef8e4-b864-479c-bf86-f42c63d352b2.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	480
Entropy (8bit):	7.6143539250877526
Encrypted:	false
SSDEEP:	12:bJGQEs5PCeexbUZWyi/jNMpdTNx6LSJ8lTX33:5HvexByIMhQr9n3
MD5:	F32F3B04FA8E2DF1C9CAC070B371A1C4
SHA1:	E03BCA4B0F3E869015831AB74F1197CB3FE612D2
SHA-256:	DEC72FFA49F5E1332A1848A0D76E41B242214518A198FF8745F8C906D85F56D7
SHA-512:	F757CA4ABB927CBC50241D252EF19515490287E9440931510F107E721D94CA2A9C235E697DEB6742F92E84F87A235E18BC344E56FE2D361D87591CE87B4BB624
Malicious:	false
Preview:	..Vk.gqT. ./.4.N..T.4..^....7...KLQ...v..;.,.3.3.f....e.....us.o....R.VX.Ot...S.oy.I<.a..,.7..E..66./.....?p<....\....Vt..2....iR.-.@=!..=<.l.....7.W.x..r.;1......Y....*...........\s\|x.p..B.....1./.cEd,.....O/.......k........iD..._.....~"...R...C..u>.n...dt.....S.uE..J.t$.^..v..E......0t.1Kv....p.aA.4....d..7.......6p!"].e...Y..^.=;p..T~....qp...].P.Y.+.Ar..l(.......Ts.K.RH....e.j_`.Y...S'K.#.%...S.....P...-.f..j~..S.^..':.h.....N{X....0.....\|..5.E.N.

C:\Users\user\AppData\Roaming\Microsoft\Protect\SYNCHIST.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	5.884183719779187
Encrypted:	false
SSDEEP:	3:YcyW0meH/jDSq9/gaADgn:YLfSq5gXDg
MD5:	2D4CAC6C4C942AE409B71F633441D51E
SHA1:	8655A753EB52FC1315AAC39131AF2CB946AE7DC2
SHA-256:	B037EA7233F688D9BECCD5A79A49317A7C911EFBB47B6727B06DEC98CA93B67D
SHA-512:	864E261F72EA6E2BB4F8B371E5FC6BDA44806595893DB020FD98CEE0BC4E8A29DA46541F36EE4957CACAF47A1E572770A8DC329F0C4806CF7C123942F8F7B4AC
Malicious:	false
Preview:	..#p...2.^.....vp@..?.)...G^*..<..d5P.R..Gz...o...I.F....$..r#....^.p...M&.

C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	17936
Entropy (8bit):	7.989485003233104
Encrypted:	false
SSDEEP:	384:uf27uq0hx9aoDRa6PiRvb2kUmoxLQO519MZxtf8IZbGsfoZF+jdL9ahY:aquq05tDRJPICkxo7519Uk+GsgSjdLgK
MD5:	E22E37ADBD68609C544309B6981F6EFB
SHA1:	2F62573E5622857C228505C9D3B30AB8E32F7466
SHA-256:	5F75229C226FF9CC2C9429FFA66594892E78B8943CF2239A3B69AED091459BA2
SHA-512:	64D553BBC1ECB76494B9BB338A5121C494A5CB493CD8CF9B5BDFA081CF916B57ECEECBD008FCF533A30504C8A48F93E1E9D7FD5917F075EDDE115C5AECC0D509
Malicious:	false
Preview:	.SR.!I..c......w~n$.6)... ..p.t..@....d.UvU....u.f.Y/...{.s....A.2y.F..=Q.\.XoZ..L....x..N.nQ......G..`....u.l..r.......;(@...........#W..a. I..dL..Izn.($.M....)..`.8'Ix,\|..^[..{..W!$XK.L..S.....g.......[.\|..6...-}.e.....UD.[..=O.E...:.2.......7Tq!.....m/..e..x..J...:..k`}....O.....K1.)..ct.......~)..N....x...=.6......i=..8..<.g...D........W..ZH."@...L\|..%}...........x.Lr.....T....(=.,...n?...m..'.....^........2.W..M.a0.i.......@.....V.....'..\|..3.qP..<;$/.....-.ba..3.K.0.....wo.p..!...........d..R......(......1.]..c.@.......@j... s%@..'..L..X.}...A;.....{....R..\|.m..f.N.N49..k:.C!7d_8....^C.M.J.s.+O.V%3.^.~.B.`k..M.y...,.+.Fw....L.....Z....CI.w.`C....E..E.\.........5[Y...e.g.%.<..o..[#p.....8.. ...J3LB/E..... ........T.Z...r.D.o..L.H..u..%L.z....PJBM....'.<......[u..;g.9.....g....sV.w...2. ...]..1.......Xy.........5(.m...m.X_...[. ..3...V....l..u.B:.s.f.......y..v.[Y.(.0......F$f.....Y7.T...g.....C.N..).s".K....{..6...v...

C:\Users\user\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	208
Entropy (8bit):	7.025422275862681
Encrypted:	false
SSDEEP:	6:WKJfsGQSMd4Yjn5acYkO44CORKWENRl4S01M2AlPS:W9GQS+4m5acz5WMVOMla
MD5:	D8A7A1F11C63F0DE588EACFFF4A1AEC8
SHA1:	C568CA609BDB3BBA002E76AEF7371A79631BCFBD
SHA-256:	592CACC98446B154DA22638A9DB6AB328CCA1CAD21F7E808CB7C101BA3A3C9C4
SHA-512:	D5A476DF1936A94860DD95DD134AF291A844D892365AF9377EFF3830E53E4850FFD1E2B7B158C97903F748DB58FD6C960414CB7118D848F9C86191AEA0AFB1BD
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...<.a~B.........X......a.....>......7..T..H....W.. ...`..o.L..m..k>..1.y..o.p.K...G.....3..H...u..f6(nt...R.`]YuEi?X.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.795886251400753
Encrypted:	false
SSDEEP:	24:rMgdVgLKscjJpMtdK0Zd158X7QJCcDo9psNJm6WVFulmV5sKX:4gdCebFWtdK0ATQJmjVLz
MD5:	D6B4A17B0911567AF1DE85B678AA6DAC
SHA1:	14A35808282169759DCCCB732FBC5B5FF7865131
SHA-256:	D5EC8A19D64E7B7030B9C8D2D2314452A0CC1C45907855EA7E7202780842A760
SHA-512:	FE9781392D65D4776378332B5F75B8728992F348C499A62B9DA26F00C840DC45EB1A86A6FC95CF183421D76B0DF02BC9E7FBDAC40A724A89DF14BE11C594486D
Malicious:	false
Preview:	C........?V-.../!5w....V...h...\|K./V'L`....3.#IA..'.....VMP...G._...p.eq.?m.\.?,...%.2.....A..y..xn.@.r.....s-.MW!8.n.......%/.....a...n..OR....)....dZS]p\|,......t..C#+..T.d.d..l...L..9(.KY....o:aV.S.L....{.I3O....3..=....VtL.P^.m]d\|.Q1L.R.r...L....~..{..).w....=......".>L..0.....Y....i:,...h.OAt;(.x....}.MZ.+n..]....0.R../...&ag.....K...Pb.Z.t."8..Q.....#"4....'<e..\..R......BJ.f.Y.A....4.b.....J......AS...I.?c.P;.<z..~.B..:.A../#\Mv...'...a#...=.l..}dL\|..8.....E..S..+7..-...G......._I#h..."./#.}g..Wh.\|}.P2e...d.........e_....0....1{.BQ.P..(........5s..G...^6....0:.O.U.jy.U.=..Z..E#..].......9.F<:.$O6G6..t.h.u...r{.!........K.....[N/ZhE...N.7.xS..m,.=V.w&..xG............(...:...~..].......d..a.o<.U\J.....G7.><W ..3..$x.3'Y"P........tl.t.r...c.....f.>)]F("...[.S!.iV3..U....N... {..c...h..W3\/W...;9.z@p5x.Z...D...L.............\|..1Z..cA{.6..0...l.v........H...b7.........%......J...1c...hB.....DV..4!).=7...........%....U3......Fd.6.$.;.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.917563302560368
Encrypted:	false
SSDEEP:	48:4gdC5ZMfOE//n0kX1tvM8QtIphcFPdFBoia6ypbj9Xe94XJ:FC7MWEXNvM8phuPqiBOv9b5
MD5:	3B1EE54FCB019A09B44AAE3181F5CE26
SHA1:	91C63D9D6827F3E0AEEF54CBC1B77516A83112B1
SHA-256:	EED8CC7E9FB80BEC7AEEFAD1C0BBA80F5BC87B6AC0FD44185DB88DBE0C3D264E
SHA-512:	848FC35924F585B66B50AFB9EE2815AB983BC8F937D4890A290243416BFD345B40A3A8048ECC2080FF18FA377E3F74CF57CE2C7D058D34A0DDF2250D6CDDD8E8
Malicious:	false
Preview:	C........?V-.../!5w....V...h...\|K./V'L`....3.#IA..'.....VMP...G._...p.eq.?m.\.?,...%.2.....A..y..xn.@.r.....s.h..d.0..E..XDM.Q6L...Y....g7.r...Rq..Gl.f.u.....3.F..^...T.K..X.....j#.WZ...._.,N.0...Z.b}....6....SH4......p.V..j.:.. 5.$/...+.K._.....I....v2.t1...Lsa..F4.2 .....&u..9\|g....H...,.R..9d^.8[T.5,.).......0.......O.r}.2EL.X...k.~.g...F.X..`...;hE.J.k..M......+.0.O.']Hza..v.e>.1....c.[{nr]....T.....Jz2....f.F..g..K..0.8..Xs@..u..R...w&..1V~..T.<A........1../.1..j.K.w.....uH/..k.&.H..P.....].di.V.u~..lZ.z3.Q9!.......M..o..g..C.#0\|.fE....xN..x.h.......9..&..b..d...g.HA$[."....:......oq...N..r..5b.\|..9....w....+.y..^.}F..\|...d..oO..=....3.Y...Y.....L.G+.P..69.lv}......9..J]..!..v../.n....NY....&Q].eX.z8.....k...5.~!..:.x..PC..S..W.ic..........s'..w.....9Jc........t..=.V....{.j.X....+D94.2.}.Up4..x.,"Zi..y....f.!...=......T...0'....zd...K.....O.r.....5....b..e:.L..1...7.O4o-Y..A....YBm..*.6fpX..D.lJ...k.....J..H0.F.:.........]9.W.WP}.x)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2048
Entropy (8bit):	7.901612120351901
Encrypted:	false
SSDEEP:	48:4gdC5Z2ZVMav8q3HpM8OX6kKkKrpFQTCBMWVCzNOJ7+DtHFPt5E6M83JLhx:FC72fAq3pbOKYKr7QmB7C4kTfM8hT
MD5:	592A39F0A360B60135F4C82C586B08AC
SHA1:	736868F4CFF579896DE526B63EBEE1AB2543DB0E
SHA-256:	6407728DA8C572E6DE0C4E6F0B191E45C455536141993E6A44E306383C48B09A
SHA-512:	460D96946DF57C8C7CBEE4AB9EA910EB4BB559CCE76A557749E6DB7460B8E228F6EA7749A6F125A263CA3EA4ACBE4ED96507A5DB133CF3BDB9DE08450EFA65BD
Malicious:	false
Preview:	C........?V-.../!5w....V...h...\|K./V'L`....3.#IA..'.....VMP...G._...p.eq.?m.\.?,...%.2.....A..y..xn.@.r.....s.h..d.0..E..XDM.Q6L...Y....g7..Zv?#. .4..S(.....S./..@.u...A..}'..e..w3.V...&.<c@\......h.7..K[T..J.......%..0....'..].G...K.N................M...~M.y.e4./....&..'.....&.u.1...M ...Y.;..h..1\|....BiE@,.$....x\.. .3...B-J0.B..$c..u..\..\|`O.....~o....7<PS..<.R.}._.....7..2V....:l...,.......[V ..h.?..p..."M.ml8E.Oo...@...<..]....P.&o..X...V../9.....\..t..J....0.f.14H,...)l..v.#.%C....U.k.2...5,7.y..`..b..(.?q.NgP...EW..50.......x......0.....C.....c9:...p.v......U<.^..6.g0......../..../N.N>...n.....iC..$.....z...Yr.4M8._$..V.i.Y....vV>.{2......bQY7..\|q5.R......I.{....u.K.jp<%...b]..Tk....1.?.............H./.l..%.y9W...7.+=.4.y.i...A...!...Zln`.4....r.(w...........~...?....V.nx.R.u.;.b.....E:`8SZ./.!.......:;.mu...8...a...#....m"........9../....2rh.....X.....J.Bh.....a.e...l..Q..C........2...X....)..%B...S:;.NA.~A...@N.o\

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	7.918687988337462
Encrypted:	false
SSDEEP:	48:4gdC5ZF/ssBmblGQN+mKQsTNfqe3Ec9mIXkHy/mnQIJkX:FC7u1pFLKQQNfqehmIkrbJkX
MD5:	BE28B663EF8365C6789C3C7B80CA2191
SHA1:	7741EEA2F7A5CF7B8E56B500F418B33A8800679F
SHA-256:	2D127BC6BCD8DEFF1F6BDBE02FD154ED433FAD2791B1E89A52B1D43A5711DBC5
SHA-512:	4ECFFE5C45FD6EC97726C6A805737D2FEE9138DD3EC22D8CA008C96712B4277533A6DB619725D3016C6CA33CE122053FA51D78A8F821F685BC94F085D7099C11
Malicious:	false
Preview:	C........?V-.../!5w....V...h...\|K./V'L`....3.#IA..'.....VMP...G._...p.eq.?m.\.?,...%.2.....A..y..xn.@.r.....s.h..d.0..E..XDM.Q6L...Y....g7...E.t(B...p....;.z.Ba[.U.'...%e\|Zi....vb(......,..j..,.OS.X.....i0.f4.+...%.A.8....%~..#$\.a...[..b.i..e..n...i..;f.9._1.=...Q.oo.....W...z..R.}G.......P...,M...r.j..h.p.;...E.Qil../..........J.".u7.}.j..}[cbfD.o7..0 ..k.... ...,.cc.3&..,..Ud..........8..}6..n3O...O..~.G...[U..dg..PQ.@..d...j..ws...f.y1..h.......2.^sT..7i-3.==].).^/.^5.%.R....W..X..D,........A..r.+.e.T.......m.r:.ys..pT..[..b.....F.h.Qd..\..c.-.......aw1...VH..Bo...].Q$.....1...#Q.,\.C.U.S.).....&..8...........T.I.%.......y.p..t6.J....q.V.wIQ....+.0.....O.p.X...MI...QE..%....xh.G..S...e/.]...mA..J....OR...LTpC%.A.).....;7..y.{... .....T\|.}6r.}....q.$k..\ix...~...8Z.t?.....0...#.pzY/.G..M...0...[w.<...(.Y_b........gN..GQ.^:..S.+'....3g.:khr......e.k...(5[3.`......9`.WC&N....X.\|"(.V..!.\|..'cH..H...?E.&C..q....!.=.?!.\p.\%.&..5atN..D.v.@W\@.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2080
Entropy (8bit):	7.9000071465074
Encrypted:	false
SSDEEP:	48:4gdC5Z1V5QPnQ6/R/c3NBxdC9GYoXX9yIRPkpUEw0hWtmMknA:FC71V5QPnX/tc9FC9GXYIBEw0hW4MknA
MD5:	204A3B2346A5237A96532ED99120603E
SHA1:	1F9C2598C94640111A7A962463480D693D61BB4C
SHA-256:	2B9DC22C24860831739E3543FD841D07274CA59FF941770DA927180A49822C1C
SHA-512:	0C87BC3B654EEB99E280A786E053567D3CCBCD4F6FD61D7F8CD1C34ADF50FA41B4B55580C1BC2DFA46E86718862380EBD1EC764C8CA2C1A3ACCAFD8E8666AA8D
Malicious:	false
Preview:	C........?V-.../!5w....V...h...\|K./V'L`....3.#IA..'.....VMP...G._...p.eq.?m.\.?,...%.2.....A..y..xn.@.r.....s.h..d.0..E..XDM.Q6L...Y....g7.z.'...o<s.9P..2....`..l.Bi....;..-.;....Y}T.Pz.+=.^.\|.q.v.....%......\|.5...c..4.l..=..]r.v...!...x. v...1_2..E....?r.2.....38.......!M....{..[%.qf.a.nx.>./.....)........x]..#......`..-..S...?.s.C.jx5KL.k.w.~ucY...4.....R.....5...m\|\|..A..m.u..\|....j..;z..,d..r...'-.9........C8..'I0.&..[.0Tl....e.J.....,.m`.PY..A........'jo..0.8.x.g.A1..p...OJ9._...D..-...h....:.0v...6y.M.s#...zg......^..tA.T.W...K..T/d*...o....f/A<9\.n.....l.h...n....1PI;.A{.2.....(.......R..h..+...;..i.l.lVg....Rq........;.MU%....%.np../...g..K.a/S....z...,.28.F..).{3.q$q......r........Dvq....5]..$7_.R.x.A.5..w......&D.X..d_../.Jv....0W.m..d.....V;i.6..g8...o.hD&.....-.TW........Q..M.K.&p.]..,....0nL.}.q.}.Y...O%V.j......HE.T.~.5.n...EhV9..6j...G.b..._d..$.){r.'e......>..f.^....^...9.._._Ij.0.&...eP..8P/G...4^..a..\....iZ/O...-

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.456379998069859
Encrypted:	false
SSDEEP:	6:/nzbt5SZ+BDwlUi/V4Lk8Dm6a+7/SKG5oW4BcDSP+ZeMrnS/UkAskXeBKUSP:fzp5c+BElhV4Lk8DmorQ5l4PP+Zesn8u
MD5:	A55944B5C9B951B1BBD9DE6D9DC6A417
SHA1:	AD561B864B652E2D439C60D2F2A7B08FAC4124D5
SHA-256:	2D341729ED2343440FEB2920323932684FB31FFACE7965F2DFDB97C3D85E3826
SHA-512:	3BAA176689B680A9EBCDA16FBE68C696B49237810450B1CC3D5759B018215CBCFEC099A0048527EA14C59ABD7C9636B8276C8118D77CEDCF999A8D228D57D722
Malicious:	false
Preview:	..5G2.......9.......w.t....G@(..Y.>....!4.=k.:..M P...Y....).1.%........2.X..G..T......g).-..pz.......0(Lr.1..A..b.O...>.r..."a..!t1w&]fX..]0.0..D.+....".3.Pr....g.R@..g..N........8.3.P...5.z.z$..4.....f..q.a....A<r8+..cd..........>. B=...W..W..a...&.\|.{-.....P...o...\|n'....+..4..+..q....}..F................X..L..U.EeK.......l........u..H...}(.....:.Cw+.(']..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1552
Entropy (8bit):	7.875621946725357
Encrypted:	false
SSDEEP:	48:f9rq7ljb2+H4uLvSU5EJXK9JJiuEvvoter2O+:fhaS+H4eLma7Mu0Ater2r
MD5:	CAE1DB4E0691D0843CE6C707411330D3
SHA1:	3C710C28B530FB32ECF0BB817C9EEA70AC688E5A
SHA-256:	14AB0FFC5E3FE4124427012698A33D7A44A18A54F2FCD9A2283E677F3EB56467
SHA-512:	101B5E0F93587A268CF220AF1235930C2A29389E07563874042D0AA31C3963AF97F2674BE9617B2F4501DA4CB0BF2BF190DC00E1A99C3BB8D31A2DABF769D463
Malicious:	false
Preview:	...".j..f..E.`7..d...:..x.........E..6......s./N........$......K...n.......lk.S.xyl...Y....v.CPG.}a..D.\?.#.(.......u.....a.:.......Tf):..A.s]......W..../.....6..8....3.h"..H}e9dg.......v....~.<.....^.%...C...e..U 5~...=..i..,..@....^5...9KN....(M.W..?.d?...o......j.L........!..z.Op......kP..A......t.#."..o.vA..;.D..8Fts.)..W.0";B.".XPX.K~.Z\>h`....g...]C..=....qT..t.%...tT5t_...Sj(....M...........#.._N...c.$..C...Lp.b..rNE....\|...K.n..afx..t......v....G.U........nz...tAo.......U.u.X...vza./qQ.....9...?..\|.2...........q.RCk..:.[.=B......5.L....V....=~..d...r...... ..:DH.,a.O...$........fi..g...%=........s...:.Q...q.)\|.,F..N....4.....m....w.;...p'(..Q.emY.....U2..._r-.p...}..q..8=.a.j..c....$p.-.s?..T..>./..%.\....9..l.:...J.&.n.3..!..UVO.U..,J..X..Pl...\|.2u.1]%...7.....{.U. ...\f..Z.............;A. ....%R.........S.G..lc-.+.....&_p..^z.......iR.nK.X..pv.a...*.G.......,/..2.?^t.M.>....k......Gp."C..J...Q.&.1..A.5....K....^/.T../."..5W.7ed.W.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	5648
Entropy (8bit):	7.966708123569533
Encrypted:	false
SSDEEP:	96:y4aWhdw/T8QtvZAp/fFR0MGMD3AFxAj6pCaZZHkFF2992w5av8Xba:jhurIz4MD3+AjaHkFF2L3aum
MD5:	759C748F0BD74E1AB925FC2FD76854C9
SHA1:	C4FC705F2375FC754272B1F1017D37872926C91D
SHA-256:	7EA8211102693F596DF3AE2D5E6CE967B5B38755751D5F9DD34D751391CB8F06
SHA-512:	13E7FA2952E255D7FD28F14F9B687B7AC4912E9AA88E31CEA5A7AE90B12E64E45EC87797582646343A822CCE8FBBE40383ED0D5DF2293D8972F36083497FF9D0
Malicious:	false
Preview:	...".j..f..E.`7..d...:..x.........E..6......s...C+.ZB..a........q..o....x.....E}.B.......!.}....y..0...;N@..<>.......9....4..sV\....^.;.td[.r3.......%.Kc........%.7A;.f..`.y.%...........w.TU..tG]Bzy....#b........p...........zV{....dE.. ".q..."..5)..h....O...J./...m.n.+.z..._...x....6.o1...6.X......\..3B.qI....SL:.O,.).........'.F........@..6.W..1!.......v#..=i.4.F>}6wM..P....3U...V_0..$..`l...3....S-..p.....U......Er..e..Bq..X..u.;&..#.....z`.%<..9.....&.1.A.6?.....^!B..SsNn.fyc.B..!.v....w..Bl8..t..`` ..!...o.c.c}.%....}...-.g\|..E/..i"............rD..NZ...?..d...r..agB..oEc.^....c.2......yImo......4$..yP...y..-Jv.bbe...e........2iU.........e.....u....k.w...q.....A....s....pj..5[p..dx.=t#.\|...l..\......Kw..!.\|....h]R.-.....z....J....S.9...L.Pu...P..T.......x..O.o....[3..._^..$R... HV......<..:.w;.m....g8gM#.u."..Ku.O..}9.k2.....)..,X[..v.o..R."...^.....FFQD.`.(..x......o..*v..z....sQ....s....B."...$.GE.GkI.~.[#..H}N.F&.g..[."..0W .5.]%....m.__

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1056
Entropy (8bit):	7.831504515503428
Encrypted:	false
SSDEEP:	24:A8Qm21xYX1xmijjM5MT0VXeZ3ekLpq5FYnrrfbM2NutrRm:A8q1xYX1nQMTgXeZOqpqrYrrfIs
MD5:	6A39B5AD556BA6EC2ED447CE473F074D
SHA1:	36026270D77257F6706AEE9C0F7F02DFD557F838
SHA-256:	CE943BD0EF1DDE1B992A31572C7AF4FBDA0ACF22977A808C07D213EC0815A898
SHA-512:	FD60358A248910295AD08FE8020F826FD640F8D1DF5EB8A56AFD2D5F6F5C66874628B19769E6D2A134955FB22547456661A15FBA5973888E70CB980BEE667BFF
Malicious:	false
Preview:	..:..-%....cz.:.b.....~.r..njBR.S...1yS.Pw....E.....y.v......n.'9.{.c$..a..h..-.B.m..nB..w.`.(....k..'.8E.jw0.K.-.A.H.t.<..../.......y3$A. ...J.e.G....m....Y..3.P..Z...l.{.z%.@d.=.u)....#'x.W..b..X{{.&.IH..\iw....2.R...c....xZ.&..X....oF+.`....#O'.`4#..U..s}}.,.i.k..G...y.2...v.1...w.@s[....#z..~.....#e..c;R.q.W..s.0a...~....S.!._.......3j.:F.......`.w.5.5..HH?.....P..=..8....o. c.....^w4....{..#....Z.....7'..z.@....Qg....G.!...Xxz..J........j....2;..-.Ka4v...+.\Vx..)H0..OS..k..8..".VWJ\..........3....+.N.m.8.)<.ho.`.].<9.6R.._.(\...G6=.%.k.8.^!M[..C.sZ.v..dY ....vz.oxA.}I.\|g....3...&....{.X?2....9h'^...S_o#..R....ab.N<....~:.3..4ru...E..dPd2Uh.pp..%..9.i.......{...7j...<B...c1O^g..'".L..,.h.....P6qL..X..)uw...F.%l....#...)1.......3.../G....3g...4x.\|.%.82.....Q..3F<..>....d62l*P......!W...]R.H...T.W./.P.;........E.:Xv.....p.16.......H..'.....{.B...6..?........>y.l"../pD.a..#.G.X.K.F..5...u.P.Ba.s.WP'KU.....\|.P._.......Zv......-.hB....t.V..-

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:sTwn:s8n
MD5:	EAA4E1925FE14FE35BE000F793B2D503
SHA1:	C7A7489F36AA6F7D1341CBF93B79C930F5BECC74
SHA-256:	EF251863083CFDDF74B88E95F2E5E6E46A3645BCE61F49CF8501B8D04C76CED8
SHA-512:	35C15EF36C227FE663FACB2B1428789ABF8EC86AE6F12B61FB3C78446BACDF2D36EBD1AB2D2D28147692DD5F65E033DF408D6BBC0287CF579E576B5FDCB50788
Malicious:	false
Preview:	...H..d5......U

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:hRVB1D/8Y:pDD/t
MD5:	786DA1CF16DEFECA6B3CD5BE03C47692
SHA1:	08C33331567A88D5A7CF892D67A6CD98B6C327BC
SHA-256:	77C633DE957D60CD7E8B7A10D8A84C3F191716967F582E772FC6BFCD1266BC89
SHA-512:	BF30D1D16A547035E3731BC68C91E4C26389258181B7DFEBA16CA4EF623175B9D770AECEE69B8D3EF0E42E5896B3B1FCF69378AFE56404B26D4D2831D44C8E1E
Malicious:	false
Preview:	....@.e)JP&..[.Y

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	704
Entropy (8bit):	7.696200471285848
Encrypted:	false
SSDEEP:	12:J/TdDI+vEJE+fUCSKDIKKKxlBOek5QUvKni1TOkcpvnV4VP8LlvrTn:J/TdD3atdIQCiUKYCkGGdYTn
MD5:	57A3077AF8E17D77674DC88468B631D0
SHA1:	BAD6631B1F8234C929310C548B6A470C2CE28044
SHA-256:	1EA9523EAB2EB7A20B1BDC58A37E1CC6FAD4D8BECD48432971F36ED149B312A7
SHA-512:	3F171C2D3747CF814961FFBA4160DDDAB86C8AE6FE79E4BC0C4A46200161E5D6D7F4084430BF1F46A2FAF7613C0324EA39F3CD290E8CC0F8F3D336790ACA0C36
Malicious:	false
Preview:	H...Bu.m;N.x...by..$?.\....Y..P9{....\|x...2......[.L...].5...\9s.P.......j.k..fl.h...k4m..T.'.I........-.o.q...J\.C.{3...@vAVvg.&...)bs!.A.+.....k...D..J.Z....wW..D....3..... ..,..Gqwe..9?..{....bH.j..&......B`.R=.a./K...C-..Cw...}a\|..L0bAI..o^....R....Oj.........r5..7.....?.IgpA...?y5~.....^I...N.jf}/(~C]...6.D.;D.........:....V.}w..'.+..3...O.&.{..@.^.`E.../......r...:R.....Xw..8\|A......:.`E..8...D..R...^#.........6.H...c#...?J.:..J^..x...p.G..l.$.\..S....]..$...`...B.C.b...~..Cp..P.........}........a..g+....@......)[...c.g9[.:.W...#....B.....&.F.$r......p.B... G.t.h...Tt.X>....O...s..>......a.b..#..d..7.3...L,..*..q..@R$moh.).dc3S.A..$.p.+?.b....T/.L.Jr...L.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Documents.mydocs.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.820239527472575
Encrypted:	false
SSDEEP:	24:AiVPn7ac1O03DyZ4Yt4MG8PrYCDGb8AGnrroF7pP1CFPGJxuI:AiVP+E/u75zPrJVRnrrWBkcCI
MD5:	2C60AAE87034EE8A11C678531159F749
SHA1:	873082856F3DAD8E26ACC6E1BC714F64FF1718E0
SHA-256:	BF10A6833B693069F14D30C868A694215F37AAFA9C29C86CFC0C1FE195E0D3AE
SHA-512:	6D6AC1930625691FB4C5AF7DB8098F3F9C9C6A38FCA217CF3F9049870D125D20C80CE2A9C89BEF0537770227D038EBB73A3E0425EBB63219F2972D1EAE1C9E96
Malicious:	false
Preview:	..:..-%....cz.:.....g.>..{..M'ady......{......S.6......^3.\J.}.C(.K...$..N.'.......^Sg.x.).R^.26[.....].$.^.L...w.."......>]YN.2W.J.6<`...w.Z....]aa&.p.Qo6.e..2.$.....1\|C...K..Q.+E.....;!d.T.......k.....DU.N.:R....l\|.W...\|...k..P.0.\ .d....f.....M.lI..f...2...,..KY..........;..oU{y....7.~.6..6.....p5.~...v.W.4.{..B..}...=....i....vRf..B ....T..)v>......y...f.O.1.6+...........NZI4.w...I]...{.....m...j=eM&.u.+..-..("...Tlp?...5..j.....L.$..+.....S.......9at.R.....{;.u...lb..-.2.P...S...DG......... .Z...0&?.......$....7..q8.71!^....."Z..U.@Q.....q.=P.....T.>P....n.`.]>v>.\.)S......,....d>f..u.e......G.....0....thN.v.........}....Ax...B......!e.$.d....QI..F.I..x{..j{..a.H,..W..(.7t^..hz......Gn^...4..\|.s..\.4<9.s....D@..3PYwNa..;B.q..ap............Q...W....k..2...k.P...s..........?.{u/.$..;.t..<.6..Z.{.L.N.6l.J..V...&.!;.;>#.n6]..?3.@._w.....".{kSL...f.o..O..`K..m?'.;.....5.:..SJ.{.ZZ..@.E...w.8.m..1..].iAk@.d.xim..l.[...<....W.D.0..R-#

C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:qoGMEeAeu/:qoGLeu/
MD5:	ACF43586A7466BE0AF3BEE2C11051945
SHA1:	A9DBBA4E1F8C3A87E6C1D867A4A75A8D3D33BF64
SHA-256:	AEEB1EF7FE78BEB7624AF6592BDEA9F17F8E34D82F2F5CFFA45121E42B196DC6
SHA-512:	76EF3E45289925E772E69BDE29597D6085E4AB791A33E58CEA9CB75372FF0602DE1DC6E53228EE291CCF331A2BE1CB23D47B1467A3502413821727710FF25E62
Malicious:	false
Preview:	..b-.w.a...m....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	576
Entropy (8bit):	7.6643809506014575
Encrypted:	false
SSDEEP:	12:4gg54NhIz5pqbGxzAK4erpzaYF9IceDOKkjJjL6MLBlV05X:4grWzLqbGxzAK4R3/HqJ3zlVyX
MD5:	8F2F6862F21013C7A551220669FAE71E
SHA1:	0F3A9143E443F7BA5728F021CFB2EAADC6B56567
SHA-256:	13E390309EF49FDE7059FDD2A54BB6554447E337CB17E397795C524476DB7DB3
SHA-512:	DEF069B93780A388C5C50F0C8DF0E96855ED99A4483980A460E2173D7A20C23645A883E9E70E4F9A8564702C01E357F7019CB8B954996B655421AD24E1167162
Malicious:	false
Preview:	.vc..\%FN..w...F...#.\|V...j......z.;........h..}...rgy....\?...Dk..\.s..Z.p../.BtHp.#P....J..\|.w.W[!.N~D..o p..R..F.:....o.....(wp..O...r.....TE..%...$gFRB.r>..[..!.>.]...9.!.u...Y.Nx..,).h0.........c...F.+..{.d...a9r.....x.>pb......d.....p.......y.?..bs...o...vM....L.~B.M78..4[.....O6.j.odD.J..+v...a...*@....#.p..bu.A..\|.a&.....b....CT...Bv.1T.l.p.!qnK..o.[...F..L..G.<B.$...U .R!..F}...H.0a+...Z...\|......b....Q'........;.AH..\|l...-.W..`...L.\|Z..%.A)&GhS...5.........g.Z...q..qVk..`..l...p...7 .......(q..i......z?d4..'k..S.}......X..MS...xH.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.82468779242169
Encrypted:	false
SSDEEP:	24:AGcdFX6loTKhTjlHx5WrECx4pKBZcAp9maDZJnWsk5MMQHJuwr:AfdFK+TyHxQAHV497nDqMPpuwr
MD5:	A47E442E8E25C37CD7E02C3F6633E887
SHA1:	BB34A3AD489156CA63E77637F197B6E8F3ABD195
SHA-256:	1C0EFDEAD568B1B3E5DBA2632921AE12B0E235406B467165972326906FCFB9B8
SHA-512:	7C3492C8E642EB8BCC714AB791156924C4A35F33B722A32187E0BF64A50C2CF952D6CCDCA8525573001EC2DE751E0226AD6D7DF92AE41725F64AC45CBDF8C091
Malicious:	false
Preview:	..:..-%....cz.:....x.U`...f.9.C.22...CU.t...q......<..z@..h/..,...,.+5...%y..).0S..b?......J.4y........].F....V...{...98U$cX;.E(R...zoF.?...8!n...6..........!.3#3..)3...X......j....ApN.....@.3..+.........Z..4A.l.i.l...;......Y........E.2i.1.V.R..F.\w..^uj.]....{.......A....O.e.7.(..v...QO..Nww..UIx...K....i..=...H..7...'.C...q..7&!\|.....'.G.._.(r.k.q.~....A.... !u@b?.3..at..Y!{.S.K}....PW........&#;....j.3..5.l..b...kN\|.U6.9........{o.p.....,K.j.h.bpB.BdN...>..nB.r%..cu5.jo...gf.F...h.[?tj.........g.(......W...x..mSU.w..~r...(R@.Gw.....5.H..o..a..4.y....}.f.9.......^.e.....Nb5KMx./W...z.O.6....7.H..3.O.7b..Da(..:.0Q.d......F..#..0.#.f/.B...e.Q.w#.c.......\|.~..!.3}.O..+..2K_..>.u.K..)...I...C..*2\|..}2...1.....B.....AS&Y..E...nII.b..2+r.0}.=.]#^`\.c/.L.fT2......#.H.Q@....L.,...@..H.;......&...5.....M.?AfI.c\|M2...l.e..95...s.Z'...]..+D~.]..(...._...A.<$d.......=>[N...Q..-...c1../.A...S.{.>...I7...''ro...T...kY.....0....Jt<n..C..l.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.839683883678454
Encrypted:	false
SSDEEP:	24:AGcUMqJgli4lo3BnluytuLfJx8SyHjTLV1gl6CofkAqO8nxv6vJj898:AfUpktlkBMr8SyDPVal6nMxO8nRkj8K
MD5:	0500445DB3E806B5FC3A40AEFA75A354
SHA1:	F873535A93AC2E8D4FF839C9E8F6D687090DBDAE
SHA-256:	7AA226EFEF829E99116C5B61D989BD11E6CCF55B3F714772A40D8309249DD941
SHA-512:	A7ECF022DB3EFC889F4908CE2B87BEE7814F80D1106F0AE3921C754337FE49EF7ACB849E9664048E88F388A020CF8D6570FE035AFD7D499775E79AE962D01B1E
Malicious:	false
Preview:	..:..-%....cz.:....x.U`...f.9.C.22...CU.t...q......8.Y.T.".$..b...##..Ts..'.r.AY...L....NV.d..I...r,..{P.m..<>z...XK.x..IE_...@.k..)8...G=n.(.m.NozQ.....6Y.5.hC0S. ..t.D.6<..!9.E.H..FY&5.u.......K.CP.dE.r........[..\|...!'l./:...X..../8;.a.s_.n.)I..\|..ZR....T......1..=r.=.0..1...;........Dm,.\...y-.E..........%...m].G.5.5a....dK..{...1..c..6.k./...l..L....+V.O...@.5.L)....t......l..u..Q\|.{.~.m<I.l.&......(ZdN....+.....Dg.6..g.:...-..>F../.1.7....8fT.'.!~j..PJ._.n..HA..b}._&......2.P..j.9......GNSe.qO1.O.n....E.{Su.[..B...rr..Y..p.h....3n..[.Q&&...<..)..h}..5......:...g..A.vC..G..TB.....yr[..J..>X...].E.R.G{....{....\......a.y....n..T.'id.....L@.....9R.F...2sR`..H..xX....3....(...U...].~7..M7El.......e..E.. ..J..x>.............u.)..QIN.`(.....Hz.q.........=(*......w)....g.=Q.......HJ..z_NKe..V{.{p..F..\.%..i...........?..n<.K.~3.C&....(;R....j...M.;q..s.:i.!W.e...`x._O......l.G....?...0m...].n.....$oD..y./..r(.d.a"+...?1........e...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.839322762580808
Encrypted:	false
SSDEEP:	24:AGcsq7MNLWAjrqxrz8whsfTRJA1JyUJSw+V/oVeMP5vlU4Qv/pg:AfJ7yDixX8GsfO1SLaeKlQXpg
MD5:	C079D55A7E85C499F29F7926CD5FE6D0
SHA1:	A5F4CB6C6EECF01B3F0B3B0CB802F4C073FB2357
SHA-256:	8CED369EF04584DFEEADE99C3876778F05CF4323BC051D813C17156298E82DA9
SHA-512:	249368910E0E14B787D816B2118425EB548BE056D9277D9199207767B5FF7F2DBE17DEE753CAB78244583E2243BBF0DF0ED339F3D2184D88DE9724D186D3FB7C
Malicious:	false
Preview:	..:..-%....cz.:....x.U`...f.9.C.22...CU.t...q......8.Y.T.".$..5)...,.>.}...U.M...m..II20._.....p...GA#.#....-.....9...C...k...c....l.).........{.}..!..+E\|...R...d.+X.;...:u.Q.+..).........rB..qs..#.?.\|/.p5..N2K{...8}7..;.7u2.......G..G7.a.2......;..8.........Zq.."....N.~.[.F.g..i.......#..Ij.>.%;.O..uDq...p.."i..?ak.....g..$...9...6d......&.>#...8$.7...$.l.J....{..(......OT.^.YJe.c....&.7..E3C....>.T..~\.$.T>.3u!T$?.\|.Ghv.R.}?..........P...!c.._.-.w(.s.b....q....ODv.)4.......n....t..'.:_.[A&OY..?& ..bk. .8....}\w..I...d....z......Z8...X\gi.....2.....a..E...C.9...j.\|....(..XfP.....:..d...b5...~l..3...nA{?o...9s.kA..3.!.e.P...r:V...gc.O.z.q...e..j......_r.~H..!...J..<.@]..z......H..V.9...... ..$E..,.V........wNj.0....#...1.$?~..`.........!z...y(.yy,...^3.Q.\.H...p...RH-3S=.}0....l....v..I.....j.{GlI.."..".S......C.)Ue..B....d.(\k...S...r{.......P..E.L..T2z...8)..7...B..;s ....#.7+................d...8.........z.a.hlJ..V..h.v.b0l..2.....5.\|RS..?.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	464
Entropy (8bit):	7.5307320213879185
Encrypted:	false
SSDEEP:	12:4gg54NhIz5pqA9H6A1d4TUMtPB1ANnHACbB/3eFa3:4grWzLqA9H6A34QGqAk3ua3
MD5:	98AE20B8A19FABF85E8FEFB2FB6E2DA3
SHA1:	20E6D9F86EE83E20B263C24C024A4D37C34C58D9
SHA-256:	2C5C01A810266A37DEA37129A650BDF1F7CE1F127DAF2A8E809EDE48636D6942
SHA-512:	EF825AAF1725D8E8969FF002B594D09D90321CA936A760AB683FC0C787C6F18505E70E36BB12B6E14B13F28811E42F57DF83C650673D994D77C5FFC4B2D92A98
Malicious:	false
Preview:	.vc..\%FN..w...F...#.\|V...j......z.;........h..}...rgy....\?...Dk..\.s..Z.p../.BtHp.#P....J..\|.w.W[!.N~D..o p..R..F.:....o.....(wp..O...r.....TE..%...$W~.f....w.\..#..o.d+K'.....68,]9..&....C....m[....x.3..ZnB..G^U.9...L9.%.k...N.H<..p.^:.s..#..0.].<..F.g.x.Su......W.`...t!.d....\|rt..\+..b...pe.(U...IS...ld&m...+l"..4P..7..[R.nY..J...2..ak.lW.'d!W.o..]..e.G]..........>...0.... ..?~.Zi.....z.q.....u.5.V..."g..S.t...R#.[5..n...c...d.a..$.R

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	7.8417018384962995
Encrypted:	false
SSDEEP:	24:A1O651gZQJoI0JZ/aBfa+oUWn4SuwuhMpqG2imxQdHiE2ISw8r3xgnfODx:AhXKaBfakapKh6qGOkxSmfO1
MD5:	4F3E3F64383A8C6F68CFD8552A6944C7
SHA1:	AD97B89CEBAC457819EFAF80EE54C9CB14ACD139
SHA-256:	5D4BEF807A9278A4F042B78FDD429AFB4519C3383743134DA56BC0D47DD2D0E0
SHA-512:	DC023160CDFB72C9015E57E70A3DAF09DC1CA50ADBE0A71E0D2E0081B0D363D440FAB05AA4F80BA12BF3DE33709DFE56BE33568EF35A848255784840FC674A16
Malicious:	false
Preview:	..:..-%....cz.:...h..i&x.yk..l4`..E.E0.........doo...\h.%.......P;...f...).3..#..../)&..e...g.....Q.h..4...%sq....V.26...f..uFo....b{.>...X.g._........w...T.6.`...t.J......:.. ..;n.~kF1.....-"..c.\.%x.P.A...%......n....V..`.].-..r. `%.9......J.W.r........,#....... .CL.-4.L.mS..}./L.\iK...%.L.@..2.1.(.(..a.S..g...m^.2.C1..%\|{w.~.C5H.PMF.$...z.....-X^...}.m.F..Z.Nh..'ym+.)8.G.Ej.c.DB=..ZA......w.EL........{GNh.:......R:.>.Zh.4s]...x.....P.a..]E7I....-.0.\.....,.........t....c.d....3...5.7...9..b[.v.......z.t..`;_...6.....j..V..^.po....l$/....k.,.q\.jv...L.l...,eJ.....G.B.wKc..]..V...I...2`......Os....c..Z.k.kH....^..oyB.....G...h.}1.....g..Y.[a..:V54..u.Q#.&....I.....*rT.e...M..v...x...K,L.....[Rd......4..M{....vja@T.zF..X.:..k..#..S...82.....h2...d..!5..oB#...q3.wO...0.J.^v.-......6x........;.qn.$.2;.W......._}I..4.Q=.{[.f!..i...r.><.K..#.r..l...K........Y...F.j..}4'..>]6A(..sd2Z.. ^..hI..<.w.L.N..j...Y.;...f.u.U.D..i..]..U.[.j.......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1168
Entropy (8bit):	7.8467356965354345
Encrypted:	false
SSDEEP:	24:Aa/AzAD+VoflqCXLT0AbzklCsLK9XHzizzYUFflc/ULKCUA2hczB6:Aa/fDO+qCzbzOleMM/dCUA2KN6
MD5:	929CD3BBFFE517AFD64BE6A741021358
SHA1:	7A46DA0E56AA5230CD155FE4CDA39F23A7FCFE92
SHA-256:	2FE084AE0201BD32F7D49A30A2A3FEC343850F1E6494731123D916EF246AC56A
SHA-512:	52EDDEEF90609FD760E22E191A8DE02BC6F5E1118C024CF696F7701923932394FD5979568F596C73C27E9C17B003CA1E717F583B95024EE2B6EEE3336D787B42
Malicious:	false
Preview:	..:..-%....cz.:...WG,@.EV.....;...Z.!.... ...h.mG_...Q.Iv.EM25.N.P....M.K..g..E.....H..b.).1.h]l.....D.^z... .e#..+T1..e....!.....w;.......#......`@..S..P.w..w........O...y$n._....A..k....h.x...sc.[.".?.5..&...'X.y...@If..Eg....#.qf.7X.m&gD.+.....m.R...@7..#C......e .3".>7......4........$...^.=jo..a.\.].^......?G.L....X...:...:!{.?...C.;9p.9K....p~...=.t<.g...W..2.2P.#.#......O]..NHu...]~....W[.0.00U.c..E....8....)hz{Y.V...B.`Yy..m.l....68..5..FN...=..~...#.....;CIfm.l.I..=..0.,.x....Q....<....k....I.@m.n.;......xy.Lt...T..g!..E....SS...x..l....Rv}..w.Y..r...(,.....Uq......E&/...W..\|..x.....#..-emUv...Ct.qev.P.=.3..<......tO.:..s3 ..$.&...'.a..]RQ3..<..#1;.5....$..f$.+N..Q...Z.H.vY.I...!j(..{A.3.&+..@+...?.\.Q..a9aS.v2.:.......2.G':.j.2X#.AO...V..H..!......}....\En.._[.). .H.......}G.%..G.......F..+..z....q....I....\|..I=.m.W.......O....."A.V..=....a..d.-...u.K...............-........o.............^s;_.......K.{..NU.....'J.6c..a.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.854151362881732
Encrypted:	false
SSDEEP:	3:zO1KJfqfGQmxnZgDyGz0vhf+hSfUyI8ToB8YFFOp+Nwni5rVOKKopYlcin:WKJfsGQSMd4FoSfUyI8TLoFlN/r4opIB
MD5:	80985E82145CD787D1BE63B684B1A523
SHA1:	5CE252F36D3FBCFEF5F9BFBBEA3AD70D9E34C529
SHA-256:	BA4C8063C2907018BC62F410B9E6734237D6492872A5A5BA811A8471100B50EB
SHA-512:	346253508D3B4809D324E7A88946D9FEFBB7A00FEDE1CD430E8CFF15A40AA0D2ED1B0866209FFF2C53E693A2E91AC83CE34C5B4A60AC61148E997396FFBEEB82
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f....s...F..*.3...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.866796604297542
Encrypted:	false
SSDEEP:	3:THaVggLC0Qd8CG3I5+Z+hQhYr23hfxufAGNmv1qsOoNCYAb1D8:4ggj93IS+hI+Q5QAGwv1qssd8
MD5:	9C50AB013139E0D9F6742CD1FD0F3337
SHA1:	FF79F4E0A95D510D976A5502D1B0D5C51C7DB573
SHA-256:	E25D78AC66D9F2EE236398898872065005181F966A5C49040FA8AC4DCA70F83F
SHA-512:	A71B6E91E429B26BF8D3369C6158AC50B79125A484AB4ACE31B1C10292F4511EA5AEDA3542CBEC008F3C69E963E9D8742C3E5D248D73B1AE7E3E57AD1DB255E4
Malicious:	false
Preview:	.vc..\%FN..w...F...#.\|V...j......z.;........h..}...rgy....\?...Dk..\.s..Z.p../.BtHp.#P....J..\|.w.W[!.N~D..o p..R..F.:....o.....(wp..O...r.....TE..%...$X.a..2%~..uoB...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.842787726518096
Encrypted:	false
SSDEEP:	3:zO1KJfqfGQmxnZgDyGz0vhf+hSfUyI8ToB8YFFOp+Nwni5rVOKKopyHkEV8hyy2q:WKJfsGQSMd4FoSfUyI8TLoFlN/r4opZB
MD5:	89CBD859B96A4652C5FECB040D042B15
SHA1:	671E54DBD212163F5608D5EA45BDA3064FFB2348
SHA-256:	A950AD078091B9CFAD8EEC82C4E1155912352FA0044AEA52A1826BA6BF01B986
SHA-512:	D8BA2CF7CFE8518F838713A8758AD0252897FF7626300FE85DB883C3F9EEDE7956F970831296FBD18E1BCD7DBC91DEFA17FC91A46C2E9DB94AF4F6265CBDC524
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f..G...!'..Y....O

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	688128
Entropy (8bit):	7.745832248993148
Encrypted:	false
SSDEEP:	12288:mWVEtVuZqCUAgmh0kM9Vipj1cXWWTBz01W0ZJ9WE3QqH3cAb:9kk4A/6kWVipjMK333cAb
MD5:	F9369D1C7FE1D2797D23F20CA19059A6
SHA1:	16E378519BBD97467F751064B17276F2408441D5
SHA-256:	B30EF4DBCC89CD4BF0DA3E7787F43E42023DDC2B5F0BB4F24937538E10E17533
SHA-512:	ACC38A05A8F5F272F068D91A61B5EFA378839B398A372E67B62FBF65985FFB8846325D3C533E551BBA88257E0EEB983259EE2860462B5A642D28599776A7970F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 69%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...CF.c.....................n......./... ........@.. ....................................@.....................................O....@...k........................................................................... ............... ..H............text...4.... ...................... ..`.rsrc....k...@...l..................@..@.reloc...............~..............@..B................./......H...........(s...............0............................................(....&..(........s.........s.........s.........s.........s..........0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0...........~....o.....+...0.................,.........o....+....9....~.........,2~.........(....o......,.r...p......(....s....z..+..s..........~.........(.....o......(...+..tu....%-.&.+.%(........o................&r;..p..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	true
Preview:	....\%R.fg.tF.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tvaYCy1BcKESHqnO.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.83939701027072
Encrypted:	false
SSDEEP:	24:AaRzeYpIs9F1ASY+sZSW0LujjYAsUMBwqLr+C8ptV0p3iS9ecyE:AaRzeYeShzKjiUMBwqH+CppvIpE
MD5:	A731E2AAF7AD781E771F4DD6DC587540
SHA1:	0501DAF1D6FE4B6EE8E8434002B9A689D50617B2
SHA-256:	9EFE8C7E5A98E4E93886430E7F1B12A72E5FCD15008A2C80CFADA5D683922E3F
SHA-512:	BD888819EA41BEE716C7C194D273F3CBB7BE34EA53B856D07FABEC48ADCED964746078D5C613C7B1BA4583B6BA3A2251B10315AD6B05BDAE7B5F13CE06C653D8
Malicious:	false
Preview:	..:..-%....cz.:...WG,@.EV.....;...Z.!.... ...h.mG_...Q.Iv.Eb....g.}.d.8..V`._.......l#...L...KM...V...........y..$......?..r..\|..`.h.{.!.t.(U.h+'.MD6p..F.c.59.cK..I.F.....X..,.....X.._3..cO.b.......At..o..xY-do=D..=C..zs..]U.......j^#._U2U.8_..Y...r.7.2...l......m.....,".......)r..P...q.B.;.w.Yfb......v$.....M=....7...NS:9.n].........Yc.Z.$.D..d..o..>/n.(.~l....I.-...K.'..s.D.....d.5.. . ......{.UE..Q...MI;,nSbe.?..lG.~......!._^<.....q].g.j.Nd..Zs...?.'z.H...v.iq3....w.P......0Q....')qr...FdH}1....[./..+.h..k ..q..:.....A.St......pyA."rz5_.."...c...&Pw..Ry...wTSN!....%.....7[............Av.oj.q.F..D.KxiaP.X.............\|..Q# .z.H;~E....t...y}[V-.W.....F.;O.<..:......~..\..(.......h...<....e...J.>.\|0...]...1.&B.-..L...7.di?.b#i.i(.ND..0.}..:..{..u."...A.......'6..y..1.t7...d.......a2....E..\r./O `.....r.%&....$t[In..6.&6..+...G...3.f_........w......S.F.`.=h.f..<.7......&.....c..W....z.:.Sk.m.s..o...yA...~.......!.2.uk.e.-3

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.531772645006209
Encrypted:	false
SSDEEP:	6:6PGNfQUQnCQX7P2afOTD0AxPzFh4/CzpTdUzq8NZBsKUBQXgReK3ebw10LehgE7p:AGCUKCQXZIlxP5PTARsKUeXgR3w+Fdd5
MD5:	A5144B8F9737BD2D53D5C7143FC6A9C2
SHA1:	0B850E054ACE91A2F40944AF5EAE3719CDD1E205
SHA-256:	9EA60F0299807461E8E30712832F71D0312938079429ADCD5D0039A5EF866D46
SHA-512:	5042AD47B05B2B39224CFF8F4C04FEE8460EE077D3B6DA4CE9D9637F96B1ADD29414ED80ECCAD59076D0AD0794027672F2C9C2D1B04CE94CE23BD3D879A5F4A4
Malicious:	false
Preview:	..:..-%....cz.:.n.Nc.c(.k.GI...uFX.fo.R.pOV.O@./...8......././O2!;.U5.hA.......Xb...S.[.w....(....k.>.P....)....qZ..o..J...T..=...8&+/.......:..DJ....z.....w..`..GBTT.y.mgW.....D.W.C...$P..1...08.ycO/.:...'v.._U....(.a..Ix..S...a.=..B<...........=?..L.......'eM...$.r..........~..!.t.w.v.V..1[.M.........K3...?.{..[Q=<.d...8.:y.G.5.e....3...........n./..m....>4.,&..........b.....j.b._...aIy..C..h

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.752544050516921
Encrypted:	false
SSDEEP:	12:4gg54NhIz5pqJeUXRyJW5I5PwmXAXQFbVBVc5AHFlK5OTxvQAXx4Uo:4grWzLqJeORUWAPt3VHFlK5OlQAXxm
MD5:	E341559D8E4E9FF3F36CD9AB63944271
SHA1:	EE8FDE337E0C4F675CD2BA716D8CDD456FDD0780
SHA-256:	84AC089BD2C58BAF07B732DDC8C5A58AB3D011635CDC51764E215F5A4C66823C
SHA-512:	4F91D3D7AFD87926171B18CE350B8D57BAC90E2DD764AFBD2CCA5A7A5B81EC877A6FF5AAA2C986A0F0DB10A13609A52C60298BEF96E1C1B3630C483CA8F5AFFE
Malicious:	false
Preview:	.vc..\%FN..w...F...#.\|V...j......z.;........h..}...rgy....\?...Dk..\.s..Z.p../.BtHp.#P....J..\|.w.W[!.N~D..o p..R..F.:....o.....(wp..O...r.....TE..%...$u....X.a.....q.@.@a2@.h\..A...r`P.hh"(...p..h......&.SJ..7..E.%.aR,y.:j+...I...>H..o...m>Z.'-.2=9......_.M.N..P.iT.....+`.E.6..cPV..xR`:.....Jky]...@6L.L...O......tN2..k......O..=..\<Q..)...J....`..........W.,ya6.k.TSMj../..S..4.}...S&wm..U...4q..o<@8F.(....-O.Q.i...V.....4..K.kc.@..Y...^.0...c..n..R.T.sJ..e......IO..U..:..mH\|.5..`6f.@j..l.l$._y...)..Z..NW....{...`[l.Z..H.....1...mv.:.`......b...P......(.9.E#p]).)MY..\|....7.&G.q....C...I.....0.e..no...[.....g..]?\.}?A..WF..../d3,.`!.. .G..+.x..dS..L.<=.y{..6..#..F-.....P.vs.t..,...e....vt:..z.m....e+{@.=N.....\|..#.R....b8a.d[.l..d.d#.DF4 G$..........IZ.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.4697982517683625
Encrypted:	false
SSDEEP:	12:AGCUKCgetmqcDidxzhixlbxq8xL9cxAFHf+tF+uGpY1:AAqqkiD0X88FeM+tk1Y
MD5:	7068063628DA26A52E28E60697213D4C
SHA1:	6ECC81C3602764A063F38B9929CDD881CE9243A1
SHA-256:	4FA252A584C675D8E80A9E0B78933378C3ACE7B4D5C7C8A49610DBCB6A1E2B92
SHA-512:	98B910945CE6EAEDDDFB304EA2A0C3A519B4C7A5F23BD3C0022B375DFF76467BD5A7715C2918C2746C6F244CE1FAE55B656C88318BE4F966FC585BB8818C4160
Malicious:	false
Preview:	..:..-%....cz.:.n.Nc.c(.k.GI...uFX.fo.R.pOV.O@.....kfW.R...=/L.u.=.]r.<......x.K..:...R..H.6..q.....d:.}.. ...<....s~....I..N.s....:.)n.^.F....b.4...s.C..!..2....\V..\..9.....}..o....y_jK..D-.fb....3...D..{V....6.:\.....E...x~<-.....>:LDh.6%\|C.ci..,.......&......3..tc........r..G..=.8.(....+..sKT.y...?g.k..-Ec9Z'..+.w)..h^......2........{.d.0\.....F.......<.vK)w#21u.....;2H..9...f..?1.9O......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.534633222048337
Encrypted:	false
SSDEEP:	12:AGCUKCLTQXqOypmMr3G5VybBBlqMhkGxFE4xtQu8ItpYm:AALMbMr25VybBnqkkGxFpku8mpv
MD5:	3415B0FD044669FA4148F3BBB24BFB45
SHA1:	8AB3C12ED33784073F290C7BF82B4791D519A19B
SHA-256:	7E1205B7F750B483DE23E6C51B0EE09CBDEA2376EE0D4A9B72EB10E858C76DA1
SHA-512:	10BEA2E91B64040DB0FBC508F6438F162A605643BDCBFCA145CEE6984E6D8EE5AEC768AA22141196E87B7A0C593C5BE1D2086A1E6BE216686CC71B2BC4A12F86
Malicious:	false
Preview:	..:..-%....cz.:.n.Nc.c(.k.GI...uFX.fo.R.pOV.O@~.,8..iY&....%.o...DZ...Hp..KK$[.h.Ei...........Af B...e.@.@...{..T.[c.;........U:....Mt!.......^1.]..<....d.:.z..u.u.)1q.[J.U'.u..6...t...@..*.k..<.#_$...!.M"..ZnaG....k.=.C..q..@.b../5VD..d]j.MV...}.....cl.F.m.2S....L..>.'...}..Q..Qo...._...c..^..I.El.....1"H.mBN@.i.....[.0W...A..[..m...@........5W6&..u\|be4..Q#.;//u.-=..._3...6{h........F.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	336
Entropy (8bit):	7.256262727999788
Encrypted:	false
SSDEEP:	6:6PGNfQTFI9A8ziTdCX5S6LlAqS1mYNh4ZOv2QXwarNC0jUV5E05KStSY/E5FQBhz:AGCJI5ziTdCX5S6LWqGXWkAiN9jrCE5+
MD5:	5B5C763F2C4AFA64171DEC8C259ECBE3
SHA1:	6F47721AFEDC13200E985D5193556E6B00B72C69
SHA-256:	11B47ED6F4F7448A10A9620EC18609A5B6B8E838F8E901788921BCBF7E4D78E0
SHA-512:	1089DC0A6595223CF74AB73EA160F75CC3B01276E0FC81A36452ECB1B43761C43679B4C913D29A1FEC73315212DFCA53CF2CCE887C7A2651103E4892B2C56FBE
Malicious:	false
Preview:	..:..-%....cz.:...,= @.4...&.'$^..?4uQ....&X.b....!d..A.....S.N.o....U.X..I}.8.....RF9.4.4.Xm..........t.s.@.7.....l.y.....0..gt)yv.\|=......i....R...\}.g%....cd..@..6.shyC3..yc.4.......Q[.=-v....q>.......!hQ....4.S.>...z..!...&.O..c8yd.. .X....u$.b.F.....h.....&.....'.d../...*.f.c2.:.Z.D....{..5d..g....."I.q.n..(.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2496
Entropy (8bit):	7.929465580220604
Encrypted:	false
SSDEEP:	48:At//9cnv00ZIWtV2eKzeGUIl2mea98A8RyLCdRdui3O653AV:4//qvXK+merk224a3qpwV
MD5:	0CAF63E2FF4CFCB2B18E4C4FE891D43B
SHA1:	149B34CD935CFFE6F39AF94E2EFF255F3652B68B
SHA-256:	D7BDA7BEFC914B7697F30F222BF4241BC45A45A7F59A4231DBF81674793F3BDE
SHA-512:	D458DBB08E79B913CC50B9D5F9055A039FD7AB15BE7EEA9F129E3F3928E61A92CF42D2F246F2A9152DFFDA0AC8F801DCBF88DA3B46097C5B0DB073EF6C42A742
Malicious:	false
Preview:	..:..-%....cz.:..s.B..H..8....X.&3..,.m..z.wh..\z...q.T..j..c................%R..p....B.a..^.$N......0u...Mm....ey..o..R{..w$4.;.v.._..R.eYf....q.>.=.W)ox[.....I..T...5:.V.L.@........y........T.....6k..Z=....D..H$?..A.t-.}_/.../.)~&G..s..../ha3!.I3.F....9.;.+....U.A...<3.'.b...M......a.. ......=@...-m..k.H.jL......~A...H[R_.W.0.e.....jnP.\:.K....../=..:..e.3rB.6=..z..s.k.....6...^...dvaJ..G`..n....4......Z%3\|... .5..2u].T...a..6.Y..6P.Opy.'......0.pr..6.Q.F.6.....\x#E....]..........!....-.................-..&Sa(...LP..7s....W .m.l...n.#../...E...5+..a.....7...Oe.....KH}..7...3....1..qdCxn....K..........;H.j..h~_i...>b;v~..t.?n.dQ0.*..5...\F.b..NJ.r3<.t...;...<.9qI..S..V.z...I...e...X+......{o..pB..!.\....>..K....6.t..z.K....@........O..w,.. .,.V..6'S..V.Xy.L(.B^.../...C......l...S._UUr.)..GT...X.C...8.A[.wQ...IYI..W..d.P`..7.nM8...T.m4...._.....'.$...p.L.......R......,..{....h.2>A_.M.V...p3.F^.B..f2{{..NMCZ....b...i.....)a

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE (x86).lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1280
Entropy (8bit):	7.854517818004195
Encrypted:	false
SSDEEP:	24:Aamypv08TVz0/mhkYtJM6mQMJEUjy130icL7pqvh4AiKRDw6LYP:AaTsmReY72bja9m6hpRDM
MD5:	8272CE441690281D511F471447B0432E
SHA1:	E819BF62A591291513892449A82E214479CAC689
SHA-256:	86A310BF697EB1B15FBD16CCC0EE5F3EDA9C90DA45BB1B9F118E0D0DD0BF62C4
SHA-512:	F5484BC924CE0F272BDA8E13F98D8D3EA4786B47057EBE197B0198B6E13902D1AAB5994D3539F100BDDE7644B03334C470BD8AE7729D789AA3A2433D248D1349
Malicious:	false
Preview:	..:..-%....cz.:...WG,@.EV.....;...Z.!.... ...h.mG_...Q.Iv.E. +.V...gc'_.2...~...Y6...&.#.D....m..V...R..Z.k~.......f.o2......(..4.Z..>.'...f.......Z$......r.@._2...p.u.\...;N`.....L....<....)(`p..[...\...#..2....M..Yu.;.-.y@..j../5...q........m.d..24m...U.b...6...V...52c......9.a.M$.......d..8..^.v8....fLW..Z....L....K.....].G....55@?.9...g9..+M...6.u......K...!.}.^/7..t.....1.'......W.z~.(..z.,w.1.....1Pu.35....[...3%..@nX(..j..... .~$\.c.@...../..)...4..e..n...@..........{E..IJ..zv~%d......qt.E.^;A\...l......zDo.+=.i...CX....Q.....+.......v.V.].....2.v/},..A....)....g...XF..Y.kl........GV.a%l....o.z-E}....\|..P.....'..5B.df..]yo(Xz..jqiP..L5..H2.z....E...%...)s._@....o8....5).h...q:.....4D.QS{>`.E....DE...\.."<I..\|........i..9Rw.....-..\.A....C..F@U...H.C ..o0......h..'..uf. .[8U.e.Kx..H....\....X......f.{X..^..V...k......1..P.t...Z..4.Di.D~.b..lW...c.G..6LcS..rO.0....../. .X:^....5..2#..e..=...n.9.+.n..O........F.\|.NTO

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1280
Entropy (8bit):	7.8463076392171205
Encrypted:	false
SSDEEP:	24:Aamypv08TVz0/mhkYlM7aYeMt9Q20+7F/TrptgCm5vnnFJOS8:AaTsmReYy9o+R/TpmNFb8
MD5:	319BB7E2FF093A61080B6672E5E83D22
SHA1:	34DC15AC70DA6D1718E1BB10877FFF500375AD59
SHA-256:	D325DBE40848C94533DE432E3752DEA35C210AA1EDABF8C16EC25A7CD39F58BD
SHA-512:	DF0C0291969B6C8A26EE2E84AE3E5A02F1482E01BE79C9240580F4DFF9F684C93F091A29E03DB916F8B4FF5F3319E697847F217D705AAE623978D40230C2AD75
Malicious:	false
Preview:	..:..-%....cz.:...WG,@.EV.....;...Z.!.... ...h.mG_...Q.Iv.E. +.V...gc'_.2...~...Y6...&.#.D....m..V...R..Z.k~.......f.o2......(..4.Z..>.'...f.......Z$......r.@._2...p.u.\...;N`.....L....<....)(`p..[...\...#..2....M..Yu.;.-.y@..j../5...q........m.d..24m...U.b...6...V...52c......9.a.M$.......d..8..^.v8....fLW..Z....L....K.....].G....55@?.9...g9..+M...6.u......K...!.}.^/7..t.....1.'......W.z~.(..z.,w.1.....1Pu.35....[...3%..@nX(..j..... .~$\.c.@...../..)...4..e..n...T...d....>q.J.u..d.c.....b....vu.s...c.t.LmpV.wVm/...'f.^x{..A....H\..P.t[,$....J9..G...n...m..X.2X*.U...r.H.1y.[...r.2Xm.J.!YXK......hi.....j...r.......[.].N......r.P..<T.z...u...9.../..[.=&. G@y.C..V5.n.c....2v..ujt;..W...{..,p..U..B..Kj.......S].6E........~+....^so..i~......w....X...y.S.Y.&&..d.Iz/..$.uC../.......a..o..........&./..y.^]........s.:....j.E-E.M.8.>...q.......)..4.)..&.J.U.O....b.r..5.......L..m!(.S.F.]..Y..!...^F.3.X..l&. :...\.;k{m..z.v(.S\|j.>.G4.w..$g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2496
Entropy (8bit):	7.92713615093017
Encrypted:	false
SSDEEP:	48:At//9HWhK51+iaRsBuQZjsjkTYh9qnwO8JXwzRNxYi+Ns1TWAqJ7a:4//NWwhaY5QL7qnBJNMNDa
MD5:	50CD2D488F29A3298A4D7B1426335FF2
SHA1:	57FD1E975DAB576BDF4BBF9A9D4EF5976A975E44
SHA-256:	4CDCE579B7FE479DF87A5BC7040F655E783F50D4D1E0B515122B5565AD3EA19A
SHA-512:	5D1D88C682EF59D54A98A4E5E2595A8802F332C3F7238479C762FCE8367D67A62F1343E02B694328F06829B4E524E2A1D19AB3696A11FAEE76FD70827E21A9E2
Malicious:	false
Preview:	..:..-%....cz.:..s.B..H..8....X.&3..,.m..z.wh..\z...q.T..j..c................%R..p....B.a..^.$N......0u...Mm....ey..o..R{..w$4.;.v.._..R.eYf....q.>.=.W)ox[.....I..T...5:.V.L.@........y........T...a0.I...[...\JX......6q.u'...Jg@S$.DK..;.{`...M..y.l..d._..X.{:..mz\.c`.&_O%b9..\....c[.y.vS.I ..M=..eJcw...\<)....{.a..j6...v.lSq.o{,m.\.......S.s.z./S,....ee...J.w\|..;VE..K.9;P.4..~>#...}..m....f...!'.r....s.}..Cxb.b[."..x....a.'Ed...A...pq...:..m..A...q.-........J...)S.Y\..D."..."....5T.fR.7..-.W_V....p..3.'.C../..Cz...K.\|7-.....X..[. ..YO....f....P...T.E.....z.,,..Y..X.Z....5cf..q@...pz....d.=...l..o...<j.J.5Z.\|D&.V./I.a.W1.....o&.,....'.....D..GL.,_!7{n...k..q!.......b?5.Z....6..~...Y.W...yGZ...=..lL..%S].G."...J.\|C+.......f.....e...x.V;.c..h....k?.)3.f...H.t.....$.....w.d=...v'....[C..W..x.0\X..I.}..9....."S.U.5....#.#(..`....PdM..F..I.}.Z.,.{s.m...a..F/.%L..}....t.4[V..zi..\../. ...}.350.v....x.L........@..EO..L. ....!^

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	224
Entropy (8bit):	7.070040120735838
Encrypted:	false
SSDEEP:	6:/JSob1c6tftrRJSnhxgqQsElKe8cqjdUqm2XTPiAjR:TbrlA5QnlaNtXrtjR
MD5:	F5F9271B7DFC40438CCF3853C05AE857
SHA1:	53723D83E7F9F99B2D6C30F8BD9E8DE4DDFC78B0
SHA-256:	5B33A5C561877052FAB762D59D758EFEE807C74477CB70C5F2743D4AF2094878
SHA-512:	E4A9BAFCC9DE445EC24A5FAEF51EE528C7AAE7616F4B1DA0EE67C2687238630AC3E5F923C7985033286FB89E3A2B7A2E7AFDC0295ECE557FAC1A562797462B56
Malicious:	false
Preview:	x._.R..].. .SN.!........D.D. .$.SC....Uc.f..z.re.rD.h$.W....-]....)..v....d~..~M..E..S..7...b..\;..u .....eI....I..V@'.....D5.L....\|e. ..3.t...o....mrC.Gl..K..gK.....h ...../.r....$.P.9..m((X...l.Z..[..c.....\o..!..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	272
Entropy (8bit):	7.213610486437653
Encrypted:	false
SSDEEP:	6:OYzAoHLREB5fcJdShr5eQBFw3hTH+Wywib3pAVn:OYzAoHLREB5UJdSR5eQBYTryYn
MD5:	958F35E9F2B5D231A3B05F38792F5FCD
SHA1:	BF0CA2806B8B180D3AB9A70A24886C40229DC18B
SHA-256:	C0D51D7F2A3B4BD024A8F041ABF3EB257A06016E44D7C241274318F470517261
SHA-512:	58927033D6BB8938A9991C7A65975067F5FFE2041D276388CB2324770C65D8F6F88E49E6E943563CF7D71F7BDE42D6C558ABD85A0D10A0941CD5EADAC6B8FC59
Malicious:	false
Preview:	o.S.....q...g)..oI.L.Z...VQ....AaF..u&.\|...:E...E...eI.O.........UF.L.....i.,..5...`G$Q.....AA..C.(....^..~U........C..M./Z>.x..r:.'._(.D5.4.i...I2..........^.I.-..+<P.\|+p.....q....Nh.*,...m.R.D.+..%.ll...0...c.- ;^..3.e.k...J.S%O.q.QQ3q..#.c.m ..Y......%0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	176
Entropy (8bit):	6.838498592983075
Encrypted:	false
SSDEEP:	3:zO1KJfqfGQmxnZgDyGz0vhf+hSfUyI8ToB8YFFOp+Nwni5rVOKKopYEPUt:WKJfsGQSMd4FoSfUyI8TLoFlN/r4opYb
MD5:	BEC339D42CDB901CE6F33115CA626F78
SHA1:	8442106B43543E1CCC76DBD1C17608AC910B9267
SHA-256:	9BC7F3D7417D962AAB97650B15C1563953909F05DF9BE6E061F5E50BC3DD01FE
SHA-512:	841DC4631C6E85E48CAB777EB07C4043903E927B2849BDDC81D059B5160215B4C23FD411BFE66FD5398FF3D11632E2A665F2705CBDA8871849A6BA8040BF2AF7
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f...'......*..C...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	74000
Entropy (8bit):	7.997342360844836
Encrypted:	true
SSDEEP:	1536:GdLfTBcgoEQ1h2tkgf8HBdv6rpr1IwEnJTPZsbVBQk:GdjvoEQ1h2NkCA1PZAak
MD5:	D187A8DFFEB80786AB3B441612143E95
SHA1:	13BE0E7C3EABA6DDD3A7A333DF98776555F70D15
SHA-256:	8C9BC878C51707FAB938F71C482AAC92EFBDBCE0265C6F02FDD05FDAB225C0B3
SHA-512:	FEE8947EF1A9A8EFE5B83A8DFF2DE9F6CFABA52753C9AA5B222B354D4CDBF19BC386770AFE72C9557850510C8562083588B648F6DA1C99279AC796D691ECF818
Malicious:	true
Preview:	`_..A.....e.]`G&\|5...?0\|Q..(^........Z.7.p:HxLmK.R/...D~...H.z..S.T&?V."....>...l.BM+.+..V.Zn.)v..g..!...t}...c./k&.rK.G9{....rIH<......".c.dx.A...0..;.jog.]..&Z2..x%!"5a".iI...z.]A.as....R....f.Sa~6...G.Ch. (.Q.je.:'.....a.z.=.bjn.1.....!..................H.]9.^... ~...C...C8....L.{.h...,#..k..k.N. ....%.A.6+H.U...X.....07..7..GC....[..\ ..D....c...u.I\|...;X..a.P.z.-=.r.B...... ...'.h.LL.....0.I.s....M...../0....s....=...N..q...t).e.A...+.7....fm}.KR....#]..~.{..3V.eJ./.."..M?.6.......Y........h).@}K~... .Om[.w.S..o.X#....=....}n......E.Q?It..4.I:...~.oER^&...S.7.-...R.......R]..;.B3....rui..........@..0.X.D..7.T.....h..V.8.......-k..\t.F)...tXS.e.m.L.0.RP......C.,..:.#or....d..9..{l.....4... .8s..ha.j..V6...4..'...h.Fp...Y..)W}2dJ.RnE...5....$!d.2 ........m..$Ev.B......&.4dO.B..1.4...J......G..n).?.1\.....;7/..V.N.x..(>.XdT.9=.7u:...2..2..k.P0.s.z'.Rq.f..dBh..V...%..'.j(n.x..!...6.!..X....9.E....X<.......\.6.i....\^l......H.....r

C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	73744
Entropy (8bit):	7.9973272736523375
Encrypted:	true
SSDEEP:	1536:pCKrlPEEghZzq2sUZkAFc/dPCBD9ZvziyxtENODNfCCku0c1DGav:/lPEEgHzq2ZZSCB3wOtL1DGav
MD5:	FB246CAFA9C45D4515FC4448127852D5
SHA1:	AAC6FEBD5A86B2FA89A7AF1982C735B0C6A83BED
SHA-256:	D94A66DEF41802FF25D198053097C4BAA27A87199D2B1651398F62096CF2E57C
SHA-512:	26AD1989722FB1E6C99A6A8CDCB1D3B9B252130284C6676F6C18822721D69EF9A2324CA107551DD298E4883EC36BF58EF503C86D283AFD10BFDDE72C9989A139
Malicious:	true
Preview:	.F..s.......(H.}.e......^....^D.e[.....f.:hB....n.......\|J....^60&.9.!..x...Tz.8...t.2./.=.t>..E....E;O...(..\....l\|..'...hm..5.s..y.V..9..@.FS.5n~....?J.(N.'.i....l...2..5.HPwdT.....a..@_Xh......iX.t#0..O......1.e..d.S.."cc.7s...y.f.........8."wG{Xa..%."..J..%....Ty...{...3 .Ivr..,.....{.q.7/[...&..ov.,c.g...Np.....z'R5.jB..y(...1.wKs.......l{.........),.N..m.(..U....OS..n......n..n......5UU?..>....;.M.'8. .....,.U:.a..'.Dr.I..vttk....&..}Q..k`v&3..v.........A..3._..L.Ua.._.9t.\|.>......."t0.B.w^.p....f.`'.....f..H.6'B.U.c......".~vV.1...ch.J....:..u.'.....h\|;.<f..T.r3....W..M.....Q....u2RM..e..S.#...=wk.....G3I....0\..@..v..%/. .......<.C.z.>..R.d......9.!5.h....... .....ae&.0.\|.....Q..v..j.k...w.....2'J.....d....[...&......h ...........r.3.)..s.7...P.DKl.....S,r.-(.,}Rl#g.rJ\..]%6......8...x.^X.[...0..vF.....g..@\|...)...e..!4,..*..........X..."...j.........].. ..f43m.g$...v8.}..`P,....8>A..]cJ..nc....a./p._N.\|d...$D..+}D. .....Y..6...bS

C:\Users\user\Contacts\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.503514192991831
Encrypted:	false
SSDEEP:	6:WKJfsGQSMd4Qp3ljGQzOAOHVpdmMautuSalYxMV5KW5noaN23sboGl5UsIZd80M0:W9GQS+4QxlytA2DdmjlY05nTKsUK3uhx
MD5:	6B12C4313CF244BBB41D0B709E298E76
SHA1:	3EF14DD3F6F0EF098D345DB352FEB36E3D0C082D
SHA-256:	03BB4D851A0E4A0699AD3973D2045C211A6E1FC5E6FC9A64F5C3B69719427084
SHA-512:	5F328B589FDEE3F77D1A7C05F1488D8C1BEBCE5A730F2BC52490380F31E28C4D4F88C95251DBC66ABA62666E3FB9F53135D9BAD3F6D31D7B978C4B9917C2AEDD
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...O.....{#."..k....',....Y50.r.......i......g4...K....)~#I^_....f[}R.(..6..2..#P%.!..p.D....h'b..6...u..z.....v.s....L..&...9.i...Yz.sTJ...AoW..O.T.V.G........eTU....H....o..M......C.^\..l.%...8........7(......GA..,Bm.Db.......P.o...+Rq.....{..JS.. .........P..l.F.EC.1.WN.Y....{7.H{m.O..H4.d./.i.....c6.@.Ej.*...x

C:\Users\user\Desktop\1n8xsH3cmA.exe.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	688144
Entropy (8bit):	7.999746427960926
Encrypted:	true
SSDEEP:	12288:J1PA2KZLfHruugmj2C6zlFr3kbYkw85sZOTooMKnXEfBzmdsOz4a1i3j2WBA:HIZrH1gO23rcYb85sBoMKXWBzmdVzP+W
MD5:	CFF5C3EE7EA792805AF02F7E8C2A171E
SHA1:	04EA7E160B2D6581D1A8C0B5D6472D73EBB1EC1C
SHA-256:	91FBB25F358C959BF1BF3537C8AF4618691358B49C3F19E4892BFF5BDCABC5E5
SHA-512:	3B08666C2990CBF0F3697E33833AC7835C6CA09816B07F322AA7304BBFEE5322A93B5B43F0879C349D17A983DE97044A84A02479875FA242833BA703F9790D13
Malicious:	true
Preview:	.l....jB.n..$\|....+Sc.C..e.....V.q.....=......\2t.N%........U..t7H.4.x...w.+Zl.poB...1.x..P....P.0\.K$.W..[..Ul~...Wy...+..^..9e...~.....k....X2...t}.8.H..$...~_Hk.8D.l.p.W..}.K......h.Bc....ct$O........(....E.v..5g.&%.9..T..7?wz~.c.w.0..J...JD..<Lk....H..%...P.g.9.>e.GL.;+..i<.%U..R..'..........x.6?......G..`.'.......'G_..-....L.S..Y.....K... E..1].Pu....!..Ah.....R..$....:..l.(>..[...s2dV.c......R.Y........A....O..!z.-.7.s.Y...FQ.Liz./% ....9. ..B.x:`'{.-..s...g..N..4'..?.....J.....&...C* ..E.2p.Kn...._.nY8e..-...gtTg....~...I....7F6.._...g..b..p(s.B...aw......].te.D ..I...<.,..uZ.6@@.....?.[..t.a%0...Jx..-]f....u..@g.Y.J.."J....c...O.. x.T....7..e./-...V..h%U......:.uy..\|;......'.?...A..h.(...g...F=e.........Q.....K..k........6......Un..K....;.}.A.;.i7b..H_.$q.N..+G..tA7..9...X.[.-d...E....rI...y&...._H\|cN...5f.3/....jD.B.<.-.em...x.~U.X=n=L.=.9...MI..0R^.....h^..(..@....30.t.08.E.....T9.U.}..@~4)=*.jP.R.......P.H..).;f.Zo...m.R=

C:\Users\user\Desktop\Excel 2016.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.935907096175898
Encrypted:	false
SSDEEP:	48:Ax1pUXPcexpdA9T+Pv9ZOEis4TNQn6XO5XmUGERv26h6iS7l122W/uG:a1pU/JdPStxe5mUL26h6iGv22euG
MD5:	E717376041DF4F8A088026EA6482F282
SHA1:	E894A8567D9D472E2F533641CA10157D8756F5CF
SHA-256:	49D3010E95BADFDCA3911D8A11EB95D220599A2CD2D16394859734AC66130BD0
SHA-512:	96EAF487F8F0910D7D1B0DB6DD2EA08FE697AA5196216ACC2659172A056FC55A441B65CB3D51F8B5D6115F94FFD288BC693F719C970D9FC34612E86BC903960F
Malicious:	false
Preview:	..:..-%....cz.:.?+....\|\|`....?.%Yv.r[. k<:C...o.nY....vq..-p2..k.Z.......n...}r..F7.?...O...`..86..v1..l'.,.f&.j...B7....#H.bww.P.w.Hd&....KYrA..-..{x..(W.n^..Z..U8.g.a..x.....6..P\|2.Mt...%..q.s0s$1.+..d.!.e.........\....n._.......T.w)..N%.....GOAM.r.P..k.s.@....?..2.-.-...U...#.,.t.?X......;.$va...U9..3.AspS3i...Sb..&I.h....\.5...z~...`....k..<..'.v..>.Mj."c..P>...^.52.e}i..i#.......q..[...^..o'P..$Y}........qT..3....op....oY......R4\|....,<c m.. ..9.L{~."^..(....u.~.,..x..p....t........C.......]0EG..7z.c.)6....Iv.C\|y;..EeZ.4v.V.A....[..O\.....\u$...G.S.(..uW........9.l....2.=....~..T.....&.QhvT .......d.34^..X.1.b.j..:...~.8a.......@l.....W..i.....9.#...\.a)...:..7..... ....K..E..o..d\.._R.......1xB>.4..../........B...k..$zal.m.KN...q..&P[.......>......p.\|\|Mn?4\V.?....`...V7t...#.=M.$..%...hX...9.\|.....Q.....q.\...N$.....7%.t....TT....>).{..<.0m.....9b1.u.-sJ...s2.k...y......l....;..c.q.Mr..N)V.......P...@..,..w.."....h...g....

C:\Users\user\Desktop\GLTYDMDUST.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.824791473232009
Encrypted:	false
SSDEEP:	24:xoZrA87yirGs9yU9YheFOL9zoBWbm2nILKVSs/zSJi5l7:xFmyqGs9yU9obZcWbjILNs/ziS
MD5:	3EFE0D10584AA7B06A6682DAAEE70AEB
SHA1:	1E4E5108E45671821FFBE706E1FDB1AEAA15BDA2
SHA-256:	609B04E6B20203B5F30947AD51224D15381FB309CF8E2CC5BC8A54F38EB670E6
SHA-512:	F91949EAE088FE68794F83B40F8C52A8236AF148FFD0230E74EA1227F2EAFB8FA4A8DB3209F751D32ED3AB9D4EA3DCFC2A2765E3F94A3F64C88E331D574E4B34
Malicious:	false
Preview:	..v......'^._.Pvp.P?...........p.t..9.D... .#...9.b/...U.._j....../.>J..H:.3.{......}.V....G.A...E..#=.q.ya.R;.`....d..u........O....I.k.+.k~.GU...$b"...N.G\...e2-..Ew... ..D.xk....I6...x.'L.-.f...E4LYV.V..{.$m...3.Gd..E....<.CM...5.5..h3...}k...\|...72+.,..W...1.05...0k.y....'?Y...5.R...D".fD...`K....-7....%t\|...c%.....4....O;.....%!xc.......N.y.sW...F..!)..~.9......{.....GfM.X{.{.,=3.A.2.@.J.2..D<.....%y...!....=..A.......~.Ui.z..>\2.1........xJ.#....../.Z..M.Ra9.0 ....B..0S....zF..0.D....V...p..#..F.f..Cc....C.bU.m.<&4.>.n.....i.42.nY.B.P....+g.z.!....'..9rh.aB.p...}9<8..<....L_h..>5.U@...#.'...O..rr.h._.>4...76.......nB..#... y$..>U!...h....U..k.x.....,.$.H..Dj.=..(.b."W...z.9.L.R.=.Gw.P.p.i!_n..\|...m1B......!{.u.j...].)m..Q.}t.4.~}.X...h.4.s....YuA...B`/:./.h..N7..Qe.i.!8.knb.2K...!.=.......HJ.+o....l.....$X...... yR...PUz..,...^Eu...='.\.)..G.\|.\rNS..Q}/8.z...P..K... .E!W..0.W5..Z.9.s .($s~.7_,..._....D.....t,h.z.....E...Sq.@F.\|qb^t...#..]

C:\Users\user\Desktop\HMPPSXQPQV.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Desktop\HMPPSXQPQV.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Desktop\HQJBRDYKDE.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79422921182211
Encrypted:	false
SSDEEP:	24:gJvItjKdUQfxOWX7YAI8kcaxcM271PagWT++nHn1RwnV8qaxQjuspb:MvCyUQ0AYGkca6BoTNbMV8qaGjuspb
MD5:	391CF08F846589B3AE577C74AD99E0B5
SHA1:	5D4970A5E1E6ABA439B8C88BA04BBA28DDC267DF
SHA-256:	5B3D4AA66D1797065FCB9B5177C168188B2F8C43432ED11374FAFD1D2876211E
SHA-512:	D4D5219ECFA51BD3C0D647CB6BDDED13FC286BF9396A3FFA1D199B04BE399BF275298B8CA0B9026EAFAFB770086463800BB1C6DD4F74CA4B62C4616293DB30A6
Malicious:	false
Preview:	..#g.....y&.\|.R.0..g..y..:..S.tx5.....o..........V.P.n..zU.R,.6..y".<$_...ZUQ.6......J..@...cr.f....\FX.t....>7...I.g..#.u.8..".N3L.k..J...\k..V.\|{#.&gM......1.6...fx..V`..f..4.....B.6-....A)...{Q.....(..[De.i{..........,@..T......h!^+>..B...../....J..{..=k.F(.U~b..(....-..gf#..~.Sj..Rq....^..."V..+3......[G.....`...(...xp..fr..&._. A.Z.........5....y....5&.9 .i@......:# ... PO.{=61h..;..;.....S..8.M........i.{.yc..............}.4..v....L..?.~.`.!C. .L....+..c.F.h1...../.y...XE........l..1..3...%......w...:.g.\|......y.....N,.3.Q.6.n..LI1....)....%........kUt.g#T+.(Fg3.8etv..;w.......9{...$.(4.]...j.NVs.v.9VP...g0...g'.a.<..q..`U....f;...^.3k..A....{Kp..........q..&.2..lI...%.......`.LW.K~.?x...v.V..N.\|.V........=&....y...._.....HY...pV-.. ...M.n..e..TMy%.C..D..;......6..qbk>..o...R.V...h...}...t....u..q.o..a.G..^.<...6 . ...R.k.@a>"......3...7~.K.cl.=.......1`.....a.9.U.......'Q'.B.5Y...q.H.....<U...`...../..\| .. WK...LP......

C:\Users\user\Desktop\JDDHMPCDUJ.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Desktop\JDDHMPCDUJ.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Desktop\JDDHMPCDUJ\GLTYDMDUST.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.824791473232009
Encrypted:	false
SSDEEP:	24:xoZrA87yirGs9yU9YheFOL9zoBWbm2nILKVSs/zSJi5l7:xFmyqGs9yU9obZcWbjILNs/ziS
MD5:	3EFE0D10584AA7B06A6682DAAEE70AEB
SHA1:	1E4E5108E45671821FFBE706E1FDB1AEAA15BDA2
SHA-256:	609B04E6B20203B5F30947AD51224D15381FB309CF8E2CC5BC8A54F38EB670E6
SHA-512:	F91949EAE088FE68794F83B40F8C52A8236AF148FFD0230E74EA1227F2EAFB8FA4A8DB3209F751D32ED3AB9D4EA3DCFC2A2765E3F94A3F64C88E331D574E4B34
Malicious:	false
Preview:	..v......'^._.Pvp.P?...........p.t..9.D... .#...9.b/...U.._j....../.>J..H:.3.{......}.V....G.A...E..#=.q.ya.R;.`....d..u........O....I.k.+.k~.GU...$b"...N.G\...e2-..Ew... ..D.xk....I6...x.'L.-.f...E4LYV.V..{.$m...3.Gd..E....<.CM...5.5..h3...}k...\|...72+.,..W...1.05...0k.y....'?Y...5.R...D".fD...`K....-7....%t\|...c%.....4....O;.....%!xc.......N.y.sW...F..!)..~.9......{.....GfM.X{.{.,=3.A.2.@.J.2..D<.....%y...!....=..A.......~.Ui.z..>\2.1........xJ.#....../.Z..M.Ra9.0 ....B..0S....zF..0.D....V...p..#..F.f..Cc....C.bU.m.<&4.>.n.....i.42.nY.B.P....+g.z.!....'..9rh.aB.p...}9<8..<....L_h..>5.U@...#.'...O..rr.h._.>4...76.......nB..#... y$..>U!...h....U..k.x.....,.$.H..Dj.=..(.b."W...z.9.L.R.=.Gw.P.p.i!_n..\|...m1B......!{.u.j...].)m..Q.}t.4.~}.X...h.4.s....YuA...B`/:./.h..N7..Qe.i.!8.knb.2K...!.=.......HJ.+o....l.....$X...... yR...PUz..,...^Eu...='.\.)..G.\|.\rNS..Q}/8.z...P..K... .E!W..0.W5..Z.9.s .($s~.7_,..._....D.....t,h.z.....E...Sq.@F.\|qb^t...#..]

C:\Users\user\Desktop\JDDHMPCDUJ\HMPPSXQPQV.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Desktop\JDDHMPCDUJ\JDDHMPCDUJ.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Desktop\JDDHMPCDUJ\LFOPODGVOH.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785895323765408
Encrypted:	false
SSDEEP:	24:MN27EBTCR86Iaz0NlFTfuyKfeZIGyjDbxzFY4SI:M87AuRBuBfuf2CGGOI
MD5:	C6BB1FF2B955E47911C5253781F6243B
SHA1:	5A6031323E824BD3C7D02B7038C5F530E732485F
SHA-256:	7C3E459E490BCFFFC9B6705E8D2F3D92FF96D76131ECD05956C9742860005E39
SHA-512:	D35A2B757344D8C4481542361EB129C517B90FD47D7EF8E3F84A4FA15A4CCD9C4F9B927E8655CBE4A528BF22A5FE861EDDE01408EE9D67D6646ADB6BBF30A16F
Malicious:	false
Preview:	...........H.DL..#...YN.....2e..B.U`j>..F.'WB.../..J..l].Tc5Yl.e..pa94.G..L{3..n.....U..3.X...l..#.Z..9T-......+u.m.....V.7..&..H.6>..P.l_..%._..yQN..k....o.....<r....AK.ZU8......q.t..[.,.LJ.H.g"...k..K....[..U.c...'iVjU.kd../..^.K.J].q@wIs.tj_."2...&.PE.a.T...#..~.'W..'.S=pHq%+.!..R....f.n.(..I..lJ..:_.!..r......r.,n.3.M).L1,_...H...`-[...X.^.._^a...{..=..`t...9.F.O^.c.lK....Y.t.i...x.......]...?#.`GJb-.=U8.Z....D.E.....a.....$.x.-(`....s...-(..,1.S{..Hh.O...C..k..i ..B......b+..;......BN..,..R`.O,.-..s.]..t9.^Y.}uv>.ii.....S]...1.j..{....]....mH............x.^ua=.B v..N.b..C`r..RN...r/.M6.y[./VC.<.....Z.%.0..W..d..v.S.......Vf..W..GE..UVF.-.. ..{8..H5....PFC.......lCJ.4a.=.`:...R..q..7..lY^..&...GW..Sn.@...1{M....k.....C..i.}...e......v\|.>.?.K6.f..Vh...2........0...F.$q.....^?,#3[..dR...3.e...i.#p..._."...{..a.......M!..v!...;...[...Tx>.7...05U...8.2.sW(..`2B.lj....'..d".....<..r...._. ..;...qA.7{gZ >("..H.....d.JS.=.B....N.P_..W.X.CL.$..k

C:\Users\user\Desktop\JDDHMPCDUJ\NWCXBPIUYI.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Desktop\JDDHMPCDUJ\NYMMPCEIMA.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Desktop\LFOPODGVOH.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785895323765408
Encrypted:	false
SSDEEP:	24:MN27EBTCR86Iaz0NlFTfuyKfeZIGyjDbxzFY4SI:M87AuRBuBfuf2CGGOI
MD5:	C6BB1FF2B955E47911C5253781F6243B
SHA1:	5A6031323E824BD3C7D02B7038C5F530E732485F
SHA-256:	7C3E459E490BCFFFC9B6705E8D2F3D92FF96D76131ECD05956C9742860005E39
SHA-512:	D35A2B757344D8C4481542361EB129C517B90FD47D7EF8E3F84A4FA15A4CCD9C4F9B927E8655CBE4A528BF22A5FE861EDDE01408EE9D67D6646ADB6BBF30A16F
Malicious:	false
Preview:	...........H.DL..#...YN.....2e..B.U`j>..F.'WB.../..J..l].Tc5Yl.e..pa94.G..L{3..n.....U..3.X...l..#.Z..9T-......+u.m.....V.7..&..H.6>..P.l_..%._..yQN..k....o.....<r....AK.ZU8......q.t..[.,.LJ.H.g"...k..K....[..U.c...'iVjU.kd../..^.K.J].q@wIs.tj_."2...&.PE.a.T...#..~.'W..'.S=pHq%+.!..R....f.n.(..I..lJ..:_.!..r......r.,n.3.M).L1,_...H...`-[...X.^.._^a...{..=..`t...9.F.O^.c.lK....Y.t.i...x.......]...?#.`GJb-.=U8.Z....D.E.....a.....$.x.-(`....s...-(..,1.S{..Hh.O...C..k..i ..B......b+..;......BN..,..R`.O,.-..s.]..t9.^Y.}uv>.ii.....S]...1.j..{....]....mH............x.^ua=.B v..N.b..C`r..RN...r/.M6.y[./VC.<.....Z.%.0..W..d..v.S.......Vf..W..GE..UVF.-.. ..{8..H5....PFC.......lCJ.4a.=.`:...R..q..7..lY^..&...GW..Sn.@...1{M....k.....C..i.}...e......v\|.>.?.K6.f..Vh...2........0...F.$q.....^?,#3[..dR...3.e...i.#p..._."...{..a.......M!..v!...;...[...Tx>.7...05U...8.2.sW(..`2B.lj....'..d".....<..r...._. ..;...qA.7{gZ >("..H.....d.JS.=.B....N.P_..W.X.CL.$..k

C:\Users\user\Desktop\Microsoft Edge.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1424
Entropy (8bit):	7.875315629924915
Encrypted:	false
SSDEEP:	24:A2zKdqvA4F2XUdiJAnybI++8sE6r7AMvhoaU70hn6jiXCB4eoZVkC2iap/ReDILx:A2zKdqrDovsE87AMJo0h6eXSoZVkQapr
MD5:	70BE09E4632CED399C34C07B2DF4819E
SHA1:	5AEA796E1ECFD2B392CD64A24FB4B6EFD4C7B274
SHA-256:	8B78164B24EFF514BC98CBB93D1954260A3A1D12B4227D13F4BE41039718114E
SHA-512:	C41609CB95C16F2E0E3DA0C2A957D548428976194535F992775D68648BB2CF31102A12ADA178BA1FEE93C40146E74B2670CDCC5A77C66CC2CAFD6D5B01E95FD0
Malicious:	false
Preview:	..:..-%....cz.:.SD...e....."...?R..A6:A..........Ab'.f..3..)..X..e..{......MSO..^.8.B...H.X..Q5..f.M...{....!.+.p.E%.._.$z.,^.p...^4\|.C.0C.Y.....68q"............,...O...r<.<Q[tl..~U.g.."....6.W.u'...W...x<`.} ..z.wGJ.u.%..`.A...~.....8.!.+...A....-\|.t..../8A....pC}....)J..JXU.z...U.....j.\q..l1.q..6..P..V...e....B.o..8G .<.tP`."l.q......mip..#...^12..=............w.8..SI3..M2.A...1...gR..fGPuz...l.,..[.....h..A.1...Y.<o...z?...,.......C.W[fu9W.dqx.?2.J....e%..~..wr.+S..?Ai.C.pJ..c........<.S.v...o.d.z....w..B...B21...I.b........5y.......`..mO....`o...\|I..)..[_3)D.K.HZ...5...K..R.=\|q...(.C^x.....&.i..x..N?.t.y8.m.H(t...AKn^...........{sp.#.e.7.wu..z'I....;....(...8...........z..O.....a....&>4..%.....W.G..YyJ.}m..g...cu.......o...i...K$.^8...2..ah.O......].8...B.>.3h..J..../....G..+...RS.&~.M.aD.3.....;}D.Z...-@...T.-.a......F(..[.../......U{8..........}4.0+..]:...\o.~...{.l.....$.[..a...f....[...._.&...j..g..C3.:j.J......

C:\Users\user\Desktop\NWCXBPIUYI.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Desktop\NWCXBPIUYI.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Desktop\NWCXBPIUYI.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Desktop\NYMMPCEIMA.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Desktop\NYMMPCEIMA.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Desktop\QCOILOQIKC.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Desktop\QCOILOQIKC.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Desktop\QCOILOQIKC\HMPPSXQPQV.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Desktop\QCOILOQIKC\HQJBRDYKDE.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79422921182211
Encrypted:	false
SSDEEP:	24:gJvItjKdUQfxOWX7YAI8kcaxcM271PagWT++nHn1RwnV8qaxQjuspb:MvCyUQ0AYGkca6BoTNbMV8qaGjuspb
MD5:	391CF08F846589B3AE577C74AD99E0B5
SHA1:	5D4970A5E1E6ABA439B8C88BA04BBA28DDC267DF
SHA-256:	5B3D4AA66D1797065FCB9B5177C168188B2F8C43432ED11374FAFD1D2876211E
SHA-512:	D4D5219ECFA51BD3C0D647CB6BDDED13FC286BF9396A3FFA1D199B04BE399BF275298B8CA0B9026EAFAFB770086463800BB1C6DD4F74CA4B62C4616293DB30A6
Malicious:	false
Preview:	..#g.....y&.\|.R.0..g..y..:..S.tx5.....o..........V.P.n..zU.R,.6..y".<$_...ZUQ.6......J..@...cr.f....\FX.t....>7...I.g..#.u.8..".N3L.k..J...\k..V.\|{#.&gM......1.6...fx..V`..f..4.....B.6-....A)...{Q.....(..[De.i{..........,@..T......h!^+>..B...../....J..{..=k.F(.U~b..(....-..gf#..~.Sj..Rq....^..."V..+3......[G.....`...(...xp..fr..&._. A.Z.........5....y....5&.9 .i@......:# ... PO.{=61h..;..;.....S..8.M........i.{.yc..............}.4..v....L..?.~.`.!C. .L....+..c.F.h1...../.y...XE........l..1..3...%......w...:.g.\|......y.....N,.3.Q.6.n..LI1....)....%........kUt.g#T+.(Fg3.8etv..;w.......9{...$.(4.]...j.NVs.v.9VP...g0...g'.a.<..q..`U....f;...^.3k..A....{Kp..........q..&.2..lI...%.......`.LW.K~.?x...v.V..N.\|.V........=&....y...._.....HY...pV-.. ...M.n..e..TMy%.C..D..;......6..qbk>..o...R.V...h...}...t....u..q.o..a.G..^.<...6 . ...R.k.@a>"......3...7~.K.cl.=.......1`.....a.9.U.......'Q'.B.5Y...q.H.....<U...`...../..\| .. WK...LP......

C:\Users\user\Desktop\QCOILOQIKC\NWCXBPIUYI.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Desktop\QCOILOQIKC\QCOILOQIKC.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Desktop\QCOILOQIKC\UNKRLCVOHV.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794474051474343
Encrypted:	false
SSDEEP:	24:bqqdou/x/0j32/d/QWI1BZWMTyvseWtSYk9z:bx/xPFbIkHv2sYk9z
MD5:	52FFCE6BF74C7E825CC4C99FCF9EB593
SHA1:	0692BF85BED0C03FBB97F82EA8CB3D9271EE8F53
SHA-256:	4CDF86F84C3A24C1F058196B9367A7B7B3D0601688599BEEEB73FAB82AE9F5F0
SHA-512:	113BB2D7D3D4DB98567D7061971898B1809800C9DB24AC5FFF7C8C9ACBEB6FD84D7C4634F5CCB48787B61EF85BA9AE6BA4DFEB0F0072C6A14551BFAB31340158
Malicious:	false
Preview:	...M.....OA.!e5...w`..I...k.P...+.lF......yvBSyT.}.X..Nf8.ID.D].w.Qy6.&6....&.;.9T.'.TL. ...X..oU...#.....9..r.._.T.9.w##~."x...JI.!.P..U..o._IX)q..lC..D.w-u...;_.K.....p.h.].cN..1B.1.z..8..;.....i..'....#._-.r.+#L..z!...A.D.,.-.....a.mRk\|_.....%ye..q)..1q.....v..xB.......{....\<.\.......,..MZA...dn..7\...VV..:.A9.8.......V2...(r...!E..U#D.~{../...)vH.E.......hH..\bxf..7U74,.5...+F.....9$..r.....1...4.ot.p)6.9y$z...)c.?....V\|..Mh.2._...M.....Iy^...T-.w..M.Qm..W.S(;....2uA.cH.B$."n..V..+~.d..F....C.3.5@.....:p.IF...L..V.V....X..5'..r+...wgO!:;?..r65(..>Xk.\.....w.-p...]..#....h.h.e..9c..RA......+....q..8......jx.fJ......f.7Sv.U..rw.. Pz..an.w.....:.Lbb.../.....".N[.`..{.?...ff..c..Lv...j,sz.J.**;....&.#B.M8..J1..v-.Qa.B....."....H....b..w.{c.."..J..L...Z..Cm..D..;..'.G+:\.aObg....P.:n...u.tU...u.H 1v.n.....$.wz.........t..m.4.P.........k..e.\...c..c.@.H;&..r......G...7P5.A#,a.1....9......h'o...X..w%...x.......T.:.W....f....i.j....._.G.+a.....

C:\Users\user\Desktop\QCOILOQIKC\WSHEJMDVQC.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79369625536087
Encrypted:	false
SSDEEP:	24:gNzccqE/rb0PlQcyfyXNVJbj1fnwwFBKub14iwU9zb9oU04Lf+gaxoIMadHI:8VqEyQcyfiNdPw0Iub/wUZTLfbcoIhdo
MD5:	DB96B117ACB142EB4754C080FABB8F79
SHA1:	BD18414D1F89ECB69CC077F7E9BD27A7ACD0C6BA
SHA-256:	6DC04F9E483F5FB1644A15DA0085F88C73ACE7E9CCE1AD7E54797AD0FDEC8A0F
SHA-512:	811321927B35BDBAFA349ABE00EE9B68EAC190535878BA82A9B49637A3A9017D6C9BB8C26E8183EA3109A3E416E1173AA7CFBDA80EADAE9B2F7264E84884258D
Malicious:	false
Preview:	m.../.M2..O..(..?...W.$H8...t...QX....\|Yk..J.G@r...%...7.. .i..X.3UQ............h.h.....R.7/.1yx;.Ps.....o.`.G:..G....Q...A.s.}..O[M.7.[..AE8.....3q.......'.O\|vl..3A......<.[.$`{..3.,%B...^.......5...<.....Z..Gx.+.d...z..>......G,'...86.5.onj#jl`{;)Z.A...=..G..'..)..N..L.....J...d:'V.?...t..-.3.X..$......'H.$jR9G...D.32....\..4..M......-....@.ug...Io.u..DH.....\|I.5I..DHRi.Y.....>.C.>.1=a.Q.......q.....s.m.`p...)[El..,[.=Q..r...q.jK.+..F.&....'o..`.a..s..$.W.W.v8..h..........dE.....0H.2A0..w~.....K........5..w.k...% ....A...LpZ.......l......U13.R...RY..:..E..T..]..S...m.........Wkw.4xydj.m.$..MV...>yY....]..........&./>..(.WZ.......)..BP.<..m.9.E.....?.......zP..L;.H..).Q.L.`.2,.E.[.H..xQF.<X.E.....[....+2.\|[...=t..B`.0>..k.B....-..o..fs...q.'....-t.V..}z`:.......x.....M...mfCf.B.~lg.%8.6..J..u.~...z.P.........j.).0A.E.QK......PMR_...g.T,K.iU&l.J....LO.28@.a.....T$...'..j.g.>`s<...hz.(...........g3....`G....$C....PO.7W}.

C:\Users\user\Desktop\TQDFJHPUIU.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785222258773929
Encrypted:	false
SSDEEP:	12:LkTovMcteQTK7zGp7ZbTrtjU+OAKqp/NC9q+72KEyvAN8csJ6STouWQnIpdATM1J:8ctDTndOi/oGKKiW/dUM1Z4xtBHoT
MD5:	BEC4D7E5DABDFDACBDBC0E1C97572826
SHA1:	C759B5047F963DFA9157759AEEEC4A6164188ED1
SHA-256:	81EE8843088660FCC099CE850937D169D60EE2A4129E29866640A51A9F31A238
SHA-512:	8F924BCF4C6E7FBD641A428294B66CDB1CF7CA0E896CEC4B827C2044C4E565D6FDD17A5776086007FED6D307F2CE5DA2014D4A856E7C59D413507AA882A754DD
Malicious:	false
Preview:	..u.......4...H.I..P'...].....AQ.....a...d.9.^j.:.........E.o(e....~.Y.......:.......;sj.&^.0.\.u.n.W..h@..\.t"...3q..j..T.(...f.........9....N....8..I?....;..J..z..?NdWV&P5H.L.XO...h.\|.a_o..Tp...;.6d..O......w.Z.j....Sz.......-.l..d.....n...#S[\......F?A....75%.....v}..g.....[..'.....}Lpo...6.4........\..^...P.XAd5.@...}.V.P...).....?a...:<.z&....1....9"t~..;......x..}.[8.[^zs.1..T&.d ~LG...j..I...D...>b.g..Bz....\|]9..!...d.6.7..6J....._{.....v.Y.. ....o.6....U.0N.c.s...Z'..>....p:./U....d.A...=..l....8<.....M.;Z.f.Z).=>.<.x.#~:.kS......W.d.R.N.E..A.1...J^K....SN.Q..<.)..hw.l...l......._.(..N..-2;^yx...&t...h......:...5`.O..........\|....EL..N.....-.Z.T..v):...C..)._.r..u..]t..G..~"].......a.[T.8s.Y\9Qr.d....h=.N.v...AF.....~doc.'.......e...E.Ab../xs...C...h`U.9a..j3M..h........Es(..;..01.V./.%..N.#....m.bE..2q.N...I.iq....4..G...W4N..-..z.E1 ..L.oj..F'...TbJ..e=.r..xq.....7.B.ka.i..J...9K....S.$.'.q.:..0~.15{.u...}.......1,[=..G..F.....

C:\Users\user\Desktop\TQDFJHPUIU\JDDHMPCDUJ.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Desktop\TQDFJHPUIU\NWCXBPIUYI.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Desktop\TQDFJHPUIU\NYMMPCEIMA.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Desktop\TQDFJHPUIU\QCOILOQIKC.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Desktop\TQDFJHPUIU\TQDFJHPUIU.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785222258773929
Encrypted:	false
SSDEEP:	12:LkTovMcteQTK7zGp7ZbTrtjU+OAKqp/NC9q+72KEyvAN8csJ6STouWQnIpdATM1J:8ctDTndOi/oGKKiW/dUM1Z4xtBHoT
MD5:	BEC4D7E5DABDFDACBDBC0E1C97572826
SHA1:	C759B5047F963DFA9157759AEEEC4A6164188ED1
SHA-256:	81EE8843088660FCC099CE850937D169D60EE2A4129E29866640A51A9F31A238
SHA-512:	8F924BCF4C6E7FBD641A428294B66CDB1CF7CA0E896CEC4B827C2044C4E565D6FDD17A5776086007FED6D307F2CE5DA2014D4A856E7C59D413507AA882A754DD
Malicious:	false
Preview:	..u.......4...H.I..P'...].....AQ.....a...d.9.^j.:.........E.o(e....~.Y.......:.......;sj.&^.0.\.u.n.W..h@..\.t"...3q..j..T.(...f.........9....N....8..I?....;..J..z..?NdWV&P5H.L.XO...h.\|.a_o..Tp...;.6d..O......w.Z.j....Sz.......-.l..d.....n...#S[\......F?A....75%.....v}..g.....[..'.....}Lpo...6.4........\..^...P.XAd5.@...}.V.P...).....?a...:<.z&....1....9"t~..;......x..}.[8.[^zs.1..T&.d ~LG...j..I...D...>b.g..Bz....\|]9..!...d.6.7..6J....._{.....v.Y.. ....o.6....U.0N.c.s...Z'..>....p:./U....d.A...=..l....8<.....M.;Z.f.Z).=>.<.x.#~:.kS......W.d.R.N.E..A.1...J^K....SN.Q..<.)..hw.l...l......._.(..N..-2;^yx...&t...h......:...5`.O..........\|....EL..N.....-.Z.T..v):...C..)._.r..u..]t..G..~"].......a.[T.8s.Y\9Qr.d....h=.N.v...AF.....~doc.'.......e...E.Ab../xs...C...h`U.9a..j3M..h........Es(..;..01.V./.%..N.#....m.bE..2q.N...I.iq....4..G...W4N..-..z.E1 ..L.oj..F'...TbJ..e=.r..xq.....7.B.ka.i..J...9K....S.$.'.q.:..0~.15{.u...}.......1,[=..G..F.....

C:\Users\user\Desktop\TQDFJHPUIU\ZIPXYXWIOY.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.814772270748105
Encrypted:	false
SSDEEP:	24:OTESQGNYs7GrnGUNl9OrioO1+ni1OKb7NNzQhyYn2dhH:OWYYsqrGUHCaf1O6ZRMnn2dV
MD5:	6B283536DE1E52491E78B45FDB15CD29
SHA1:	CD85E29D45584F3B04F43CB91CBE4B9353E1EF4B
SHA-256:	596A03D6D828E273C99AFD7877E45D263ABDF01BC8AC4F9912FA26DE2A5CE29C
SHA-512:	635C93D9C037AA0EB71B0D11E958F100FB42E5038B1D6DE50B0AD5443FF29FFE92E73ABC7434EF0F7FDE4A3E4BC55293054A4F47B87341F27A2CD5666BDD06FB
Malicious:	false
Preview:	...j*....U.B.ND..z..;q.t...wMD...6...7..>k...c.$.._.ClZ.y....Kp...vm1l...MW...Z.........P.,..,..Q.K4.x..R....yrg.`.L{..../;`.....U.^.-......Wjx..a...&..\|.]W.i1...e.@.rz.b.fA..T\|.G.........2...o{........t..2_.'.S....K!.....54. ;m.....z]9...8..Z...Q..h>..1.".c!w.2..L....~AG.'.."..8QB....<q_w...J.k..~...}..'@e.H....=Hw[)'....6....4._....Q..Z.._.4..7.3zF..W...va.ZG`.._........T.I.pG.P..b....s..&...s.g.y.T.k#..u...T.r.........J2F0...A/..,..&7V.._.].D..........4..\|d.R.....TrQEg@...).^....W......x"......N.....g.T6."GZ..;..O.........?.......z:ts..}.....q..D..?F....1.;.....VO...5......g.........b.n9.O.)e.....?..\|.)Xy...G.:4S...i.....U...[..\...H..i..?..G!.>.m.0.)..1,........U0w.o.....i..^h..3...iT.\|......dX...'....$..s.....(V.?.........[...}..K.....D.5......X.3..)..I....q..!p.?.uZ...+...$~.nRdH..8.g..6,MJ..`................H_4o....:/V......%&......t.mrs.I.D.M.wi...............r..Z^.E...o.Q...}}.....we..2......G..WMEL..7.q.\...Z.d.....w.

C:\Users\user\Desktop\UNKRLCVOHV.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794474051474343
Encrypted:	false
SSDEEP:	24:bqqdou/x/0j32/d/QWI1BZWMTyvseWtSYk9z:bx/xPFbIkHv2sYk9z
MD5:	52FFCE6BF74C7E825CC4C99FCF9EB593
SHA1:	0692BF85BED0C03FBB97F82EA8CB3D9271EE8F53
SHA-256:	4CDF86F84C3A24C1F058196B9367A7B7B3D0601688599BEEEB73FAB82AE9F5F0
SHA-512:	113BB2D7D3D4DB98567D7061971898B1809800C9DB24AC5FFF7C8C9ACBEB6FD84D7C4634F5CCB48787B61EF85BA9AE6BA4DFEB0F0072C6A14551BFAB31340158
Malicious:	false
Preview:	...M.....OA.!e5...w`..I...k.P...+.lF......yvBSyT.}.X..Nf8.ID.D].w.Qy6.&6....&.;.9T.'.TL. ...X..oU...#.....9..r.._.T.9.w##~."x...JI.!.P..U..o._IX)q..lC..D.w-u...;_.K.....p.h.].cN..1B.1.z..8..;.....i..'....#._-.r.+#L..z!...A.D.,.-.....a.mRk\|_.....%ye..q)..1q.....v..xB.......{....\<.\.......,..MZA...dn..7\...VV..:.A9.8.......V2...(r...!E..U#D.~{../...)vH.E.......hH..\bxf..7U74,.5...+F.....9$..r.....1...4.ot.p)6.9y$z...)c.?....V\|..Mh.2._...M.....Iy^...T-.w..M.Qm..W.S(;....2uA.cH.B$."n..V..+~.d..F....C.3.5@.....:p.IF...L..V.V....X..5'..r+...wgO!:;?..r65(..>Xk.\.....w.-p...]..#....h.h.e..9c..RA......+....q..8......jx.fJ......f.7Sv.U..rw.. Pz..an.w.....:.Lbb.../.....".N[.`..{.?...ff..c..Lv...j,sz.J.**;....&.#B.M8..J1..v-.Qa.B....."....H....b..w.{c.."..J..L...Z..Cm..D..;..'.G+:\.aObg....P.:n...u.tU...u.H 1v.n.....$.wz.........t..m.4.P.........k..e.\...c..c.@.H;&..r......G...7P5.A#,a.1....9......h'o...X..w%...x.......T.:.W....f....i.j....._.G.+a.....

C:\Users\user\Desktop\WSHEJMDVQC.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79369625536087
Encrypted:	false
SSDEEP:	24:gNzccqE/rb0PlQcyfyXNVJbj1fnwwFBKub14iwU9zb9oU04Lf+gaxoIMadHI:8VqEyQcyfiNdPw0Iub/wUZTLfbcoIhdo
MD5:	DB96B117ACB142EB4754C080FABB8F79
SHA1:	BD18414D1F89ECB69CC077F7E9BD27A7ACD0C6BA
SHA-256:	6DC04F9E483F5FB1644A15DA0085F88C73ACE7E9CCE1AD7E54797AD0FDEC8A0F
SHA-512:	811321927B35BDBAFA349ABE00EE9B68EAC190535878BA82A9B49637A3A9017D6C9BB8C26E8183EA3109A3E416E1173AA7CFBDA80EADAE9B2F7264E84884258D
Malicious:	false
Preview:	m.../.M2..O..(..?...W.$H8...t...QX....\|Yk..J.G@r...%...7.. .i..X.3UQ............h.h.....R.7/.1yx;.Ps.....o.`.G:..G....Q...A.s.}..O[M.7.[..AE8.....3q.......'.O\|vl..3A......<.[.$`{..3.,%B...^.......5...<.....Z..Gx.+.d...z..>......G,'...86.5.onj#jl`{;)Z.A...=..G..'..)..N..L.....J...d:'V.?...t..-.3.X..$......'H.$jR9G...D.32....\..4..M......-....@.ug...Io.u..DH.....\|I.5I..DHRi.Y.....>.C.>.1=a.Q.......q.....s.m.`p...)[El..,[.=Q..r...q.jK.+..F.&....'o..`.a..s..$.W.W.v8..h..........dE.....0H.2A0..w~.....K........5..w.k...% ....A...LpZ.......l......U13.R...RY..:..E..T..]..S...m.........Wkw.4xydj.m.$..MV...>yY....]..........&./>..(.WZ.......)..BP.<..m.9.E.....?.......zP..L;.H..).Q.L.`.2,.E.[.H..xQF.<X.E.....[....+2.\|[...=t..B`.0>..k.B....-..o..fs...q.'....-t.V..}z`:.......x.....M...mfCf.B.~lg.%8.6..J..u.~...z.P.........j.).0A.E.QK......PMR_...g.T,K.iU&l.J....LO.28@.a.....T$...'..j.g.>`s<...hz.(...........g3....`G....$C....PO.7W}.

C:\Users\user\Desktop\Word 2016.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.9287936307427165
Encrypted:	false
SSDEEP:	48:Axv5vubVIVHKL1PRW/MoGWYvzaM4QdMAUen4Uc3BF5DA0MLdaw/pYQjjmnEQ:aR2bVmKL18BIzaoSFen433BfMLz/etEQ
MD5:	59B8F80BE5112D8994248DC0AC270C47
SHA1:	B0E719A444EC56392764EC5FF3A044C26ED29B00
SHA-256:	EC9EC918D4B1F64323560441D390329671243F40BB5F62032CD8E0CC19416D0D
SHA-512:	E3B6199101E81DA7F0E12FC26F295E1E1B6AB2F64053F7DB98EA95F081C0867054409BE38A7F6B2E83EEDD226F7AAE4F073937B8A99EB7722B43C816BF09BD51
Malicious:	false
Preview:	..:..-%....cz.:.?+....\|\|`....?.%Yv.r[. k<:C...o.nY....vq..-.......~...$R6.y...`......CW../.h..s.m..$.....F..i....j..[.".A..?(b,_`wXn.j2H..wD.....r7L0....)=\|U.H.......f....Q]..C...a..D..........P~.)}......\|.......v.%...YW.M..#.<.K.....z..'...q..[p>6^...\|_..@.5.y.J.5B!]....,.C^..,.V. .....dC...G..e..i....$......+@...u...64..kn....T..-.+m1......7...:Zn.l....?.T...2x...f.t.f.7s...0..hL.i0.s..41..c..l....lhl.....]..mG}..!)...a..&..p...]......41Q.\5........"..+..7...'.....2z.9..J..Rq.y.._..-".._$...,.J...YYL....{...0.F~WrV^D.]...G.s.UC&...v.....#..C.4........j..G!..s`]...z....`.iV.Y""^/8/.>.n..8.7.p!qq.BM.AI...JRu).@..4.....b..1..l.ae..mE..J...=.GP...w..<..h..J\....5..2r.....U]..`Q........)S...`.)..sB-...H6L=...Z]... .....O.{2.....>.y.....U..'...r..p.U..:.H.(..=/v..hW...Y. ..x]\...u..N.Zr.4...4f.:tW.t..Oq"..H\|..6=/..[.f.):V..X........t.+`.fG/...,q..Q+....u....1*)...cR..'.f]......6.ynZiK..(.;...C.c...WJ.-.hxY......0f o-.}..\|.....3.<\|.

C:\Users\user\Desktop\ZIPXYXWIOY.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.814772270748105
Encrypted:	false
SSDEEP:	24:OTESQGNYs7GrnGUNl9OrioO1+ni1OKb7NNzQhyYn2dhH:OWYYsqrGUHCaf1O6ZRMnn2dV
MD5:	6B283536DE1E52491E78B45FDB15CD29
SHA1:	CD85E29D45584F3B04F43CB91CBE4B9353E1EF4B
SHA-256:	596A03D6D828E273C99AFD7877E45D263ABDF01BC8AC4F9912FA26DE2A5CE29C
SHA-512:	635C93D9C037AA0EB71B0D11E958F100FB42E5038B1D6DE50B0AD5443FF29FFE92E73ABC7434EF0F7FDE4A3E4BC55293054A4F47B87341F27A2CD5666BDD06FB
Malicious:	false
Preview:	...j*....U.B.ND..z..;q.t...wMD...6...7..>k...c.$.._.ClZ.y....Kp...vm1l...MW...Z.........P.,..,..Q.K4.x..R....yrg.`.L{..../;`.....U.^.-......Wjx..a...&..\|.]W.i1...e.@.rz.b.fA..T\|.G.........2...o{........t..2_.'.S....K!.....54. ;m.....z]9...8..Z...Q..h>..1.".c!w.2..L....~AG.'.."..8QB....<q_w...J.k..~...}..'@e.H....=Hw[)'....6....4._....Q..Z.._.4..7.3zF..W...va.ZG`.._........T.I.pG.P..b....s..&...s.g.y.T.k#..u...T.r.........J2F0...A/..,..&7V.._.].D..........4..\|d.R.....TrQEg@...).^....W......x"......N.....g.T6."GZ..;..O.........?.......z:ts..}.....q..D..?F....1.;.....VO...5......g.........b.n9.O.)e.....?..\|.)Xy...G.:4S...i.....U...[..\...H..i..?..G!.>.m.0.)..1,........U0w.o.....i..^h..3...iT.\|......dX...'....$..s.....(V.?.........[...}..K.....D.5......X.3..)..I....q..!p.?.uZ...+...$~.nRdH..8.g..6,MJ..`................H_4o....:/V......%&......t.mrs.I.D.M.wi...............r..Z^.E...o.Q...}}.....we..2......G..WMEL..7.q.\...Z.d.....w.

C:\Users\user\Desktop\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	7.213895206300656
Encrypted:	false
SSDEEP:	6:WKJfsGQSMd4FoSfUyI8TLoFlN/r4opkerQueJ2jOxL+02BxOy2VGLHsnp9fn:W9GQS+4qSsyI8TkFT46rleOOl+iyzLHI
MD5:	581528A3EC963B2996E54EF2D92262F9
SHA1:	A9F56071FAE273EF28F065C9A8F59E0B4508403B
SHA-256:	9888AF607A5483CA87BB2B94E97C8A9629FADD5D426E584A4A94D39EB05B82E3
SHA-512:	45E5B9113531962959B1A6001A74CF92BE68EBD6CCE3ACDEE1A821C9606BF71F1A9F1FE5CBFEFA837D4DFFF90E655E6CA0F06827EA4A5E1A2FEDC7C9CC93E176
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f..5CrE..H....L...){.....Cr.6.....,E..;5>...sb....{.0.../r.k.c....m)P.#..\|..+UK.....6{*..4...b...(..Z-.B5......`B.X.P..NW~.

C:\Users\user\Documents\GLTYDMDUST.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.824791473232009
Encrypted:	false
SSDEEP:	24:xoZrA87yirGs9yU9YheFOL9zoBWbm2nILKVSs/zSJi5l7:xFmyqGs9yU9obZcWbjILNs/ziS
MD5:	3EFE0D10584AA7B06A6682DAAEE70AEB
SHA1:	1E4E5108E45671821FFBE706E1FDB1AEAA15BDA2
SHA-256:	609B04E6B20203B5F30947AD51224D15381FB309CF8E2CC5BC8A54F38EB670E6
SHA-512:	F91949EAE088FE68794F83B40F8C52A8236AF148FFD0230E74EA1227F2EAFB8FA4A8DB3209F751D32ED3AB9D4EA3DCFC2A2765E3F94A3F64C88E331D574E4B34
Malicious:	false
Preview:	..v......'^._.Pvp.P?...........p.t..9.D... .#...9.b/...U.._j....../.>J..H:.3.{......}.V....G.A...E..#=.q.ya.R;.`....d..u........O....I.k.+.k~.GU...$b"...N.G\...e2-..Ew... ..D.xk....I6...x.'L.-.f...E4LYV.V..{.$m...3.Gd..E....<.CM...5.5..h3...}k...\|...72+.,..W...1.05...0k.y....'?Y...5.R...D".fD...`K....-7....%t\|...c%.....4....O;.....%!xc.......N.y.sW...F..!)..~.9......{.....GfM.X{.{.,=3.A.2.@.J.2..D<.....%y...!....=..A.......~.Ui.z..>\2.1........xJ.#....../.Z..M.Ra9.0 ....B..0S....zF..0.D....V...p..#..F.f..Cc....C.bU.m.<&4.>.n.....i.42.nY.B.P....+g.z.!....'..9rh.aB.p...}9<8..<....L_h..>5.U@...#.'...O..rr.h._.>4...76.......nB..#... y$..>U!...h....U..k.x.....,.$.H..Dj.=..(.b."W...z.9.L.R.=.Gw.P.p.i!_n..\|...m1B......!{.u.j...].)m..Q.}t.4.~}.X...h.4.s....YuA...B`/:./.h..N7..Qe.i.!8.knb.2K...!.=.......HJ.+o....l.....$X...... yR...PUz..,...^Eu...='.\.)..G.\|.\rNS..Q}/8.z...P..K... .E!W..0.W5..Z.9.s .($s~.7_,..._....D.....t,h.z.....E...Sq.@F.\|qb^t...#..]

C:\Users\user\Documents\HMPPSXQPQV.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Documents\HMPPSXQPQV.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Documents\HQJBRDYKDE.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79422921182211
Encrypted:	false
SSDEEP:	24:gJvItjKdUQfxOWX7YAI8kcaxcM271PagWT++nHn1RwnV8qaxQjuspb:MvCyUQ0AYGkca6BoTNbMV8qaGjuspb
MD5:	391CF08F846589B3AE577C74AD99E0B5
SHA1:	5D4970A5E1E6ABA439B8C88BA04BBA28DDC267DF
SHA-256:	5B3D4AA66D1797065FCB9B5177C168188B2F8C43432ED11374FAFD1D2876211E
SHA-512:	D4D5219ECFA51BD3C0D647CB6BDDED13FC286BF9396A3FFA1D199B04BE399BF275298B8CA0B9026EAFAFB770086463800BB1C6DD4F74CA4B62C4616293DB30A6
Malicious:	false
Preview:	..#g.....y&.\|.R.0..g..y..:..S.tx5.....o..........V.P.n..zU.R,.6..y".<$_...ZUQ.6......J..@...cr.f....\FX.t....>7...I.g..#.u.8..".N3L.k..J...\k..V.\|{#.&gM......1.6...fx..V`..f..4.....B.6-....A)...{Q.....(..[De.i{..........,@..T......h!^+>..B...../....J..{..=k.F(.U~b..(....-..gf#..~.Sj..Rq....^..."V..+3......[G.....`...(...xp..fr..&._. A.Z.........5....y....5&.9 .i@......:# ... PO.{=61h..;..;.....S..8.M........i.{.yc..............}.4..v....L..?.~.`.!C. .L....+..c.F.h1...../.y...XE........l..1..3...%......w...:.g.\|......y.....N,.3.Q.6.n..LI1....)....%........kUt.g#T+.(Fg3.8etv..;w.......9{...$.(4.]...j.NVs.v.9VP...g0...g'.a.<..q..`U....f;...^.3k..A....{Kp..........q..&.2..lI...%.......`.LW.K~.?x...v.V..N.\|.V........=&....y...._.....HY...pV-.. ...M.n..e..TMy%.C..D..;......6..qbk>..o...R.V...h...}...t....u..q.o..a.G..^.<...6 . ...R.k.@a>"......3...7~.K.cl.=.......1`.....a.9.U.......'Q'.B.5Y...q.H.....<U...`...../..\| .. WK...LP......

C:\Users\user\Documents\JDDHMPCDUJ.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Documents\JDDHMPCDUJ.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Documents\JDDHMPCDUJ\GLTYDMDUST.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.824791473232009
Encrypted:	false
SSDEEP:	24:xoZrA87yirGs9yU9YheFOL9zoBWbm2nILKVSs/zSJi5l7:xFmyqGs9yU9obZcWbjILNs/ziS
MD5:	3EFE0D10584AA7B06A6682DAAEE70AEB
SHA1:	1E4E5108E45671821FFBE706E1FDB1AEAA15BDA2
SHA-256:	609B04E6B20203B5F30947AD51224D15381FB309CF8E2CC5BC8A54F38EB670E6
SHA-512:	F91949EAE088FE68794F83B40F8C52A8236AF148FFD0230E74EA1227F2EAFB8FA4A8DB3209F751D32ED3AB9D4EA3DCFC2A2765E3F94A3F64C88E331D574E4B34
Malicious:	false
Preview:	..v......'^._.Pvp.P?...........p.t..9.D... .#...9.b/...U.._j....../.>J..H:.3.{......}.V....G.A...E..#=.q.ya.R;.`....d..u........O....I.k.+.k~.GU...$b"...N.G\...e2-..Ew... ..D.xk....I6...x.'L.-.f...E4LYV.V..{.$m...3.Gd..E....<.CM...5.5..h3...}k...\|...72+.,..W...1.05...0k.y....'?Y...5.R...D".fD...`K....-7....%t\|...c%.....4....O;.....%!xc.......N.y.sW...F..!)..~.9......{.....GfM.X{.{.,=3.A.2.@.J.2..D<.....%y...!....=..A.......~.Ui.z..>\2.1........xJ.#....../.Z..M.Ra9.0 ....B..0S....zF..0.D....V...p..#..F.f..Cc....C.bU.m.<&4.>.n.....i.42.nY.B.P....+g.z.!....'..9rh.aB.p...}9<8..<....L_h..>5.U@...#.'...O..rr.h._.>4...76.......nB..#... y$..>U!...h....U..k.x.....,.$.H..Dj.=..(.b."W...z.9.L.R.=.Gw.P.p.i!_n..\|...m1B......!{.u.j...].)m..Q.}t.4.~}.X...h.4.s....YuA...B`/:./.h..N7..Qe.i.!8.knb.2K...!.=.......HJ.+o....l.....$X...... yR...PUz..,...^Eu...='.\.)..G.\|.\rNS..Q}/8.z...P..K... .E!W..0.W5..Z.9.s .($s~.7_,..._....D.....t,h.z.....E...Sq.@F.\|qb^t...#..]

C:\Users\user\Documents\JDDHMPCDUJ\HMPPSXQPQV.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Documents\JDDHMPCDUJ\JDDHMPCDUJ.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Documents\JDDHMPCDUJ\LFOPODGVOH.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785895323765408
Encrypted:	false
SSDEEP:	24:MN27EBTCR86Iaz0NlFTfuyKfeZIGyjDbxzFY4SI:M87AuRBuBfuf2CGGOI
MD5:	C6BB1FF2B955E47911C5253781F6243B
SHA1:	5A6031323E824BD3C7D02B7038C5F530E732485F
SHA-256:	7C3E459E490BCFFFC9B6705E8D2F3D92FF96D76131ECD05956C9742860005E39
SHA-512:	D35A2B757344D8C4481542361EB129C517B90FD47D7EF8E3F84A4FA15A4CCD9C4F9B927E8655CBE4A528BF22A5FE861EDDE01408EE9D67D6646ADB6BBF30A16F
Malicious:	false
Preview:	...........H.DL..#...YN.....2e..B.U`j>..F.'WB.../..J..l].Tc5Yl.e..pa94.G..L{3..n.....U..3.X...l..#.Z..9T-......+u.m.....V.7..&..H.6>..P.l_..%._..yQN..k....o.....<r....AK.ZU8......q.t..[.,.LJ.H.g"...k..K....[..U.c...'iVjU.kd../..^.K.J].q@wIs.tj_."2...&.PE.a.T...#..~.'W..'.S=pHq%+.!..R....f.n.(..I..lJ..:_.!..r......r.,n.3.M).L1,_...H...`-[...X.^.._^a...{..=..`t...9.F.O^.c.lK....Y.t.i...x.......]...?#.`GJb-.=U8.Z....D.E.....a.....$.x.-(`....s...-(..,1.S{..Hh.O...C..k..i ..B......b+..;......BN..,..R`.O,.-..s.]..t9.^Y.}uv>.ii.....S]...1.j..{....]....mH............x.^ua=.B v..N.b..C`r..RN...r/.M6.y[./VC.<.....Z.%.0..W..d..v.S.......Vf..W..GE..UVF.-.. ..{8..H5....PFC.......lCJ.4a.=.`:...R..q..7..lY^..&...GW..Sn.@...1{M....k.....C..i.}...e......v\|.>.?.K6.f..Vh...2........0...F.$q.....^?,#3[..dR...3.e...i.#p..._."...{..a.......M!..v!...;...[...Tx>.7...05U...8.2.sW(..`2B.lj....'..d".....<..r...._. ..;...qA.7{gZ >("..H.....d.JS.=.B....N.P_..W.X.CL.$..k

C:\Users\user\Documents\JDDHMPCDUJ\NWCXBPIUYI.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Documents\JDDHMPCDUJ\NYMMPCEIMA.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Documents\LFOPODGVOH.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785895323765408
Encrypted:	false
SSDEEP:	24:MN27EBTCR86Iaz0NlFTfuyKfeZIGyjDbxzFY4SI:M87AuRBuBfuf2CGGOI
MD5:	C6BB1FF2B955E47911C5253781F6243B
SHA1:	5A6031323E824BD3C7D02B7038C5F530E732485F
SHA-256:	7C3E459E490BCFFFC9B6705E8D2F3D92FF96D76131ECD05956C9742860005E39
SHA-512:	D35A2B757344D8C4481542361EB129C517B90FD47D7EF8E3F84A4FA15A4CCD9C4F9B927E8655CBE4A528BF22A5FE861EDDE01408EE9D67D6646ADB6BBF30A16F
Malicious:	false
Preview:	...........H.DL..#...YN.....2e..B.U`j>..F.'WB.../..J..l].Tc5Yl.e..pa94.G..L{3..n.....U..3.X...l..#.Z..9T-......+u.m.....V.7..&..H.6>..P.l_..%._..yQN..k....o.....<r....AK.ZU8......q.t..[.,.LJ.H.g"...k..K....[..U.c...'iVjU.kd../..^.K.J].q@wIs.tj_."2...&.PE.a.T...#..~.'W..'.S=pHq%+.!..R....f.n.(..I..lJ..:_.!..r......r.,n.3.M).L1,_...H...`-[...X.^.._^a...{..=..`t...9.F.O^.c.lK....Y.t.i...x.......]...?#.`GJb-.=U8.Z....D.E.....a.....$.x.-(`....s...-(..,1.S{..Hh.O...C..k..i ..B......b+..;......BN..,..R`.O,.-..s.]..t9.^Y.}uv>.ii.....S]...1.j..{....]....mH............x.^ua=.B v..N.b..C`r..RN...r/.M6.y[./VC.<.....Z.%.0..W..d..v.S.......Vf..W..GE..UVF.-.. ..{8..H5....PFC.......lCJ.4a.=.`:...R..q..7..lY^..&...GW..Sn.@...1{M....k.....C..i.}...e......v\|.>.?.K6.f..Vh...2........0...F.$q.....^?,#3[..dR...3.e...i.#p..._."...{..a.......M!..v!...;...[...Tx>.7...05U...8.2.sW(..`2B.lj....'..d".....<..r...._. ..;...qA.7{gZ >("..H.....d.JS.=.B....N.P_..W.X.CL.$..k

C:\Users\user\Documents\NWCXBPIUYI.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Documents\NWCXBPIUYI.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Documents\NWCXBPIUYI.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Documents\NYMMPCEIMA.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Documents\NYMMPCEIMA.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Documents\QCOILOQIKC.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Documents\QCOILOQIKC.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Documents\QCOILOQIKC\HMPPSXQPQV.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Documents\QCOILOQIKC\HQJBRDYKDE.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79422921182211
Encrypted:	false
SSDEEP:	24:gJvItjKdUQfxOWX7YAI8kcaxcM271PagWT++nHn1RwnV8qaxQjuspb:MvCyUQ0AYGkca6BoTNbMV8qaGjuspb
MD5:	391CF08F846589B3AE577C74AD99E0B5
SHA1:	5D4970A5E1E6ABA439B8C88BA04BBA28DDC267DF
SHA-256:	5B3D4AA66D1797065FCB9B5177C168188B2F8C43432ED11374FAFD1D2876211E
SHA-512:	D4D5219ECFA51BD3C0D647CB6BDDED13FC286BF9396A3FFA1D199B04BE399BF275298B8CA0B9026EAFAFB770086463800BB1C6DD4F74CA4B62C4616293DB30A6
Malicious:	false
Preview:	..#g.....y&.\|.R.0..g..y..:..S.tx5.....o..........V.P.n..zU.R,.6..y".<$_...ZUQ.6......J..@...cr.f....\FX.t....>7...I.g..#.u.8..".N3L.k..J...\k..V.\|{#.&gM......1.6...fx..V`..f..4.....B.6-....A)...{Q.....(..[De.i{..........,@..T......h!^+>..B...../....J..{..=k.F(.U~b..(....-..gf#..~.Sj..Rq....^..."V..+3......[G.....`...(...xp..fr..&._. A.Z.........5....y....5&.9 .i@......:# ... PO.{=61h..;..;.....S..8.M........i.{.yc..............}.4..v....L..?.~.`.!C. .L....+..c.F.h1...../.y...XE........l..1..3...%......w...:.g.\|......y.....N,.3.Q.6.n..LI1....)....%........kUt.g#T+.(Fg3.8etv..;w.......9{...$.(4.]...j.NVs.v.9VP...g0...g'.a.<..q..`U....f;...^.3k..A....{Kp..........q..&.2..lI...%.......`.LW.K~.?x...v.V..N.\|.V........=&....y...._.....HY...pV-.. ...M.n..e..TMy%.C..D..;......6..qbk>..o...R.V...h...}...t....u..q.o..a.G..^.<...6 . ...R.k.@a>"......3...7~.K.cl.=.......1`.....a.9.U.......'Q'.B.5Y...q.H.....<U...`...../..\| .. WK...LP......

C:\Users\user\Documents\QCOILOQIKC\NWCXBPIUYI.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Documents\QCOILOQIKC\QCOILOQIKC.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Documents\QCOILOQIKC\UNKRLCVOHV.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794474051474343
Encrypted:	false
SSDEEP:	24:bqqdou/x/0j32/d/QWI1BZWMTyvseWtSYk9z:bx/xPFbIkHv2sYk9z
MD5:	52FFCE6BF74C7E825CC4C99FCF9EB593
SHA1:	0692BF85BED0C03FBB97F82EA8CB3D9271EE8F53
SHA-256:	4CDF86F84C3A24C1F058196B9367A7B7B3D0601688599BEEEB73FAB82AE9F5F0
SHA-512:	113BB2D7D3D4DB98567D7061971898B1809800C9DB24AC5FFF7C8C9ACBEB6FD84D7C4634F5CCB48787B61EF85BA9AE6BA4DFEB0F0072C6A14551BFAB31340158
Malicious:	false
Preview:	...M.....OA.!e5...w`..I...k.P...+.lF......yvBSyT.}.X..Nf8.ID.D].w.Qy6.&6....&.;.9T.'.TL. ...X..oU...#.....9..r.._.T.9.w##~."x...JI.!.P..U..o._IX)q..lC..D.w-u...;_.K.....p.h.].cN..1B.1.z..8..;.....i..'....#._-.r.+#L..z!...A.D.,.-.....a.mRk\|_.....%ye..q)..1q.....v..xB.......{....\<.\.......,..MZA...dn..7\...VV..:.A9.8.......V2...(r...!E..U#D.~{../...)vH.E.......hH..\bxf..7U74,.5...+F.....9$..r.....1...4.ot.p)6.9y$z...)c.?....V\|..Mh.2._...M.....Iy^...T-.w..M.Qm..W.S(;....2uA.cH.B$."n..V..+~.d..F....C.3.5@.....:p.IF...L..V.V....X..5'..r+...wgO!:;?..r65(..>Xk.\.....w.-p...]..#....h.h.e..9c..RA......+....q..8......jx.fJ......f.7Sv.U..rw.. Pz..an.w.....:.Lbb.../.....".N[.`..{.?...ff..c..Lv...j,sz.J.**;....&.#B.M8..J1..v-.Qa.B....."....H....b..w.{c.."..J..L...Z..Cm..D..;..'.G+:\.aObg....P.:n...u.tU...u.H 1v.n.....$.wz.........t..m.4.P.........k..e.\...c..c.@.H;&..r......G...7P5.A#,a.1....9......h'o...X..w%...x.......T.:.W....f....i.j....._.G.+a.....

C:\Users\user\Documents\QCOILOQIKC\WSHEJMDVQC.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79369625536087
Encrypted:	false
SSDEEP:	24:gNzccqE/rb0PlQcyfyXNVJbj1fnwwFBKub14iwU9zb9oU04Lf+gaxoIMadHI:8VqEyQcyfiNdPw0Iub/wUZTLfbcoIhdo
MD5:	DB96B117ACB142EB4754C080FABB8F79
SHA1:	BD18414D1F89ECB69CC077F7E9BD27A7ACD0C6BA
SHA-256:	6DC04F9E483F5FB1644A15DA0085F88C73ACE7E9CCE1AD7E54797AD0FDEC8A0F
SHA-512:	811321927B35BDBAFA349ABE00EE9B68EAC190535878BA82A9B49637A3A9017D6C9BB8C26E8183EA3109A3E416E1173AA7CFBDA80EADAE9B2F7264E84884258D
Malicious:	false
Preview:	m.../.M2..O..(..?...W.$H8...t...QX....\|Yk..J.G@r...%...7.. .i..X.3UQ............h.h.....R.7/.1yx;.Ps.....o.`.G:..G....Q...A.s.}..O[M.7.[..AE8.....3q.......'.O\|vl..3A......<.[.$`{..3.,%B...^.......5...<.....Z..Gx.+.d...z..>......G,'...86.5.onj#jl`{;)Z.A...=..G..'..)..N..L.....J...d:'V.?...t..-.3.X..$......'H.$jR9G...D.32....\..4..M......-....@.ug...Io.u..DH.....\|I.5I..DHRi.Y.....>.C.>.1=a.Q.......q.....s.m.`p...)[El..,[.=Q..r...q.jK.+..F.&....'o..`.a..s..$.W.W.v8..h..........dE.....0H.2A0..w~.....K........5..w.k...% ....A...LpZ.......l......U13.R...RY..:..E..T..]..S...m.........Wkw.4xydj.m.$..MV...>yY....]..........&./>..(.WZ.......)..BP.<..m.9.E.....?.......zP..L;.H..).Q.L.`.2,.E.[.H..xQF.<X.E.....[....+2.\|[...=t..B`.0>..k.B....-..o..fs...q.'....-t.V..}z`:.......x.....M...mfCf.B.~lg.%8.6..J..u.~...z.P.........j.).0A.E.QK......PMR_...g.T,K.iU&l.J....LO.28@.a.....T$...'..j.g.>`s<...hz.(...........g3....`G....$C....PO.7W}.

C:\Users\user\Documents\TQDFJHPUIU.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785222258773929
Encrypted:	false
SSDEEP:	12:LkTovMcteQTK7zGp7ZbTrtjU+OAKqp/NC9q+72KEyvAN8csJ6STouWQnIpdATM1J:8ctDTndOi/oGKKiW/dUM1Z4xtBHoT
MD5:	BEC4D7E5DABDFDACBDBC0E1C97572826
SHA1:	C759B5047F963DFA9157759AEEEC4A6164188ED1
SHA-256:	81EE8843088660FCC099CE850937D169D60EE2A4129E29866640A51A9F31A238
SHA-512:	8F924BCF4C6E7FBD641A428294B66CDB1CF7CA0E896CEC4B827C2044C4E565D6FDD17A5776086007FED6D307F2CE5DA2014D4A856E7C59D413507AA882A754DD
Malicious:	false
Preview:	..u.......4...H.I..P'...].....AQ.....a...d.9.^j.:.........E.o(e....~.Y.......:.......;sj.&^.0.\.u.n.W..h@..\.t"...3q..j..T.(...f.........9....N....8..I?....;..J..z..?NdWV&P5H.L.XO...h.\|.a_o..Tp...;.6d..O......w.Z.j....Sz.......-.l..d.....n...#S[\......F?A....75%.....v}..g.....[..'.....}Lpo...6.4........\..^...P.XAd5.@...}.V.P...).....?a...:<.z&....1....9"t~..;......x..}.[8.[^zs.1..T&.d ~LG...j..I...D...>b.g..Bz....\|]9..!...d.6.7..6J....._{.....v.Y.. ....o.6....U.0N.c.s...Z'..>....p:./U....d.A...=..l....8<.....M.;Z.f.Z).=>.<.x.#~:.kS......W.d.R.N.E..A.1...J^K....SN.Q..<.)..hw.l...l......._.(..N..-2;^yx...&t...h......:...5`.O..........\|....EL..N.....-.Z.T..v):...C..)._.r..u..]t..G..~"].......a.[T.8s.Y\9Qr.d....h=.N.v...AF.....~doc.'.......e...E.Ab../xs...C...h`U.9a..j3M..h........Es(..;..01.V./.%..N.#....m.bE..2q.N...I.iq....4..G...W4N..-..z.E1 ..L.oj..F'...TbJ..e=.r..xq.....7.B.ka.i..J...9K....S.$.'.q.:..0~.15{.u...}.......1,[=..G..F.....

C:\Users\user\Documents\TQDFJHPUIU\JDDHMPCDUJ.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Documents\TQDFJHPUIU\NWCXBPIUYI.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Documents\TQDFJHPUIU\NYMMPCEIMA.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Documents\TQDFJHPUIU\QCOILOQIKC.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Documents\TQDFJHPUIU\TQDFJHPUIU.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785222258773929
Encrypted:	false
SSDEEP:	12:LkTovMcteQTK7zGp7ZbTrtjU+OAKqp/NC9q+72KEyvAN8csJ6STouWQnIpdATM1J:8ctDTndOi/oGKKiW/dUM1Z4xtBHoT
MD5:	BEC4D7E5DABDFDACBDBC0E1C97572826
SHA1:	C759B5047F963DFA9157759AEEEC4A6164188ED1
SHA-256:	81EE8843088660FCC099CE850937D169D60EE2A4129E29866640A51A9F31A238
SHA-512:	8F924BCF4C6E7FBD641A428294B66CDB1CF7CA0E896CEC4B827C2044C4E565D6FDD17A5776086007FED6D307F2CE5DA2014D4A856E7C59D413507AA882A754DD
Malicious:	false
Preview:	..u.......4...H.I..P'...].....AQ.....a...d.9.^j.:.........E.o(e....~.Y.......:.......;sj.&^.0.\.u.n.W..h@..\.t"...3q..j..T.(...f.........9....N....8..I?....;..J..z..?NdWV&P5H.L.XO...h.\|.a_o..Tp...;.6d..O......w.Z.j....Sz.......-.l..d.....n...#S[\......F?A....75%.....v}..g.....[..'.....}Lpo...6.4........\..^...P.XAd5.@...}.V.P...).....?a...:<.z&....1....9"t~..;......x..}.[8.[^zs.1..T&.d ~LG...j..I...D...>b.g..Bz....\|]9..!...d.6.7..6J....._{.....v.Y.. ....o.6....U.0N.c.s...Z'..>....p:./U....d.A...=..l....8<.....M.;Z.f.Z).=>.<.x.#~:.kS......W.d.R.N.E..A.1...J^K....SN.Q..<.)..hw.l...l......._.(..N..-2;^yx...&t...h......:...5`.O..........\|....EL..N.....-.Z.T..v):...C..)._.r..u..]t..G..~"].......a.[T.8s.Y\9Qr.d....h=.N.v...AF.....~doc.'.......e...E.Ab../xs...C...h`U.9a..j3M..h........Es(..;..01.V./.%..N.#....m.bE..2q.N...I.iq....4..G...W4N..-..z.E1 ..L.oj..F'...TbJ..e=.r..xq.....7.B.ka.i..J...9K....S.$.'.q.:..0~.15{.u...}.......1,[=..G..F.....

C:\Users\user\Documents\TQDFJHPUIU\ZIPXYXWIOY.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.814772270748105
Encrypted:	false
SSDEEP:	24:OTESQGNYs7GrnGUNl9OrioO1+ni1OKb7NNzQhyYn2dhH:OWYYsqrGUHCaf1O6ZRMnn2dV
MD5:	6B283536DE1E52491E78B45FDB15CD29
SHA1:	CD85E29D45584F3B04F43CB91CBE4B9353E1EF4B
SHA-256:	596A03D6D828E273C99AFD7877E45D263ABDF01BC8AC4F9912FA26DE2A5CE29C
SHA-512:	635C93D9C037AA0EB71B0D11E958F100FB42E5038B1D6DE50B0AD5443FF29FFE92E73ABC7434EF0F7FDE4A3E4BC55293054A4F47B87341F27A2CD5666BDD06FB
Malicious:	false
Preview:	...j*....U.B.ND..z..;q.t...wMD...6...7..>k...c.$.._.ClZ.y....Kp...vm1l...MW...Z.........P.,..,..Q.K4.x..R....yrg.`.L{..../;`.....U.^.-......Wjx..a...&..\|.]W.i1...e.@.rz.b.fA..T\|.G.........2...o{........t..2_.'.S....K!.....54. ;m.....z]9...8..Z...Q..h>..1.".c!w.2..L....~AG.'.."..8QB....<q_w...J.k..~...}..'@e.H....=Hw[)'....6....4._....Q..Z.._.4..7.3zF..W...va.ZG`.._........T.I.pG.P..b....s..&...s.g.y.T.k#..u...T.r.........J2F0...A/..,..&7V.._.].D..........4..\|d.R.....TrQEg@...).^....W......x"......N.....g.T6."GZ..;..O.........?.......z:ts..}.....q..D..?F....1.;.....VO...5......g.........b.n9.O.)e.....?..\|.)Xy...G.:4S...i.....U...[..\...H..i..?..G!.>.m.0.)..1,........U0w.o.....i..^h..3...iT.\|......dX...'....$..s.....(V.?.........[...}..K.....D.5......X.3..)..I....q..!p.?.uZ...+...$~.nRdH..8.g..6,MJ..`................H_4o....:/V......%&......t.mrs.I.D.M.wi...............r..Z^.E...o.Q...}}.....we..2......G..WMEL..7.q.\...Z.d.....w.

C:\Users\user\Documents\UNKRLCVOHV.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794474051474343
Encrypted:	false
SSDEEP:	24:bqqdou/x/0j32/d/QWI1BZWMTyvseWtSYk9z:bx/xPFbIkHv2sYk9z
MD5:	52FFCE6BF74C7E825CC4C99FCF9EB593
SHA1:	0692BF85BED0C03FBB97F82EA8CB3D9271EE8F53
SHA-256:	4CDF86F84C3A24C1F058196B9367A7B7B3D0601688599BEEEB73FAB82AE9F5F0
SHA-512:	113BB2D7D3D4DB98567D7061971898B1809800C9DB24AC5FFF7C8C9ACBEB6FD84D7C4634F5CCB48787B61EF85BA9AE6BA4DFEB0F0072C6A14551BFAB31340158
Malicious:	false
Preview:	...M.....OA.!e5...w`..I...k.P...+.lF......yvBSyT.}.X..Nf8.ID.D].w.Qy6.&6....&.;.9T.'.TL. ...X..oU...#.....9..r.._.T.9.w##~."x...JI.!.P..U..o._IX)q..lC..D.w-u...;_.K.....p.h.].cN..1B.1.z..8..;.....i..'....#._-.r.+#L..z!...A.D.,.-.....a.mRk\|_.....%ye..q)..1q.....v..xB.......{....\<.\.......,..MZA...dn..7\...VV..:.A9.8.......V2...(r...!E..U#D.~{../...)vH.E.......hH..\bxf..7U74,.5...+F.....9$..r.....1...4.ot.p)6.9y$z...)c.?....V\|..Mh.2._...M.....Iy^...T-.w..M.Qm..W.S(;....2uA.cH.B$."n..V..+~.d..F....C.3.5@.....:p.IF...L..V.V....X..5'..r+...wgO!:;?..r65(..>Xk.\.....w.-p...]..#....h.h.e..9c..RA......+....q..8......jx.fJ......f.7Sv.U..rw.. Pz..an.w.....:.Lbb.../.....".N[.`..{.?...ff..c..Lv...j,sz.J.**;....&.#B.M8..J1..v-.Qa.B....."....H....b..w.{c.."..J..L...Z..Cm..D..;..'.G+:\.aObg....P.:n...u.tU...u.H 1v.n.....$.wz.........t..m.4.P.........k..e.\...c..c.@.H;&..r......G...7P5.A#,a.1....9......h'o...X..w%...x.......T.:.W....f....i.j....._.G.+a.....

C:\Users\user\Documents\WSHEJMDVQC.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79369625536087
Encrypted:	false
SSDEEP:	24:gNzccqE/rb0PlQcyfyXNVJbj1fnwwFBKub14iwU9zb9oU04Lf+gaxoIMadHI:8VqEyQcyfiNdPw0Iub/wUZTLfbcoIhdo
MD5:	DB96B117ACB142EB4754C080FABB8F79
SHA1:	BD18414D1F89ECB69CC077F7E9BD27A7ACD0C6BA
SHA-256:	6DC04F9E483F5FB1644A15DA0085F88C73ACE7E9CCE1AD7E54797AD0FDEC8A0F
SHA-512:	811321927B35BDBAFA349ABE00EE9B68EAC190535878BA82A9B49637A3A9017D6C9BB8C26E8183EA3109A3E416E1173AA7CFBDA80EADAE9B2F7264E84884258D
Malicious:	false
Preview:	m.../.M2..O..(..?...W.$H8...t...QX....\|Yk..J.G@r...%...7.. .i..X.3UQ............h.h.....R.7/.1yx;.Ps.....o.`.G:..G....Q...A.s.}..O[M.7.[..AE8.....3q.......'.O\|vl..3A......<.[.$`{..3.,%B...^.......5...<.....Z..Gx.+.d...z..>......G,'...86.5.onj#jl`{;)Z.A...=..G..'..)..N..L.....J...d:'V.?...t..-.3.X..$......'H.$jR9G...D.32....\..4..M......-....@.ug...Io.u..DH.....\|I.5I..DHRi.Y.....>.C.>.1=a.Q.......q.....s.m.`p...)[El..,[.=Q..r...q.jK.+..F.&....'o..`.a..s..$.W.W.v8..h..........dE.....0H.2A0..w~.....K........5..w.k...% ....A...LpZ.......l......U13.R...RY..:..E..T..]..S...m.........Wkw.4xydj.m.$..MV...>yY....]..........&./>..(.WZ.......)..BP.<..m.9.E.....?.......zP..L;.H..).Q.L.`.2,.E.[.H..xQF.<X.E.....[....+2.\|[...=t..B`.0>..k.B....-..o..fs...q.'....-t.V..}z`:.......x.....M...mfCf.B.~lg.%8.6..J..u.~...z.P.........j.).0A.E.QK......PMR_...g.T,K.iU&l.J....LO.28@.a.....T$...'..j.g.>`s<...hz.(...........g3....`G....$C....PO.7W}.

C:\Users\user\Documents\ZIPXYXWIOY.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.814772270748105
Encrypted:	false
SSDEEP:	24:OTESQGNYs7GrnGUNl9OrioO1+ni1OKb7NNzQhyYn2dhH:OWYYsqrGUHCaf1O6ZRMnn2dV
MD5:	6B283536DE1E52491E78B45FDB15CD29
SHA1:	CD85E29D45584F3B04F43CB91CBE4B9353E1EF4B
SHA-256:	596A03D6D828E273C99AFD7877E45D263ABDF01BC8AC4F9912FA26DE2A5CE29C
SHA-512:	635C93D9C037AA0EB71B0D11E958F100FB42E5038B1D6DE50B0AD5443FF29FFE92E73ABC7434EF0F7FDE4A3E4BC55293054A4F47B87341F27A2CD5666BDD06FB
Malicious:	false
Preview:	...j*....U.B.ND..z..;q.t...wMD...6...7..>k...c.$.._.ClZ.y....Kp...vm1l...MW...Z.........P.,..,..Q.K4.x..R....yrg.`.L{..../;`.....U.^.-......Wjx..a...&..\|.]W.i1...e.@.rz.b.fA..T\|.G.........2...o{........t..2_.'.S....K!.....54. ;m.....z]9...8..Z...Q..h>..1.".c!w.2..L....~AG.'.."..8QB....<q_w...J.k..~...}..'@e.H....=Hw[)'....6....4._....Q..Z.._.4..7.3zF..W...va.ZG`.._........T.I.pG.P..b....s..&...s.g.y.T.k#..u...T.r.........J2F0...A/..,..&7V.._.].D..........4..\|d.R.....TrQEg@...).^....W......x"......N.....g.T6."GZ..;..O.........?.......z:ts..}.....q..D..?F....1.;.....VO...5......g.........b.n9.O.)e.....?..\|.)Xy...G.:4S...i.....U...[..\...H..i..?..G!.>.m.0.)..1,........U0w.o.....i..^h..3...iT.\|......dX...'....$..s.....(V.?.........[...}..K.....D.5......X.3..)..I....q..!p.?.uZ...+...$~.nRdH..8.g..6,MJ..`................H_4o....:/V......%&......t.mrs.I.D.M.wi...............r..Z^.E...o.Q...}}.....we..2......G..WMEL..7.q.\...Z.d.....w.

C:\Users\user\Documents\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.501476109106864
Encrypted:	false
SSDEEP:	12:W9GQS+4qSsyI8TkFT4F2UTBqACW+gIdoe0:W9HSRqSw810UYAC8Oo1
MD5:	CDE72BA79957DD1073F5E884E12D8DDE
SHA1:	357B62D8777E0E1B20F9617502357456402EEBB8
SHA-256:	0B9911959A2C1A71774F94E76DB997901894A48487007D11103E70D34EC34A85
SHA-512:	00D8AE01C38DBD5B280F705B0A8DACF6AFE2B08B5702D04ABAB236734AA31CA33865AE2AEF59471B5959745EA58620289ACAA8B7A7FDE8AAF4282A92C79EF7D3
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f..l.h........(.....k.Hk..3."..s..0k/..R+..H.../q.U.. ....HOA.[.[b.z.@O....!...K.=G.......I.2.<`.O.9~.....y..._.}.&h%[._..e...p.$k.z..8.....$...v...d.!BR..V..Z..j.V...v...O.E.&aT}..M......3:...w.*99G..Q..m.B$...d.......{M........N@.P....'..wfN`.....#.

C:\Users\user\Downloads\GLTYDMDUST.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.824791473232009
Encrypted:	false
SSDEEP:	24:xoZrA87yirGs9yU9YheFOL9zoBWbm2nILKVSs/zSJi5l7:xFmyqGs9yU9obZcWbjILNs/ziS
MD5:	3EFE0D10584AA7B06A6682DAAEE70AEB
SHA1:	1E4E5108E45671821FFBE706E1FDB1AEAA15BDA2
SHA-256:	609B04E6B20203B5F30947AD51224D15381FB309CF8E2CC5BC8A54F38EB670E6
SHA-512:	F91949EAE088FE68794F83B40F8C52A8236AF148FFD0230E74EA1227F2EAFB8FA4A8DB3209F751D32ED3AB9D4EA3DCFC2A2765E3F94A3F64C88E331D574E4B34
Malicious:	false
Preview:	..v......'^._.Pvp.P?...........p.t..9.D... .#...9.b/...U.._j....../.>J..H:.3.{......}.V....G.A...E..#=.q.ya.R;.`....d..u........O....I.k.+.k~.GU...$b"...N.G\...e2-..Ew... ..D.xk....I6...x.'L.-.f...E4LYV.V..{.$m...3.Gd..E....<.CM...5.5..h3...}k...\|...72+.,..W...1.05...0k.y....'?Y...5.R...D".fD...`K....-7....%t\|...c%.....4....O;.....%!xc.......N.y.sW...F..!)..~.9......{.....GfM.X{.{.,=3.A.2.@.J.2..D<.....%y...!....=..A.......~.Ui.z..>\2.1........xJ.#....../.Z..M.Ra9.0 ....B..0S....zF..0.D....V...p..#..F.f..Cc....C.bU.m.<&4.>.n.....i.42.nY.B.P....+g.z.!....'..9rh.aB.p...}9<8..<....L_h..>5.U@...#.'...O..rr.h._.>4...76.......nB..#... y$..>U!...h....U..k.x.....,.$.H..Dj.=..(.b."W...z.9.L.R.=.Gw.P.p.i!_n..\|...m1B......!{.u.j...].)m..Q.}t.4.~}.X...h.4.s....YuA...B`/:./.h..N7..Qe.i.!8.knb.2K...!.=.......HJ.+o....l.....$X...... yR...PUz..,...^Eu...='.\.)..G.\|.\rNS..Q}/8.z...P..K... .E!W..0.W5..Z.9.s .($s~.7_,..._....D.....t,h.z.....E...Sq.@F.\|qb^t...#..]

C:\Users\user\Downloads\HMPPSXQPQV.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Downloads\HMPPSXQPQV.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.81933747492778
Encrypted:	false
SSDEEP:	24:9ltHQDw3veahAcppUySQEClTsqJmUg1djb/5/VC0Tr7aDk:PtHYJIpUySQEC5wfjb/eGX
MD5:	696EB22D9A1AD06C6516BE8ED42CAB83
SHA1:	4EDD1746D942D80B1093952296DF2872593A37DD
SHA-256:	93CBCDFE238646724B2144C3022C314B1210C49F1ED3282470D3C62F0F42DCB7
SHA-512:	F3144DCD94BAF451FB8C036B301919CD89D6103427DB6F6F48720B549E142A4A7A4939A51CF75B3585B6882063DE0AD0D9AAB3AB9CEA4A4A546F0F17005065D8
Malicious:	false
Preview:	D.......mc...(.}.@...s.......rE.T.....B..l.T.,!..hROe..:<....4.i.;..e..3........iPO.:.#.T.8.u+..>U.~,%..9.A.9-U..j.(..w....T...t...C.T......$....../V...Dr.L.Pi%..6EV.gS.\|.c.Fl.H..`.(...T..uss...1\|..U.....U..8o..........i...... ...?..q.KAL..B>a........_c.7....7..o.98..'N.\.W..)........!KuX.D.oswz2m...'..'.......k..&.o.....c.Po3..:....g.>..i.&4....._!'1Q..eN...&-c8......]..kN..B...f..s....>%#.F.n6...[R.\..r..i.&.n.q.O.e.5d^..P....Q1....,%<v.S.p.....9.O.>.........Z......<.v..F...*b.b.... .S.P..^}l...r%.h....h...yiBM.P...5....86...f..J...G7E..\\3L.M.K.09sb.U......A....y..(+......4...V.91..c.g......4H..]..%.v.ZaN.$M5o...%.4.8..........tJd!@,...N..&W...z...<R..5R....K.....M.J..;Ej'.L......).I+..L....J..).........u....4..,5._Q#]..y.zt...y.....W.\|..w......l.N...?.....N.ouV.8.b.3.........@$.y.6.g../w0..........".nPb.../..z...j...6.....q..q...Yf.BMI.y..JL..MUHR@.3.u...qr...vsv@..k...@..h..Bl..az..1..........C.3.:.\].n.H..DYB..0..u....X.....@..f

C:\Users\user\Downloads\HQJBRDYKDE.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79422921182211
Encrypted:	false
SSDEEP:	24:gJvItjKdUQfxOWX7YAI8kcaxcM271PagWT++nHn1RwnV8qaxQjuspb:MvCyUQ0AYGkca6BoTNbMV8qaGjuspb
MD5:	391CF08F846589B3AE577C74AD99E0B5
SHA1:	5D4970A5E1E6ABA439B8C88BA04BBA28DDC267DF
SHA-256:	5B3D4AA66D1797065FCB9B5177C168188B2F8C43432ED11374FAFD1D2876211E
SHA-512:	D4D5219ECFA51BD3C0D647CB6BDDED13FC286BF9396A3FFA1D199B04BE399BF275298B8CA0B9026EAFAFB770086463800BB1C6DD4F74CA4B62C4616293DB30A6
Malicious:	false
Preview:	..#g.....y&.\|.R.0..g..y..:..S.tx5.....o..........V.P.n..zU.R,.6..y".<$_...ZUQ.6......J..@...cr.f....\FX.t....>7...I.g..#.u.8..".N3L.k..J...\k..V.\|{#.&gM......1.6...fx..V`..f..4.....B.6-....A)...{Q.....(..[De.i{..........,@..T......h!^+>..B...../....J..{..=k.F(.U~b..(....-..gf#..~.Sj..Rq....^..."V..+3......[G.....`...(...xp..fr..&._. A.Z.........5....y....5&.9 .i@......:# ... PO.{=61h..;..;.....S..8.M........i.{.yc..............}.4..v....L..?.~.`.!C. .L....+..c.F.h1...../.y...XE........l..1..3...%......w...:.g.\|......y.....N,.3.Q.6.n..LI1....)....%........kUt.g#T+.(Fg3.8etv..;w.......9{...$.(4.]...j.NVs.v.9VP...g0...g'.a.<..q..`U....f;...^.3k..A....{Kp..........q..&.2..lI...%.......`.LW.K~.?x...v.V..N.\|.V........=&....y...._.....HY...pV-.. ...M.n..e..TMy%.C..D..;......6..qbk>..o...R.V...h...}...t....u..q.o..a.G..^.<...6 . ...R.k.@a>"......3...7~.K.cl.=.......1`.....a.9.U.......'Q'.B.5Y...q.H.....<U...`...../..\| .. WK...LP......

C:\Users\user\Downloads\JDDHMPCDUJ.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Downloads\JDDHMPCDUJ.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.831439325266544
Encrypted:	false
SSDEEP:	24:ZLgJiZ32XDwmuSvjXHHCF2wkndlWTefqESMdd2lNgYzXK4WjykL0LO:VgsZG/uSvbHHCgRWCqEdslNBoyw0LO
MD5:	60C790FB8F423E6DAB6A498282B74AA4
SHA1:	441CFF3A881B1B065A4D2A868911DAFC5C2D9768
SHA-256:	252F1C98AFE3153301ED2519DC97C3BA9C81CE99B1FE6D301B846EB06B87A15D
SHA-512:	66892EF7548AF21007080C892D82F242A184A2DEA44AAEA91EE2ABC2707AA2A373E5CC4B98CCF4C4018DAB236C21D9970F6BD44614E5B8448EFCD4B005266B3E
Malicious:	false
Preview:	.s.{./W..o..A..t?H..Rn..+Ci.~..M.k.4..WdO..+..crK9..M../.e../......z..=.....A<.8..=;..R...^.nf......P..O...E....&....h.........Ci...:...9?].........SWG..[.?....}...6.2..........]U.H.c?9.v.r....mHC...RD...).aRh.......F...v#^.........6.!0.:.B..=...`.c]..".^.U7..$...P...bn......z..zb0.2x.R..0I.....y.....).....2...F..['..i ..-.2..[.H{.(E...y..?...h.._D.....\|.{v...WT......L7.........?8.e.q.l...In....u.9....y!....`.K.z'T...z......)....U......~.....I..E.....uqR0..O....2..t..P:....w},...eem-...Ol.h..^!.w!....R.f.@.&...L.;..k...t.<.L....s...@.....D.. .^.Z...N.@.\|...hpj...[wj.:t..z....]..@.t..S.!'%.;.....b.".).XSr.P0.^..1,....3..............]...\.3*C.........Wt..-6n....S......V-.D=._=3..0.-D...U...9.($..)..{h.j...] ...}.E..Ko..{B.D....Y..........X!s.[ C ....-....#..+0Q\|V...........p..4=+;.R.Hy....._9]!..O.P...._",....N..S........r..xM...p].%MV.:q.q.6.M..d.f..D.#..<...(.<.y....a.l.A..eW..#.T.k,lP....;...g.. <....2.C..oUq...VvX..IDV.9..<D>

C:\Users\user\Downloads\LFOPODGVOH.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785895323765408
Encrypted:	false
SSDEEP:	24:MN27EBTCR86Iaz0NlFTfuyKfeZIGyjDbxzFY4SI:M87AuRBuBfuf2CGGOI
MD5:	C6BB1FF2B955E47911C5253781F6243B
SHA1:	5A6031323E824BD3C7D02B7038C5F530E732485F
SHA-256:	7C3E459E490BCFFFC9B6705E8D2F3D92FF96D76131ECD05956C9742860005E39
SHA-512:	D35A2B757344D8C4481542361EB129C517B90FD47D7EF8E3F84A4FA15A4CCD9C4F9B927E8655CBE4A528BF22A5FE861EDDE01408EE9D67D6646ADB6BBF30A16F
Malicious:	false
Preview:	...........H.DL..#...YN.....2e..B.U`j>..F.'WB.../..J..l].Tc5Yl.e..pa94.G..L{3..n.....U..3.X...l..#.Z..9T-......+u.m.....V.7..&..H.6>..P.l_..%._..yQN..k....o.....<r....AK.ZU8......q.t..[.,.LJ.H.g"...k..K....[..U.c...'iVjU.kd../..^.K.J].q@wIs.tj_."2...&.PE.a.T...#..~.'W..'.S=pHq%+.!..R....f.n.(..I..lJ..:_.!..r......r.,n.3.M).L1,_...H...`-[...X.^.._^a...{..=..`t...9.F.O^.c.lK....Y.t.i...x.......]...?#.`GJb-.=U8.Z....D.E.....a.....$.x.-(`....s...-(..,1.S{..Hh.O...C..k..i ..B......b+..;......BN..,..R`.O,.-..s.]..t9.^Y.}uv>.ii.....S]...1.j..{....]....mH............x.^ua=.B v..N.b..C`r..RN...r/.M6.y[./VC.<.....Z.%.0..W..d..v.S.......Vf..W..GE..UVF.-.. ..{8..H5....PFC.......lCJ.4a.=.`:...R..q..7..lY^..&...GW..Sn.@...1{M....k.....C..i.}...e......v\|.>.?.K6.f..Vh...2........0...F.$q.....^?,#3[..dR...3.e...i.#p..._."...{..a.......M!..v!...;...[...Tx>.7...05U...8.2.sW(..`2B.lj....'..d".....<..r...._. ..;...qA.7{gZ >("..H.....d.JS.=.B....N.P_..W.X.CL.$..k

C:\Users\user\Downloads\NWCXBPIUYI.mp3.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Downloads\NWCXBPIUYI.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Downloads\NWCXBPIUYI.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.823395397661477
Encrypted:	false
SSDEEP:	24:GjY4wbz9ZE/T7ndqFHunkkdTDGRcIf2pXgb9rGLYFgP:GsLZC0OkkGJeGngP
MD5:	3CCDD0E0AD3D653869B5EB801CE0229E
SHA1:	65AC26E5424F9E131131CD28D9DFA9A7FB9624E2
SHA-256:	79905C539E52CF1631E33857DD1E710E6E946721B0190F68ACE655B0988FE599
SHA-512:	A6E69988F2049D2CD1F5770E42C3949C61C6F7E1CD8653208A023FCBCEAF890770643337F117CAC597C6DBCDA7411335938E03D67C57BF27209FB938D740252E
Malicious:	false
Preview:	Y.mY..\|....+o...L..J..`.......>d$...-.D..$..1.X.:.aK...........t..c...m....8.P./D.....F{..x.v&7....f...Q.c8.62.tZ........Qi........w.....>..D......PB.B..).!.=.......F.r...._..EFZ..a...s....+.u...P.M-xpW$5...D"s 1.q...%aq.7......7 }.hk.`......9cVU..t....oUd[...;..z.TH/&5'.....Wz&......-.E=.Y.F]/...~....x[.. ....."......%...a.F.Z.....Q...W.gS,4.=.a.L......@'R...@........82....=.x.P..._&w=.[Cp..5.......`..@.6.;p...;.x:3v.U...^..._}~...#}.V...6.3._VI6..a..wF..\|....G.u..):J...~gz_\.....d....J..EW.aZFz.6L\|,&hS../#....C.Zf.P+.#.r.C....<c....x.~.....6../....K[...~.....#.9u......H-.b...........5xl;:......Uo..=m...{!K5..#.n^....U....hjsY...-.F..(./$.....(...\|ZRH?..7..u..nw...^.wS.H&S.`.QD....M=..S,..y...Sn.$.....H.5..).E.~.,/....h.h.m....H...xu[[r=.U^..W.ROW..@.5~.T;..u.[(me....>{k....._.<..=.J-.-..;l'{..x.C.....nAK.....(X.+i..#..s...Q...i....gB..^._;...j.3.u..u...9E.m....F.$0.XP..5....3?...S.J6q*) ......4..#'.Tah...x\..]T.....Glw..N..]....M.Y Vb.5..0..j.

C:\Users\user\Downloads\NYMMPCEIMA.jpg.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Downloads\NYMMPCEIMA.xlsx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.795512020537812
Encrypted:	false
SSDEEP:	24:Bj4nek+K8l8PYXpUXseW/MDrv028gPp/lFa8fn0kihPD4Auw5:BZ1K8RXpODWy0bgPpNFt0kA8q5
MD5:	24685B992D88AA29924673F7B68C71CF
SHA1:	F7A433CE4E008C2C97036CC5763033B2839AB538
SHA-256:	584707706133A612DE0C5FE34A8408372421245EC5C1D6EB22FC50CD48F799B8
SHA-512:	15688F0D8174124F04FBE05B01920EF46DD75CD2E944EDC117E170D126250D399E459F990EE7FCE5782677DE3CB1B9669BEE69E11EF289488CC11A4BA549940F
Malicious:	false
Preview:	2.0..D8$v.m.....c..V.l..h.+.nu...-.?......mf"g\|.Ir..x.S..v.{D;.Y.=;F.[Q..j..}V.K..'./.$.Im.l?,.2gQ...?.;.u.)..Q...fF.2.B.yu._.+..E]...b\;0x...G..g....Z-Qrj.`:..t... ..@..%.........a.l9.D.t.{r.....]l.:.K...x\-...4.u....(..8..7..)..B.Kh.....n...v.5.R.H....)........HM........H....k./.{_..E...5.ekn}j<zsL.aDc3I..C..s$..n11...S.I....]....H..c.............y%....0S8.N..3...z...'.&...9..u.P.'.D...,.W..4.....,.4.a8.#<.}.P.V....9.w..[..P2C..,-.Hul..o.%.2v...K...5.Vg3n..7...H..W..O..Y;.zMN$..ytPg........V.[.f..Q<.p.b...../.Iz.z.?WUF..~..YK........m.c...[..g..0.e...a.d..P.x.C.....4.{........@.:U.Z.2...a......Y......n..sp..?>b8N.V..._1........s....$......:79..l..o.>`.ee&..s5...U.....%.A..0m?.{...c../!.....U.>p.~n?..I.........;M..}.;......&.VN..b..l-w-......T....83..Y-p92..d^.....l>........1,W.b...AT...0.7J.U\v..u.w..g..#...t-.........i..n.@.&..lIA.S..#.gSK.2\.59.R..g...!...bL.O69....A..^.....ld...L....E..6...*s6...%.YO.J...Y..2......H.}._...-..VL

C:\Users\user\Downloads\QCOILOQIKC.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Downloads\QCOILOQIKC.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.784339169551949
Encrypted:	false
SSDEEP:	24:ANPHk9CdKFcci+5LLeelDP7fgaEXOA/LCaFBYN+gjo0ZWZ6yb+XtW:ANcNd75LqIvfREXOAzfIOt+XtW
MD5:	D5977B56B1EFE3F112F8165C338C6A7D
SHA1:	4248800D6805DCF08143D15E00185673D15F9154
SHA-256:	3BDE02C50E7B7B63A41664401C13E5D11867D877CA12428658F4CF1414AC9BAE
SHA-512:	F9F7859F3108BDD300F7CA861D818F7BAA094CD072F96C6B305F04384E5008F1C24F62C0568F8572631FA248CCA1852BE07100D259E92CE65F4702BD6EA0030D
Malicious:	false
Preview:	a.i6...a.8T......vf.VHj@I.....P......6..c..f?..l~ib\|.(..."^(.`.H..9X.....J..Gs.s.....-]"oE.1.Yt^M.b.@x......B~..7...._.8g.n.\U.....d..S>.4...........tt...Rvw......G..}.C.k....>..F....u-@Z.B.V......B.v.B`8Et.nA.[....S............X..[../..(S..).cW.....R/...1...\.<.q.+.8....._...B.;.e\].y..m.`.je.zT.s.........0....r}.Sfx_....dx.X.....p...B....U.t.K.]^...\|.L.a.}..........>...Q)..,!..A.O..t..o.M...s....Zl../..S..G..>.@.-..,5.f4@......B..Y..Q(..}._.b..7...A........3......vb?..h...%.K...CA....0Q./.....7.?8%.E...l....NR.-r...Qcy.SI.R3...,...V..z...........<..Q\......4.:}.Xu..q...X...:}....."i!...eQn..ta.!!^..L.<.?.....7e..i..~.~}Ub...V;..Y...O.y..z`..--Y(F.m.'.Z.Et2....g..1..'.....(o.%..y).............s...J...%/....)..g9....p.]...\|.<...........X.$..e..o..t.n...C.!C.<.]C......~....M....x.wy4KUY@.^..-_.....]......4..lZ..9...-....Ba....y......p<u@.{.........x..FJ.M........B$M....)..WE.c\|.b..9.......~.Z.K.TPd7.\...l.0.F..l.{.I..../.8...GxI.

C:\Users\user\Downloads\TQDFJHPUIU.docx.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.785222258773929
Encrypted:	false
SSDEEP:	12:LkTovMcteQTK7zGp7ZbTrtjU+OAKqp/NC9q+72KEyvAN8csJ6STouWQnIpdATM1J:8ctDTndOi/oGKKiW/dUM1Z4xtBHoT
MD5:	BEC4D7E5DABDFDACBDBC0E1C97572826
SHA1:	C759B5047F963DFA9157759AEEEC4A6164188ED1
SHA-256:	81EE8843088660FCC099CE850937D169D60EE2A4129E29866640A51A9F31A238
SHA-512:	8F924BCF4C6E7FBD641A428294B66CDB1CF7CA0E896CEC4B827C2044C4E565D6FDD17A5776086007FED6D307F2CE5DA2014D4A856E7C59D413507AA882A754DD
Malicious:	false
Preview:	..u.......4...H.I..P'...].....AQ.....a...d.9.^j.:.........E.o(e....~.Y.......:.......;sj.&^.0.\.u.n.W..h@..\.t"...3q..j..T.(...f.........9....N....8..I?....;..J..z..?NdWV&P5H.L.XO...h.\|.a_o..Tp...;.6d..O......w.Z.j....Sz.......-.l..d.....n...#S[\......F?A....75%.....v}..g.....[..'.....}Lpo...6.4........\..^...P.XAd5.@...}.V.P...).....?a...:<.z&....1....9"t~..;......x..}.[8.[^zs.1..T&.d ~LG...j..I...D...>b.g..Bz....\|]9..!...d.6.7..6J....._{.....v.Y.. ....o.6....U.0N.c.s...Z'..>....p:./U....d.A...=..l....8<.....M.;Z.f.Z).=>.<.x.#~:.kS......W.d.R.N.E..A.1...J^K....SN.Q..<.)..hw.l...l......._.(..N..-2;^yx...&t...h......:...5`.O..........\|....EL..N.....-.Z.T..v):...C..)._.r..u..]t..G..~"].......a.[T.8s.Y\9Qr.d....h=.N.v...AF.....~doc.'.......e...E.Ab../xs...C...h`U.9a..j3M..h........Es(..;..01.V./.%..N.#....m.bE..2q.N...I.iq....4..G...W4N..-..z.E1 ..L.oj..F'...TbJ..e=.r..xq.....7.B.ka.i..J...9K....S.$.'.q.:..0~.15{.u...}.......1,[=..G..F.....

C:\Users\user\Downloads\UNKRLCVOHV.pdf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.794474051474343
Encrypted:	false
SSDEEP:	24:bqqdou/x/0j32/d/QWI1BZWMTyvseWtSYk9z:bx/xPFbIkHv2sYk9z
MD5:	52FFCE6BF74C7E825CC4C99FCF9EB593
SHA1:	0692BF85BED0C03FBB97F82EA8CB3D9271EE8F53
SHA-256:	4CDF86F84C3A24C1F058196B9367A7B7B3D0601688599BEEEB73FAB82AE9F5F0
SHA-512:	113BB2D7D3D4DB98567D7061971898B1809800C9DB24AC5FFF7C8C9ACBEB6FD84D7C4634F5CCB48787B61EF85BA9AE6BA4DFEB0F0072C6A14551BFAB31340158
Malicious:	false
Preview:	...M.....OA.!e5...w`..I...k.P...+.lF......yvBSyT.}.X..Nf8.ID.D].w.Qy6.&6....&.;.9T.'.TL. ...X..oU...#.....9..r.._.T.9.w##~."x...JI.!.P..U..o._IX)q..lC..D.w-u...;_.K.....p.h.].cN..1B.1.z..8..;.....i..'....#._-.r.+#L..z!...A.D.,.-.....a.mRk\|_.....%ye..q)..1q.....v..xB.......{....\<.\.......,..MZA...dn..7\...VV..:.A9.8.......V2...(r...!E..U#D.~{../...)vH.E.......hH..\bxf..7U74,.5...+F.....9$..r.....1...4.ot.p)6.9y$z...)c.?....V\|..Mh.2._...M.....Iy^...T-.w..M.Qm..W.S(;....2uA.cH.B$."n..V..+~.d..F....C.3.5@.....:p.IF...L..V.V....X..5'..r+...wgO!:;?..r65(..>Xk.\.....w.-p...]..#....h.h.e..9c..RA......+....q..8......jx.fJ......f.7Sv.U..rw.. Pz..an.w.....:.Lbb.../.....".N[.`..{.?...ff..c..Lv...j,sz.J.**;....&.#B.M8..J1..v-.Qa.B....."....H....b..w.{c.."..J..L...Z..Cm..D..;..'.G+:\.aObg....P.:n...u.tU...u.H 1v.n.....$.wz.........t..m.4.P.........k..e.\...c..c.@.H;&..r......G...7P5.A#,a.1....9......h'o...X..w%...x.......T.:.W....f....i.j....._.G.+a.....

C:\Users\user\Downloads\WSHEJMDVQC.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.79369625536087
Encrypted:	false
SSDEEP:	24:gNzccqE/rb0PlQcyfyXNVJbj1fnwwFBKub14iwU9zb9oU04Lf+gaxoIMadHI:8VqEyQcyfiNdPw0Iub/wUZTLfbcoIhdo
MD5:	DB96B117ACB142EB4754C080FABB8F79
SHA1:	BD18414D1F89ECB69CC077F7E9BD27A7ACD0C6BA
SHA-256:	6DC04F9E483F5FB1644A15DA0085F88C73ACE7E9CCE1AD7E54797AD0FDEC8A0F
SHA-512:	811321927B35BDBAFA349ABE00EE9B68EAC190535878BA82A9B49637A3A9017D6C9BB8C26E8183EA3109A3E416E1173AA7CFBDA80EADAE9B2F7264E84884258D
Malicious:	false
Preview:	m.../.M2..O..(..?...W.$H8...t...QX....\|Yk..J.G@r...%...7.. .i..X.3UQ............h.h.....R.7/.1yx;.Ps.....o.`.G:..G....Q...A.s.}..O[M.7.[..AE8.....3q.......'.O\|vl..3A......<.[.$`{..3.,%B...^.......5...<.....Z..Gx.+.d...z..>......G,'...86.5.onj#jl`{;)Z.A...=..G..'..)..N..L.....J...d:'V.?...t..-.3.X..$......'H.$jR9G...D.32....\..4..M......-....@.ug...Io.u..DH.....\|I.5I..DHRi.Y.....>.C.>.1=a.Q.......q.....s.m.`p...)[El..,[.=Q..r...q.jK.+..F.&....'o..`.a..s..$.W.W.v8..h..........dE.....0H.2A0..w~.....K........5..w.k...% ....A...LpZ.......l......U13.R...RY..:..E..T..]..S...m.........Wkw.4xydj.m.$..MV...>yY....]..........&./>..(.WZ.......)..BP.<..m.9.E.....?.......zP..L;.H..).Q.L.`.2,.E.[.H..xQF.<X.E.....[....+2.\|[...=t..B`.0>..k.B....-..o..fs...q.'....-t.V..}z`:.......x.....M...mfCf.B.~lg.%8.6..J..u.~...z.P.........j.).0A.E.QK......PMR_...g.T,K.iU&l.J....LO.28@.a.....T$...'..j.g.>`s<...hz.(...........g3....`G....$C....PO.7W}.

C:\Users\user\Downloads\ZIPXYXWIOY.png.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.814772270748105
Encrypted:	false
SSDEEP:	24:OTESQGNYs7GrnGUNl9OrioO1+ni1OKb7NNzQhyYn2dhH:OWYYsqrGUHCaf1O6ZRMnn2dV
MD5:	6B283536DE1E52491E78B45FDB15CD29
SHA1:	CD85E29D45584F3B04F43CB91CBE4B9353E1EF4B
SHA-256:	596A03D6D828E273C99AFD7877E45D263ABDF01BC8AC4F9912FA26DE2A5CE29C
SHA-512:	635C93D9C037AA0EB71B0D11E958F100FB42E5038B1D6DE50B0AD5443FF29FFE92E73ABC7434EF0F7FDE4A3E4BC55293054A4F47B87341F27A2CD5666BDD06FB
Malicious:	false
Preview:	...j*....U.B.ND..z..;q.t...wMD...6...7..>k...c.$.._.ClZ.y....Kp...vm1l...MW...Z.........P.,..,..Q.K4.x..R....yrg.`.L{..../;`.....U.^.-......Wjx..a...&..\|.]W.i1...e.@.rz.b.fA..T\|.G.........2...o{........t..2_.'.S....K!.....54. ;m.....z]9...8..Z...Q..h>..1.".c!w.2..L....~AG.'.."..8QB....<q_w...J.k..~...}..'@e.H....=Hw[)'....6....4._....Q..Z.._.4..7.3zF..W...va.ZG`.._........T.I.pG.P..b....s..&...s.g.y.T.k#..u...T.r.........J2F0...A/..,..&7V.._.].D..........4..\|d.R.....TrQEg@...).^....W......x"......N.....g.T6."GZ..;..O.........?.......z:ts..}.....q..D..?F....1.;.....VO...5......g.........b.n9.O.)e.....?..\|.)Xy...G.:4S...i.....U...[..\...H..i..?..G!.>.m.0.)..1,........U0w.o.....i..^h..3...iT.\|......dX...'....$..s.....(V.?.........[...}..K.....D.5......X.3..)..I....q..!p.?.uZ...+...$~.nRdH..8.g..6,MJ..`................H_4o....:/V......%&......t.mrs.I.D.M.wi...............r..Z^.E...o.Q...}}.....we..2......G..WMEL..7.q.\...Z.d.....w.

C:\Users\user\Downloads\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	7.258609930462381
Encrypted:	false
SSDEEP:	6:WKJfsGQSMd4FoSfUyI8TLoFlN/r4opYrkM9y1343xAUxbmW:W9GQS+4qSsyI8TkFT4JkMcuAwv
MD5:	6832A9BF03B037244FCBEB152A8E8A67
SHA1:	3BD84FF61BCC9CED436F194DDD24624B7132AEF6
SHA-256:	55D6008F130E5447AB75063056A9FAFB94E88359EC8B15A66B1D03B661A9AEBE
SHA-512:	FAFEF6E8183F71A2B7C0B368A0058FB27612633A0262C70270ECCB378131ADE60BC81655B734B600055836D23268F49D5C78D5B8142733BB09DB6C736799B8CD
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f.."-`..i........Y..i.{).i.zu.......FJ.bWa....Qly..8..C.f.A`5...V.P\xb...4..E...)./.lf.*K..m.Y!..d....!WJ..\|.;c`S.3.}L..A.s...

C:\Users\user\Favorites\Amazon.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	112
Entropy (8bit):	6.3441915025850335
Encrypted:	false
SSDEEP:	3:jfhuTjbjXGiY/5Ikm877S6B8KvDbCv/bzRpkP:NcjXIrtBBujU
MD5:	B311DAA8794AF5121768A2A34DA9548E
SHA1:	A35E40BBA52B85B41D2709A1E2F843DEED46B9BD
SHA-256:	D194C81D504CD6BE8A733145278733B85B8359001C3FB2934B3E876C54E825B4
SHA-512:	AE84ED90A2E6FC29DC54DA00723EABA3BDE6B6DEB0547422335CF86C96B59D24F8732FDB4821523A9D022F822D75C53145D4F3EACE3DA7132C1BD270B93FCEA9
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W;....(.zpF.m.W....K=.5AI....

C:\Users\user\Favorites\Bing.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	224
Entropy (8bit):	7.199591683274469
Encrypted:	false
SSDEEP:	6:NcjXIrtBP1CkjHRwX0W8JQpTlrQpbiKxFb4Cj:CjXULNCeHLdJQpTlrQDx+e
MD5:	965B350D8D049CF93181B060A56753F4
SHA1:	2383C27824101261401CB252A47EE11B0BD04E09
SHA-256:	7AF54885510B2B2AB56F38FB6CBC86A9C8260CFD212F606CD3BFF10E744BB5DC
SHA-512:	A8FECFB3F5A2341ED2A4C806ECA531A9E385571955E96BC8A65403A654BD11DEF927C76159C19BE1D6B75927BE7A0A295945529E1354F13390C180A1231D1196
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W..\|......7...P}_..bZD.4....S.D.M.A.WJ....&....-R....?..l..M..dok......q5..I..C.t......E...Y.W..u..d.jO)...J`.....\........rs..9..~.]..K.

C:\Users\user\Favorites\Facebook.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	128
Entropy (8bit):	6.429534765557392
Encrypted:	false
SSDEEP:	3:jfhuTjbjXGiY/5Ikm877S6B8KvDbCv/bCKHjiwgOWQn:NcjXIrtBBudiwgPQn
MD5:	AD6E8976844B8DA4C51D52CCCE2113C4
SHA1:	CBACCD74A74F5686AABC5DDDF2E9FD36C495A16F
SHA-256:	767C47C3A62C7DFB607C5D9435B23F1090AE69A1741797AE04BB4A2918EF34F0
SHA-512:	7028FD4B2A8B67D3F9E50E26F68412D1DF5A02FEA05D75905855553063D109F8ADF865AEF888B9FE4C6F0E66BB6A32F5685C658436451F33E44FFEA17A9CA372
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W;....(.zpF.m.'..........*1....X....Xj.t...

C:\Users\user\Favorites\Google.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	112
Entropy (8bit):	6.287134721106791
Encrypted:	false
SSDEEP:	3:jfhuTjbjXGiY/5Ikm877S6B8KvDbCv/bLS/+Ksn:NcjXIrtBBuPS/nsn
MD5:	9BD2632E7A93845D7429CDBD86E56450
SHA1:	C43EEC3F0CDF3DA99D99DF09563B5ED3CB7DED1F
SHA-256:	8D4EFB4B6FBF2EC07B6598C0986DF1753B101935E9FFDABD0684F94879D8D2F0
SHA-512:	192F2FF60F6CDEAAAF1ABA91352CB8EECD692BC9F1DF93D3E31D432A9CF64F49359C95E5BF6740A5E5D48CE5F611770F78CDA74E78B5C71D3A010F8DA9A71ADB
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W;....(.zpF.m..@..7L.........

C:\Users\user\Favorites\Links\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	96
Entropy (8bit):	6.327099089240291
Encrypted:	false
SSDEEP:	3:9IDrKxEFyGM/sqrE6/HczI/xm+5EqS+xE:SDuEFyNZr/ks/xm++qS+u
MD5:	3A5E158CBE0FB4D6B89CE4D2E48C4C9F
SHA1:	480B6FE64F254F2E20C02414A234ECA5B13BD997
SHA-256:	40EB818897C0D86A60D75E04A998B158388429FF59BD7D472E3F83955A5BA8EE
SHA-512:	C9CD23AEC98DE9C916C650DA2EADD7E0CD92EE2C7F9F3D050962BF4A4AF76D7AC923A4E338882F28217AC4692F4672D59A0ECCCF1BFA5014FBEE14F33CDC7F92
Malicious:	false
Preview:	..X..f.......!.......+.3.]..A..f.{....a/.@...5Z....T. .G.._.DU..]..v..T.l.C.oz7[..k...&..M:

C:\Users\user\Favorites\Live.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	112
Entropy (8bit):	6.255797444282444
Encrypted:	false
SSDEEP:	3:jfhuTjbjXGiY/5Ikm877S6B8KvDbCv/b6rYbj:NcjXIrtBBu1j
MD5:	5E7ED5B44175FD497F5D9586E2156E8B
SHA1:	5C54B748563FE170DFBD7212713B074C69AA462C
SHA-256:	5D96E3D5F225F6EB02107B5F3D37000ED2EFE55B2766142C86CF8208B073E083
SHA-512:	9F22323ACF92D8957DBD5B622EE385B3596B2D76284345D780FB0E9ED7E8CA73E35CF2F988BDB772C42205EE8A72633A4D6DFD544A18604D9C33501BBDD814F4
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W;....(.zpF.m.z.......lQ.)...w

C:\Users\user\Favorites\NYTimes.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	128
Entropy (8bit):	6.54863720694674
Encrypted:	false
SSDEEP:	3:jfhuTjbjXGiY/5Ikm877S6B8KvDbCv/buMWVw9bY+:NcjXIrtBBuLbY+
MD5:	7901A62F2DF64E0BF8B456CDB967419B
SHA1:	C826F33DEBC7ED0864FD997C466923804096630A
SHA-256:	575A772AA7185C5D247ADCC55D85DBA1165F571B8A2105A3A34EF7535B309194
SHA-512:	5AE0F8BC9C332F7FC8471E4A697661E84F0718EE15EE7B871EDC6F9CD5635096D3E4960C55E2F989C818A4C31B0558CC554495176354010828AD887CAF47E6C1
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W;....(.zpF.m...q._.s.......yp..$....n.j.G&.

C:\Users\user\Favorites\Reddit.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	112
Entropy (8bit):	6.2625375112660455
Encrypted:	false
SSDEEP:	3:jfhuTjbjXGiY/5Ikm877S6B8KvDbCv/beQenAujL:NcjXIrtBBuaLnRL
MD5:	26F20F24D3899BF94FBA232F04E18F15
SHA1:	6DF1ABFAE69B397C3718C5BDD7D55E1A89061055
SHA-256:	42676D76B82DCBDA5ECBFA92F038FA267126C3A2304C41B7DE4002F2736C8749
SHA-512:	4E1FBB6C0C964E83764AABE8E0B8A15006F4B6EECD6218567BACEF1EF358599E0645489CAE342FA1B7BF1929BE7F5FD0CB7ED8F50335124D850B7A19A11C7CF8
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W;....(.zpF.m.G.p...%.P.m1..

C:\Users\user\Favorites\Twitter.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	128
Entropy (8bit):	6.427467089725436
Encrypted:	false
SSDEEP:	3:jfhuTjbjXGiY/5Ikm877S6B8KvDbCv/bjMtADradwRaJ:NcjXIrtBBu/Iba6
MD5:	F0691A296A4FBEF2E68AEA7700FD489B
SHA1:	3DDFD410852DADAFC42B0CBAB35D371C2D3D5039
SHA-256:	5E3CFF8E042731D37A84293C200AD3853ECC43DC2D096322A46E7A681B678AA2
SHA-512:	7589991390F26EBF774CBFD9A781C3E3FF8AC41EAF883DE40971497D27C838B0740DB46622070466C18DB20E3CFBE0163BCDDB0AC830A77C7D4623364DE35AD5
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W;....(.zpF.m......n.*.7.[.........K.....

C:\Users\user\Favorites\Wikipedia.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	128
Entropy (8bit):	6.460784765557392
Encrypted:	false
SSDEEP:	3:jfhuTjbjXGiY/5Ikm877S6B8KvDbCv/bEU5dgO:NcjXIrtBBuBaO
MD5:	6CDEEF2953272094DB429EFE5E15AC54
SHA1:	E2FCC0CA271A6E1E9D51B0962531C6CBED9EBBA5
SHA-256:	B743C31C3B2D0937CEDDF086A2274C0988AC0B7872E3F3574AFBE586E5E5DAA6
SHA-512:	E2377C3B8D5E7AD06ACF20102598971F5769606455F90725F2270CBA55A0B3C2636967E5F153DE9276849A604B4CBB8C8F5AF08E6B8C9D10D9BE044B2ACE85B8
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W;....(.zpF.m.!2'..=.L......E,r.p....=.....H

C:\Users\user\Favorites\Youtube.url.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	128
Entropy (8bit):	6.433364648336088
Encrypted:	false
SSDEEP:	3:jfhuTjbjXGiY/5Ikm877S6B8KvDbCv/bbPL2y9OzBJiOLsS:NcjXIrtBBu/PL2uOvYS
MD5:	9A7B8F82E7C96CF703CF12E293BC10F6
SHA1:	DF5A60C4A1D058BF89290FC13861E940A1F61DD7
SHA-256:	060CA9424AEA6FEEA6A01E33E0894C19FA4F22DC68CD914E7193B8A3E8EB8F81
SHA-512:	AC23A5D3B482FA1581E548FDEC77376101F8CED2F4C771851925334BFA2575DDF9CB1533D872B0DFFCA5F850B9B39CFC518A5DA021E12731EFEEC8EBB3813AF4
Malicious:	false
Preview:	......9.(.2...U..p..g@.~D#.#.^...PPi]m..o....^w.r...._.JL[...(Q....>P.W;....(.zpF.m..jOU.w...'hp..b.Q.K.\.^.qu.`..

C:\Users\user\Favorites\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	416
Entropy (8bit):	7.447715224547731
Encrypted:	false
SSDEEP:	12:W9GQS+4qSsyI8TkFT4kW3eZMQ4M/Jfd68is9zdzePMca:W9HSRqSw81mZMEJX9zhUa
MD5:	D58087F5E2CDA5A645156420E73F2955
SHA1:	30E39253238997485D3C997B6CFE505AA34F9571
SHA-256:	037048023A8519A3C8BEF826EF53751A51F493AAA5B3332BE3F3AE2A9600A0FA
SHA-512:	C9106B015C0B1B9FAD39B2614298B2FC7A2D24B23362F97D9E18AB6FE41FA00D21CC6551A22880A22D89B6E0EE67C8682319E84FA771CE7AFD057E36FB237120
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f....+......?.lJ9......1..m.t...7\|...7...).N.....8>..s.....j.....AnI.Y...N.....Fv].9...8..\|.G.2n.Ii..%...t..TN...Y..i..A.k..y{U......M.:..@Y.e.T..C Mv..w...k...K....u..O.....!....2.>f..........*a...=.kks.K.J............:.n..r.Q)...h".$....M.....C.

C:\Users\user\Links\Desktop.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.571648612110471
Encrypted:	false
SSDEEP:	12:AGCzRIa8evMcaC3kxL42kCPpiOQxn+HGjVJAnsfvKQeLBVRwGwQ5:Av+a0camkO29PpiOO+mhCsHK+GJ5
MD5:	486063C2C17131A861B3D12F7FD67778
SHA1:	F4A866759FE8604D33F01B99C2FC6AE6B1BF0449
SHA-256:	F1D1F5A6802F8825606EF88A71836DF23195C6AE771BE4AFCB1C63A5497156B8
SHA-512:	E20F7F1959697F5A7B1E118C3E92B7C3319D46FF2CC2530557CB4B642427811A25244C5D76C78E984F1886533BA52259CD7CF3FA85F91CBACBC8532A89E05EBD
Malicious:	false
Preview:	..:..-%....cz.:..l..1.j%.........r......i2.j..ci...b....k...V..xi.M_..#..j....\|b..\|O.k.mi.LF..p..\...g.:.63.....H...8.9.M.l.::.7".H.C....f..9.V...3q.v....f.%7L.^k..%..#9N.L.H[~,.&rlI..?.o.bf..&.=.^.S..)..N..M.YUM..>..k.F.....~..i.l....Z...K.,kr........0..f"<....W......u..,.y%..G..P......gAI....A+.++.........'2..X[.....<..Hlp..+...i.....3o..5._...a..e.:..6....T.v..z.....d.*.S....4-..TB..4..$...5...+...b.7e....V....?}.....(...I...[....R/...p.:.h=.p0B7wy.[Q.>.Wm(.._..rh?u7.

C:\Users\user\Links\Downloads.lnk.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	944
Entropy (8bit):	7.741054772402201
Encrypted:	false
SSDEEP:	24:AvZoGeYuy4oJ+OzXWO4FiSeSdqzkOFJ54PvM9huOn:A6y4u+OzGVXeWqBF43M9h1
MD5:	F3567F1BAF141FC107EEC64CCBCAF06A
SHA1:	58120E4EAAD8C6ED70F29F6A3E92989DC8C46768
SHA-256:	E442BC2C33F8725F2BAEAA6668B9AA9FBA276CD960D04DD7ACAA70BCB50CA721
SHA-512:	3A348255E3441430B9C1B24E79CF37C866F0A6AD18001B571C4742B8F7B0DD7FB7A05014F0EEF531B1B979BAFC7F5E9A127C130E92127B1AC131EEDEE5CB5F1C
Malicious:	false
Preview:	..:..-%....cz.:..l..1.j%...............o.......d..V..b.S(d.17.g\|.P.K.....T..9. ....b._/.%.Z...)..=.U...%.......j......^...H...s.e..Viqi..%.%1....V..b.O..fk....`L............5..A.T.Gi....)..m...E8.../.$. F.lC..+b.......m.D..B.9M....t..Uf.A...........-..r..:g..D.$..GM.9.'/r...[....w.r.O.....X.U>..:DS..}.e.nP.J..^.+.D}f..;.:C..E..d.e.aG.h....X..._w.....J.._wJ....{.........]C..t^..G........i...d.....-.r..YU.u.b]../..FN....x...Z0.7J..!.yb5..No.i..xXV..t .AG...T..0.......G.:.H.j3....r..Z.>..$...xj?..a#....[!a/.....2V..VTx...c.............\|.<.aaw.P.....;.jAV....k.[........\|...:,K.N0.DT.-dHU....!g.Y.s..(@p..Oj...".....t..eS.:.M.-.DP.....N<..JB.E.w.V...-....A.J....I.e.a.q......~a..P.<..+.Jg...;..G.5...I:kmF..D..;A.......K..f.'..@3I4J..+jI.fQ>.......$.O..W....,.k...(.....j..H......gCh.......U4...\..)..M&.........R....$.Cz....~6V.K...Fd*...+.....c..lr#.rv..7~W....DHT.......-... .'....

C:\Users\user\Links\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.570024831369145
Encrypted:	false
SSDEEP:	12:W9GQS+4qSsyI8TkFT44hWGtFM3zsqd6ChdgCmUrqOt1f4Bmv3:W9HSRqSw814bFMfd+qb2mP
MD5:	E3DB1F8C320B1970C4A79ECAF706E2BD
SHA1:	480A14ED26E745E34746112E374A43E03072EBDF
SHA-256:	2DB33998A7E3DF171E79050A39F5F05FA7160412F35EEFB35A05E7F8F3D39352
SHA-512:	C1EEF29F622E4804855E7BCAD0CBF4E60829D23AD4C095B2B7859BE1B1DE81B84E6664C706D850CC110B3EA3931D88947F491293A21D099B35C8D23341D1EA65
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f...1`...;...-R....(^..3y....%F..b...P....i..J..Y....Iu.!.zP......&.U.2.;.6..;.H...:}.U.C..%...I..y.P.J..E>T..(}l........`...(^..^.:.t...:,...g.....S..F.~.j6....r..I........g.8...k...R.G..S.T..'..h.{..-...x.L6V.g....\|.t I_..h:j..Sl..=..R.?....f...8/',..w.Nf..6..A[........s.u0...........c.^=Wt..._.e..!4.u..'.X<.........YZy~1....~...

C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\edb00001.log.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	524304
Entropy (8bit):	7.9996849938867385
Encrypted:	true
SSDEEP:	12288:ab56fVOVy8vHMDHqgYlmKOCiTXg4i3o9Aw4ZNTIXzTTOsuW:abQfILHvmKOZXg4i3o8ZZIDfuW
MD5:	188AE05575C4E5C0696B3DD2E7388B50
SHA1:	A5AD9331B6E07C15D807D8B2E11E26E924210C24
SHA-256:	447D8433A12C14FA58BBD29ADA5A28CFA1F85B6A7AA6BCBCD943606021463B4B
SHA-512:	79C1BF122EF75E71B82570B818D2DD38717F85CFF5FF76A78C5EDE0056BF2F362D14AD12B60DA09700DC2E51282B2570DECF71CAE04C6E24753DBE5F18F02C82
Malicious:	true
Preview:	..A..x.....M`..w.W..S. J.b.D..]....\...=..k....0..rn.....r..:...}c....k...../....r5..uu.D... .yU.1.[%......y...Cp.r.X9.0.T.\5..m...(p`7mW../...5..DPm........;Z_.M..'...N.bA.,...d?.......t....o.\...B..c...B".6.;..hZ....s...mS.\|@Nj...}f[.x6/.r.`H.....i5zJ5.).:i.4f.,MM...Q.....2.....2.u...]...e...12.,..1...\%.}B....T....n..a..I..\|.1#./e.V~l7....+n....(......d./.N......./X.Y.Mx......".W..i...2.j.\..F..[.@.....Xe..J..6...r\...^I.....'3-ha.N..."...."..R.V..-T.}...N..q=.B.x!..4.......JN6.E.q.f...'...r...La......j..5.;.I..75.$.;.....I.2".Q\k..~J 3....d.O>;W.......t2./<.?v....g.P.;.n...s..lu..Gk...m..(a.....s=.o.m)........\[..i..r...=z...7..}.?..S..B.....kr...M.O..O./..%.e..ut..:.8.AAR....D.....O..H..y...49...xXw..9.RpO3..\.J~....Tc.Z).7...8.....Ee..xW..`...t..}.....x..Vt}...Ls.P....>,.+...jk...D.....tt.P'..>..NX..vD..5:oRW../........T&.Bu\.GM .."O..>.*W.G.......Q...,...U.E<.g.........(...\........%.........D...B.....S..G../.....j.J..

C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\edb00002.log.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	524304
Entropy (8bit):	7.9996552870616835
Encrypted:	true
SSDEEP:	12288:VOuld0N6FVDKQcTbU0ABjOGY8xlKRuHA1Vz5:Mulu66TMBrY8xlKRuEVz5
MD5:	6965EE426D7AE77457E115C09045B31C
SHA1:	E5495E4DB2188DEC639048CC7C3F64221F0A4E64
SHA-256:	38AC570FEB82EBF06B348FDABA8483D8C8E7B18743FE7E8EDF42A5F4CB6EAA7B
SHA-512:	05B2961EDACA6B95D85F6DD156CFDBD9B06C5B8161E05734A7237E9404E286FAED7D746E4D2A1763C72D485123BE76CF910A4E379B2B8901A01B8E1A0E3AD318
Malicious:	true
Preview:	..p.....[....5..Z..]0..)x.........9.#....=.?...h5.....i.HX..n..1d0.[@.0{.X....$.R....E..}.....G....@z......Q._?A.....8v..L...`...O..x....Q.12.......SPaoi#V..Y.?. >....wb.s]..A.d.L.w@0T...4.h..j.o..K"..L\|../D....:O.! ..N...E.....A. .....QLs...`..Js.u,.H.+1.U...V.].9yQK...h.,...T..UJG......8z.-./.... .7...+U...D.pk...q.{KB!.T...r...1..O.g..{[.........F..]5$2..W..2.....pR.p...........^_..V.4.S.q..r...c..z.....m...Z.^..t.K].......@.N&..Y/.\|67.....dW.4L.Xw*$.5m...S.."U8...S,S..!...-L.......kw......O:...U...2.VY.f.G!...B...'+.M.....5...g.4.j..f..'..`..>..W.G...JUb.4...O..I....F.`-MS..{.G.3Am.b............B#..T\|.Y......r...v.1MI......W......V\|....=....8BY.........@-..O...W)p.8D..O.s..E....@....]r.M..qN.:a..w...w.54Y...O..R.Zl.}.'.....:....%y......-{.^v...;C.[..7A..w_......U..T1.o......\|4;......+..x?4.F..J.V{k.d..^.l....nm........u...K.N..~j'.<.&.^..?x0.w.ie.a.00p.p......FC..p....+.C...-O........}..'z..5...R......a.Ad.Z.R.A.....}...

C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\schema.txt.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.875
Encrypted:	false
SSDEEP:	3:I83xcJ3Cn:I8Cy
MD5:	739E5388F21A12FE85A9EA10DCBFDDF2
SHA1:	833BBF8C51AF177FC734A412B2F6C964631A70BC
SHA-256:	BBAF0D70E2B3ED5191D801467E8FDD29A2269F6E7A4D096744FF4F585B154747
SHA-512:	758EF18814D563F8B831851872A0DE1C0EE5C79CFA1162EC9BA874FA80890A05E38650DBF4ECE9C9770A4A21009CC42B616B1175BC1A8CED28E596C6C7D5F916
Malicious:	false
Preview:	F..8.........v4.+...@.....r..L

C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\spartan.edb.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	2105360
Entropy (8bit):	7.999918951003624
Encrypted:	true
SSDEEP:	49152:TIMCF4XRj9XcmaAo5mLeG8e7GhaWteGX/56r1SyyERrDWv4V:TIMCFWBsdd5Q+e7Ghb8i56wcpWwV
MD5:	D01457188CFF14CB7C281BB72D112CCA
SHA1:	A711375D36540818E4C1295F18C4F83A5F536C2D
SHA-256:	784F5957BED96CBAAB8E1AA89713E3F9BD1E7223B7D783839006368DA3A921A9
SHA-512:	2F6E716C7E53BF6679F6B2C7109E6A3C5850A993D546D4756CB0ECBAC6FA1291542A5AD6EE1A7F1F1457C318AD13CA5C539D0040EAEE3E3EACB23BFA63E12C20
Malicious:	true
Preview:	.....8xK....~...'....L.......)O..K.....4M5.o......J......kF.6.,.\.V..Q...^.KVr.h.....(.#!(2....9."....\|..{./lg..m.+.....Lt...E...B....e3VE..2c...N....W..0:......O...N.g......(J\|"b. \6]._G.@.z;....k........\..an...V..w_..?I.`h.\|.9NJ6....\|.^.....L...u.a...+,...mAa...../.$.S...f......C..m...s...O&.....j.L..~z...(.7..... 4..^G.s.V..X......oZ...(#.p}Uu]....?....>... h7._....,S.C..j.f.e.s..n......8a...{....<...=P..L.4V..o..j.".LIP.._C..S..G:.tF_l..5.98.......M.....(zz..fC=.b..aY."N.g}....P....I.T.\|k..o)...:....2......e.......`,....}.c...#n....nI[g.G....8...9.......0.LZ....e..p.q...8.......'......}.\......^[.i....9]..f."j.0..w.a3.......$.i.g.".u.~..=..<m.*.c.m.......z....C...P.Q.B...]..w.Z-..3....3.Q.tMt.w..8.(d'.G..h.P..F.....rG....#..Dw..~.!.hE........NUm....`.xh.;..b......P.v'~9#]..5.y.Qz.N...}..... .....}..?.I..q...I.....i..1...&.9.;...;2'....v.^L.........D..p.2......2...AB.$4.#.E.#..c..1.......ly.U{9.F..V\|j.......H.I...B&wz..@2..})M.6.

C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\DatastoreBackup\spartan.pat.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\MicrosoftEdgeCookiesBackup.dat.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	7.235103369030762
Encrypted:	false
SSDEEP:	3:hNAV8xWFmqyhuhA9Hbw6NMastUr7xtZhc3M79FnkrqVvW3nNKcA5OVeOYM9z1gPw:tqXWJbXbxjZxFnkGpqNlYM90vpo1zCBo
MD5:	E859F6FB99608F2D4F7DCCDEB6224CB1
SHA1:	7245BAB6B8F3C2A565B8D9093AC62EB59D73420C
SHA-256:	55267C2CA21D9604C2D35665651F6C7E491D91AAD983931901ED36656F588E57
SHA-512:	BB3C552B2D36980239C324A563FBA53E819A3D13ADAEA757ADFFDC5FCCCF34BE29F978F481BD0B52E0683E04A2E6C5F6AA4E1FD067DA7630E877CF44BA31A942
Malicious:	false
Preview:	u..Hs.....%b.Q.~u.b.....S.j.n...o...h...Oc.n.a..>u...$c...v.-........qN..>....P......yZZi.!...3i`[...D...Vc.0.w.'.dK..L....~.a.N..Z...+Q=.?..*2..i..G.X..X.0{C.;...).;...I....#.L......x...uQ7~..+.o./..l....qq,V.j..A...`.f<s..v......$F{i.x....Z

C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\MicrosoftEdgeSettingsBackup.txt.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\MicrosoftEdgeBackups\backups\MicrosoftEdgeBackup20200930\Protected - It is a violation of Windows Policy to modify\Backup.dat.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	544
Entropy (8bit):	7.568726178109674
Encrypted:	false
SSDEEP:	12:+17N7wO7X4A3kfDJUWjnAv3r6UCsOR0Zj/hVLE0mCky:sNEO7X4sb96UZ6yThVbF
MD5:	95F2027DC47E795E0B1AEE9EA23EC828
SHA1:	1FA617ED4ADE3854A97E2ECB5CAF1A50A57CC3BB
SHA-256:	C9204456CC734E7FBCA0460F69937127CFDF476A9ADE25A29E623E00F580A440
SHA-512:	0F22789198859E98DC045DB5AFF84DFACE72E69E3D900991CFA694A86867B69E829FE15DA2E7E69EEE2454592AEBA70EC67A6E97E81E92156C3976D39BD1C68E
Malicious:	false
Preview:	.z.~.....q.9..}................s....w.dV...^....JD.....T......-!...<./.s}fx.qx....qf.2...{..M:.Y....,.y...$.D.BJ....``.......s}l..T...70&....O9..,...^V.iN....P...oL0..e'.l.=k..gF..(g<.B;........B?...lI.w....Ik/.^c.^..1....`.C...["...3.~......y.J;......K.H..H..mF..+..s...!...t.. .<..NT.+.C.c.+....Y..0..3...:..;?..h.=.W..:.=l..Y%.(&.#?...le2..e.U.yQ.82m..j.Y...N$#...L....$j..uD.P....t9...Wg %.4+...%.N.5.mVn....Z....6i..T....t..-..B.sw(S.T....s...Q..qh...e...&V.e.y..._.q7..;.(A...h'.$...,.C5.. \|=.wXLq...~.c...4.....C.

C:\Users\user\Music\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.645353786506428
Encrypted:	false
SSDEEP:	12:W9GQS+4qSsyI8TkFT4OYdCqnTfl8Y/pBUe7kzpFqhf:W9HSRqSw81OYT98SV7kzrI
MD5:	9BB46BE52699543880279273A57F8AA3
SHA1:	5C7392B02F78A72F133F4BE0D8F45582035961CE
SHA-256:	D56D89F00F86D889384F86A08B1AA23A7D14D3EFCE9F74DD79B189270908C1EE
SHA-512:	225405E70D3FD1B79CF6D17495245AB602CB18AED857B452C340B6BE4EDD630ADFD27BF95B8D2D7C092B30128A1A38ED894E94B0C5E64E0CAE386BFD8844282C
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f..M..._.~.......aO..o...m...t.....8.=....V.W....b..2.+?4./.4.o,..,.h....L..U...........?..'.#.9.U..~E.l.-..Q\|..]...o..s.&.Mz....ZZ1...R..^D.U.}.h.."..wXQ.!.p.Cm...B}!.....>..L...[8...v>>.&....r"....l..K.s&]..r..Y..k..G.8..(b..9.gj..}..{....s.UBSL?j....3./.L...(.......SM...?.u.u..1...$nZn....c.x}.=...VF..)..:.;.:..N4.......~}......9

C:\Users\user\NTUSER.DAT.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\Pictures\Camera Roll\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	6.94541048239059
Encrypted:	false
SSDEEP:	3:zO1KJfqfGQmxnZgDyGz0vhf+hSfUyI8ToB8YFFOp+/Hn00EMnn/FBVdoiWDKBqQ:WKJfsGQSMd4FoSfUyI8TLoFlP0innpdj
MD5:	F4CBFEAF378583171C5B3169AF4A0A6F
SHA1:	DCD2A1F74383D0709E79642E34137873BF745C99
SHA-256:	F3B8CB16381E8F0196B291044884116D3186810B018C9904CD6B0E4DF46B4F21
SHA-512:	FAF0FD935AE40CE9E4113422A5403E9F0733FC1E25D8F013672F874D6C2BDF0C8D875C778E7E04D54054FC5FEE7D04ED6E3B3BD5D0777F7357A144E225ED2658
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>..........."\\..iS..w)....m..._C"....!......<...a..+.F$,....c.;p.

C:\Users\user\Pictures\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.5763437637517175
Encrypted:	false
SSDEEP:	12:W9GQS+4qSsyI8TkFT4oT+GPt8fuCBQ6yxZXr+xUner:W9HSRqSw81sQOixl
MD5:	D6CD6F0BE07860B080155CB8A9E105A7
SHA1:	5F2E8F8A1BE87F5441B6C4EA344E76083B72B9A2
SHA-256:	8468AF0D239C3193965D4C2D57EF34994FEDF57BB53FEE9641720C51F8D3CCB8
SHA-512:	21118BDA561197CCD723EAA5A47E5EF3835AA8523013CBBCD2A8886E211E1E2DED931216B4510186B1070185BED2B22CA71C12E63282889510AF36ED54F0FF5A
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f...P..d...A..[.^..]t."5....Q..).u.iX5......7..V..j...t..~!.[.KA.L.n?..=..2.C..S..i..XrKY..d;8.Cc.aS...7..s..d.7..2v....~.]'.-..,6d.....v.:.&p>..`.z3.p@v..j)T..X.r.),.~.(v._V....mS>%.y.&...so^Y$.B....)....\|..&q......1....bY.C.k..G.s..}.r.....=..!U.^.;8..7.P....5.O...6..I...A.'....1...vH..)h.._.BSk..H.~2......_sxV....#......DQ...4.

C:\Users\user\Saved Games\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	7.187729905768397
Encrypted:	false
SSDEEP:	6:WKJfsGQSMd4FoSfUyI8TLoFlN/r4opY4/dl5YO7ZYYh0M6hslWnawA:W9GQS+4qSsyI8TkFT4H4SK96h6wA
MD5:	38F215E9C0BD61EDF7CDC0C790B2C6AB
SHA1:	FF1843D0A6594C718325B7214B150F867B2ECBC6
SHA-256:	E6D7941B2A78F6198615BD85D036D81FC1218AB810CC160F68265E8C77237071
SHA-512:	3DB8FD3FF5011630178C2D986588108614DDC4E9BA67F6BA93CF6514244437BF7183D00D029FC844CABE66541135A242AE8A6753E1BCEDB5A199884E45C747F3
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f...U...H/.......E.n.._%\|..JK.LT.i\|e..h.<...@......h.X...".q>.....w..2.I..!..#.;..%&......4.p..W.Z}Rp...w..-e<..x...>/....=

C:\Users\user\Searches\Everywhere.search-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	7.123761597686942
Encrypted:	false
SSDEEP:	6:91bk43l7TGXZ75jcuh0oUs3HJqTJRDn3zXCVN:rvl+vcudtHuJRjjXM
MD5:	D78F2EF0B6953045A2513775EEB8F093
SHA1:	28BBA96848019D34AAFADD68D508F65C7D6FB8D0
SHA-256:	B68D17522C5A67772FABB315D6FD196B666A9FB1B4253A5BD1FDC43F8FF474A4
SHA-512:	8F325D9AC1FA91B2E4644D2B9E82EC75D23F4FB53D61199F3AC534367B1AECD7303CBE3EAA9D625BB7570CAE66ED8AE5C3F69F36FFD4A98E412A7EBF3B527E37
Malicious:	false
Preview:	C........?V-.../}72M%..6.y).KK..Z.f .8..`..x%^W.....s..:W.]._3..\|m.n.....v..m..8.D../...4.NlD(.B..M.X%.....k...I.l.P2.up.<]3.......@'.*('\..-.......xl.lW...}.n.f.......O.n.l...c7h.l.0.r..w..X....c.}..!1...X4.g.......K..!.`E.j.=.J(...?n-...

C:\Users\user\Searches\Indexed Locations.search-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	7.212546972504132
Encrypted:	false
SSDEEP:	6:91bk43l7TGXZ75jcuh0oUs3HJqQOfxUwmPfkxSWJvOTtIn:rvl+vcudtH9wRpxSSOTtI
MD5:	C0E0F1E7E54916D57436B40A43486CAD
SHA1:	621A55006A66CCA3A42A3358BEFC1E6E2DCFBEDC
SHA-256:	D0735D7E5F7886D4482D1B42587FBB6B9D349AA3FD05C3A907C4A5AC8824504C
SHA-512:	2873FE236EB2BEBC31963C38BC1F5CBF48BEEDECF1B52A0F36119396A48A143E571AC2C8817661094270EFF75C04B5AB7E65B178A524AF3D4D03457568A29592
Malicious:	false
Preview:	C........?V-.../}72M%..6.y).KK..Z.f .8..`..x%^W.....s..:W.]._3..\|m.n.....v..m..8.D../...4.NlD(.B..M.X%.....k...I.l.P2.up.<]3.......@'.*('\..-.......xl.l\|4...sP..K...EjO.)....\...C..M...i....Y.X...'.y.....av.....$G0.7A+..D~...<.3.y..uI...7B..

C:\Users\user\Searches\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.596485403667924
Encrypted:	false
SSDEEP:	12:W9GQS+4qSsyI8TkFT4HENElDa69+8LUX+yp6L9bNFKmUih:W9HSRqSw81HENSDas+D/iNj
MD5:	0ADA2D2D604A53153B747063DDA521A5
SHA1:	EE615AD44211A1E2366C2552679EBA8E287665F1
SHA-256:	8EA6EF1E5B19BE20415D8B2D5351442516A1B09EB7D01A5D8CFEE1F18AA078C0
SHA-512:	9149F31618C87B19C0C09301AE8D58BFDE059CDD76DD863243EE519BF0DD0C0E7A6007C1FE283FB1667A27744A969306627F853DD6FB5DDA86FA2C6370E35587
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f.........n.,...x.x.=.!.D....?{.$..a.I.... Y~=...:G......J%.c..._....u.k...Vf.1.de..^.'.l.gs..W.5..n.....S..).p..D..............L.....).:..y..H.f.@........}x..@..zf.<b.j.n.TB.}.xx.?"..Y....\|.I^..V..MU..f.u.....x/.....Y.+..z..O:.m.Hj.........-Q.S...m.w9...f..1.%...4s...iR...jL....X..<.5...B%.._.M.}.4kQ6.Di.(;.ji.o...g=_.x..BjBg.N.z&..4#....0PuO

C:\Users\user\Searches\winrt--{S-1-5-21-3853321935-2125563209-4053062332-1002}-.searchconnector-ms.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	864
Entropy (8bit):	7.779085864898846
Encrypted:	false
SSDEEP:	24:r8+4sLtYZRHSOCHibReMcAZ6J7RfgEiOvb8jO/:Q+6kPccAZ6J7RfgpOvQjs
MD5:	65CA2E373035B1C1431632615E7EE71F
SHA1:	5A795EE7A31EC20812C3DC62159A153AC18D8E63
SHA-256:	41A2ACF54FD1F8538360A7460110F7A869109990D5AC69C7780D439AB3C5E277
SHA-512:	58128051325C5B46B217851932DA76D0212DB427EB6E6E5C793D4CCAC31C27D1AAA2551897380D10FD6A76EFE818E06A75DA93F608A48F86C006279BD572B893
Malicious:	false
Preview:	C........?V-.../!5w....V...h...\|j.O.yh~.1i..aO.Z.p.?...s.u..KW@.4\|......0"....u_..d..:.....j.y)-..8..TP&...4..o....A.Mb5...3-9...>$<S.F...(..p...6.......q..)...@.I..!..h.i-..:..9...6..q.<.....@.u.z.5]...-#No<.l..9O!./.$....s.....-!v..._...E~RD..x..{....H..~8.>nz..Q.6=.`.o..Hv.I..<.y..M2g/.....Y./K..%..O.........O[.`:P..........6...e.........c.-. ....c...J.r2.......r..}tQ...N....9...=...Y.(.HT.&n..... .R.A.....=..,..y.Y..L.f..{T.)..$.YF_n......).......@Fg8.V2.S.cD......ZJ\..../..Ucz.t...T.Z'..l....(.-N..}.L..~......*..6........Zm2.&..T..`.y!?...X."..........Tm....%..4.X;k.9.y<w..Oq...oG..ig..#Qj....n.HbF.....h..f..G..5.&.G...T.".X.T.._D.[..!G..].B31....G..mE.%.....:qgj...>.....ee.E .....r`.x"..L..P.aV....'....M...H.........n.....'.6.....1.4j.v...[%2k..h#?...?......._.\?...&...t{>...:G{.SL.....=.[.........%

C:\Users\user\Videos\desktop.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.568618671997419
Encrypted:	false
SSDEEP:	12:W9GQS+4qSsyI8TkFT4OzsZgVRR7cjSroSUJZDEfSlMN1K:W9HSRqSw81lyVRRAjscJZDEqKHK
MD5:	B1D2E5749DAE86DD0ED3EE996AB0C9CD
SHA1:	913A595571D74091474FC1745F08A59802318D60
SHA-256:	6A55F0C61BBACD09752843E705C649F4002476380A68051EAF5C394AE7C63F1E
SHA-512:	7773B8A5F38CE6017EF79CCD8BE859DAD2DB4D46BD0D6A5F53556856D6014C72E14B2E307599BD75A45A3828FD82960B4DD8E7FA64AD4FEA7CE0E8996A451F5E
Malicious:	false
Preview:	;kCu}%..Z.X...r......5.7.....xD..H`b.....`..2......VGW.9.0.m..p`...a.......f...[.:..:.Im..[).e-....P."1.>2.2..}`...h>.......^.U..D..Hf...Aiy.:..I.J.R..f........!.2...g^*e..u..K./.'rD.U.nH....F...........6..#?..l.!'3..\.A.@F..>x...WM).K.....q.H)@..s...O...Z.%Q...G".L.QL..~..h....#..qI.0f>`o..GS. ..,..[.waH.?..1..d`.....u.+..E.t...z.g,i.:....T.:.~.......oQ...":~iA....-...wt5...........PEo......\|.'l..j'.T....@.!.....O..s.....b4.tL=/..D.].p.[...Ew.J...8.Ey..Z.T.m...On...0..U..p.....\>C.

C:\Users\user\ntuser.dat.LOG1.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\ntuser.dat.LOG2.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	4.0
Encrypted:	false
SSDEEP:	3:2Ojkn:rjk
MD5:	C1A5BA70D35DF377A095B8672D47502E
SHA1:	460DE5FF781AA786194AA242D15ABA57AD2CA574
SHA-256:	32101FBC2F8B952469ECCA793A3A94CF8FCAECF5C51BB8AEAC32FDF8C8DF99F6
SHA-512:	7B99FA08B41814F52F869236A06C04333CC6B30F0F3B78B1542D9E11925EB61DE32610C15A501183FF3507755F9EC5E385E358ABF41AF865DFD3B34DE6252BFA
Malicious:	false
Preview:	....\%R.fg.tF.

C:\Users\user\ntuser.ini.tor

Download File

Process:	C:\Users\user\Desktop\1n8xsH3cmA.exe
File Type:	data
Category:	dropped
Size (bytes):	32
Entropy (8bit):	4.875
Encrypted:	false
SSDEEP:	3:LPjdpH9s:LPBpK
MD5:	191A7155FEBD0B69942258EE45B1C4C4
SHA1:	1278D9AB177503BD5EAD7DAF80D50D47FA54E310
SHA-256:	8A114A80ADD303F6F3D6B4A6E4C0B7D889CB51F75BE9CC7F6C12D5596793C3E7
SHA-512:	A3C85705DE567CAB6FF13FEE8FE8DF8DF79C20D1280BE53F07F18374240D250DA9A62D2BEA0227014116AAA09B25093E0FAE1EAD51EEBBBFE5C5C147E25EA293
Malicious:	false
Preview:	..g.`...F..v^.....&G{...-t%6].O

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.745832248993148
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	1n8xsH3cmA.exe
File size:	688128
MD5:	f9369d1c7fe1d2797d23f20ca19059a6
SHA1:	16e378519bbd97467f751064b17276f2408441d5
SHA256:	b30ef4dbcc89cd4bf0da3e7787f43e42023ddc2b5f0bb4f24937538e10e17533
SHA512:	acc38a05a8f5f272f068d91a61b5efa378839b398a372e67b62fbf65985ffb8846325d3c533e551bba88257e0eeb983259ee2860462b5a642d28599776a7970f
SSDEEP:	12288:mWVEtVuZqCUAgmh0kM9Vipj1cXWWTBz01W0ZJ9WE3QqH3cAb:9kk4A/6kWVipjMK333cAb
TLSH:	9EE42513DD04CB83D12883FC2A534F7C2AAE7F4A9542ABEB15715E9A3E312510D8F56E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...CF.c.....................n......./... ........@.. ....................................@................................

File Icon


Icon Hash:	400079f1f1793004

Static PE Info

General

Entrypoint:	0x4a2f2e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x63D04643 [Tue Jan 24 20:57:39 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa2edc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa4000	0x6be0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xac000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa0f34	0xa1000	False	0.7985218119177019	data	7.742473588286994	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xa4000	0x6be0	0x6c00	False	0.9488208912037037	data	7.838057981469173	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xac000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0xa4130	0x6664	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_GROUP_ICON	0xaa794	0x14	data
RT_VERSION	0xaa7a8	0x24c	data	English	United States
RT_MANIFEST	0xaa9f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 1, 2023 07:40:52.554502010 CET	62577	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:40:52.574172974 CET	53	62577	8.8.8.8	192.168.2.4
Feb 1, 2023 07:40:57.749294043 CET	51600	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:40:57.767086029 CET	53	51600	8.8.8.8	192.168.2.4
Feb 1, 2023 07:40:59.998949051 CET	57417	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:00.025151014 CET	53	57417	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:02.251585007 CET	50982	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:02.269659996 CET	53	50982	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:04.915523052 CET	60080	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:04.937436104 CET	53	60080	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:07.069888115 CET	61105	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:07.087308884 CET	53	61105	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:09.174134970 CET	56572	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:09.193711996 CET	53	56572	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:11.255511045 CET	50911	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:11.273062944 CET	53	50911	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:13.485815048 CET	59683	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:13.506020069 CET	53	59683	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:15.562845945 CET	64167	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:15.582310915 CET	53	64167	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:17.661140919 CET	58565	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:17.680577993 CET	53	58565	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:19.731033087 CET	52239	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:19.750838041 CET	53	52239	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:22.926158905 CET	56807	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:22.951287031 CET	53	56807	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:25.010592937 CET	61007	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:25.028712034 CET	53	61007	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:27.159133911 CET	60686	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:27.176966906 CET	53	60686	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:29.245709896 CET	61124	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:29.264195919 CET	53	61124	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:31.557573080 CET	59444	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:31.575387955 CET	53	59444	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:33.708190918 CET	55570	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:33.727781057 CET	53	55570	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:35.783741951 CET	64906	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:35.801273108 CET	53	64906	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:37.879940987 CET	59446	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:37.897274971 CET	53	59446	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:39.967783928 CET	50861	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:39.987658978 CET	53	50861	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:42.057149887 CET	61088	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:42.074673891 CET	53	61088	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:44.153201103 CET	58729	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:44.172727108 CET	53	58729	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:46.236661911 CET	64700	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:46.254574060 CET	53	64700	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:48.827490091 CET	56022	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:48.845614910 CET	53	56022	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:51.201853991 CET	60822	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:51.219350100 CET	53	60822	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:53.300367117 CET	49750	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:53.317907095 CET	53	49750	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:55.399344921 CET	60550	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:55.418943882 CET	53	60550	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:57.489021063 CET	54851	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:57.508701086 CET	53	54851	8.8.8.8	192.168.2.4
Feb 1, 2023 07:41:59.576605082 CET	57300	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:41:59.596312046 CET	53	57300	8.8.8.8	192.168.2.4
Feb 1, 2023 07:42:01.711235046 CET	54521	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:42:01.728765965 CET	53	54521	8.8.8.8	192.168.2.4
Feb 1, 2023 07:42:03.834976912 CET	58914	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:42:03.852781057 CET	53	58914	8.8.8.8	192.168.2.4
Feb 1, 2023 07:42:21.455688000 CET	51419	53	192.168.2.4	8.8.8.8
Feb 1, 2023 07:42:21.474307060 CET	53	51419	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 1, 2023 07:40:52.554502010 CET	192.168.2.4	8.8.8.8	0xe8d8	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:40:57.749294043 CET	192.168.2.4	8.8.8.8	0x79ba	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:40:59.998949051 CET	192.168.2.4	8.8.8.8	0x137e	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:02.251585007 CET	192.168.2.4	8.8.8.8	0x7297	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:04.915523052 CET	192.168.2.4	8.8.8.8	0x4b7d	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:07.069888115 CET	192.168.2.4	8.8.8.8	0x3033	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:09.174134970 CET	192.168.2.4	8.8.8.8	0xc3c8	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:11.255511045 CET	192.168.2.4	8.8.8.8	0xa583	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:13.485815048 CET	192.168.2.4	8.8.8.8	0xc2d	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:15.562845945 CET	192.168.2.4	8.8.8.8	0x2ce5	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:17.661140919 CET	192.168.2.4	8.8.8.8	0x9175	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:19.731033087 CET	192.168.2.4	8.8.8.8	0x709	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:22.926158905 CET	192.168.2.4	8.8.8.8	0x15	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:25.010592937 CET	192.168.2.4	8.8.8.8	0x5d23	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:27.159133911 CET	192.168.2.4	8.8.8.8	0x2924	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:29.245709896 CET	192.168.2.4	8.8.8.8	0x1de9	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:31.557573080 CET	192.168.2.4	8.8.8.8	0xe581	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:33.708190918 CET	192.168.2.4	8.8.8.8	0x88ce	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:35.783741951 CET	192.168.2.4	8.8.8.8	0x9d41	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:37.879940987 CET	192.168.2.4	8.8.8.8	0x2aa4	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:39.967783928 CET	192.168.2.4	8.8.8.8	0xca68	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:42.057149887 CET	192.168.2.4	8.8.8.8	0x6e8a	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:44.153201103 CET	192.168.2.4	8.8.8.8	0xd8d5	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:46.236661911 CET	192.168.2.4	8.8.8.8	0x8aa1	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:48.827490091 CET	192.168.2.4	8.8.8.8	0x2640	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:51.201853991 CET	192.168.2.4	8.8.8.8	0x5a43	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:53.300367117 CET	192.168.2.4	8.8.8.8	0x76c9	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:55.399344921 CET	192.168.2.4	8.8.8.8	0xb9da	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:57.489021063 CET	192.168.2.4	8.8.8.8	0x3b86	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:59.576605082 CET	192.168.2.4	8.8.8.8	0x8823	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:42:01.711235046 CET	192.168.2.4	8.8.8.8	0x6cf7	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:42:03.834976912 CET	192.168.2.4	8.8.8.8	0xd58b	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:42:21.455688000 CET	192.168.2.4	8.8.8.8	0x1429	Standard query (0)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 1, 2023 07:40:52.574172974 CET	8.8.8.8	192.168.2.4	0xe8d8	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:40:57.767086029 CET	8.8.8.8	192.168.2.4	0x79ba	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:00.025151014 CET	8.8.8.8	192.168.2.4	0x137e	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:02.269659996 CET	8.8.8.8	192.168.2.4	0x7297	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:04.937436104 CET	8.8.8.8	192.168.2.4	0x4b7d	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:07.087308884 CET	8.8.8.8	192.168.2.4	0x3033	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:09.193711996 CET	8.8.8.8	192.168.2.4	0xc3c8	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:11.273062944 CET	8.8.8.8	192.168.2.4	0xa583	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:13.506020069 CET	8.8.8.8	192.168.2.4	0xc2d	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:15.582310915 CET	8.8.8.8	192.168.2.4	0x2ce5	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:17.680577993 CET	8.8.8.8	192.168.2.4	0x9175	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:19.750838041 CET	8.8.8.8	192.168.2.4	0x709	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:22.951287031 CET	8.8.8.8	192.168.2.4	0x15	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:25.028712034 CET	8.8.8.8	192.168.2.4	0x5d23	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:27.176966906 CET	8.8.8.8	192.168.2.4	0x2924	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:29.264195919 CET	8.8.8.8	192.168.2.4	0x1de9	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:31.575387955 CET	8.8.8.8	192.168.2.4	0xe581	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:33.727781057 CET	8.8.8.8	192.168.2.4	0x88ce	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:35.801273108 CET	8.8.8.8	192.168.2.4	0x9d41	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:37.897274971 CET	8.8.8.8	192.168.2.4	0x2aa4	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:39.987658978 CET	8.8.8.8	192.168.2.4	0xca68	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:42.074673891 CET	8.8.8.8	192.168.2.4	0x6e8a	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:44.172727108 CET	8.8.8.8	192.168.2.4	0xd8d5	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:46.254574060 CET	8.8.8.8	192.168.2.4	0x8aa1	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:48.845614910 CET	8.8.8.8	192.168.2.4	0x2640	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:51.219350100 CET	8.8.8.8	192.168.2.4	0x5a43	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:53.317907095 CET	8.8.8.8	192.168.2.4	0x76c9	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:55.418943882 CET	8.8.8.8	192.168.2.4	0xb9da	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:57.508701086 CET	8.8.8.8	192.168.2.4	0x3b86	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:41:59.596312046 CET	8.8.8.8	192.168.2.4	0x8823	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:42:01.728765965 CET	8.8.8.8	192.168.2.4	0x6cf7	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:42:03.852781057 CET	8.8.8.8	192.168.2.4	0xd58b	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false
Feb 1, 2023 07:42:21.474307060 CET	8.8.8.8	192.168.2.4	0x1429	Name error (3)	f6yl7nwy5qujxfcf75nqdikqavdnrnflw5ro442wyusgagyelxsjxyqd.onion	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	07:40:01
Start date:	01/02/2023
Path:	C:\Users\user\Desktop\1n8xsH3cmA.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\1n8xsH3cmA.exe
Imagebase:	0x240000
File size:	688128 bytes
MD5 hash:	F9369D1C7FE1D2797D23F20CA19059A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	07:40:38
Start date:	01/02/2023
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6680e0000
File size:	111120 bytes
MD5 hash:	D179D03728E95E040A889F760C1FC402
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	07:40:46
Start date:	01/02/2023
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\OpenWith.exe -Embedding
Imagebase:	0x7ff6680e0000
File size:	111120 bytes
MD5 hash:	D179D03728E95E040A889F760C1FC402
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Function 00007FF8198FCADA Relevance: 12.1, Strings: 4, Instructions: 7116COMMON

Download Yara Rule

Strings

XN9v, xrefs: 00007FF8198FCEAD
Pl9v, xrefs: 00007FF8198FCF1B
Pl9v, xrefs: 00007FF8198FCB3D
@v7v, xrefs: 00007FF8198FD0D3

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID: @v7v$Pl9v$Pl9v$XN9v
API String ID: 0-1330735582
Opcode ID: b5e50c3824be58689ec8b0349b7c1c493b976d6cdc3941eda4ee8dd7b0c1c70c
Instruction ID: 24f17b1318847a80d137b4c750614dc0e19dbc85dbb92d93f413b47b5335a6bb
Opcode Fuzzy Hash: b5e50c3824be58689ec8b0349b7c1c493b976d6cdc3941eda4ee8dd7b0c1c70c
Instruction Fuzzy Hash: F5D3AA3061CB88CFD7B4EB18C894BDAB7E1FF99345F540969E18DC7252DA70A881CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F04F5 Relevance: 9.2, Strings: 4, Instructions: 4173COMMON

Download Yara Rule

Strings

0VIx, xrefs: 00007FF8198F283E
PCGx, xrefs: 00007FF8198F0948
0VIx, xrefs: 00007FF8198F272F
0VIx, xrefs: 00007FF8198F27FF

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID: 0VIx$0VIx$0VIx$PCGx
API String ID: 0-2909316045
Opcode ID: 399be2a6758fa488fa2026f61e374f9e90f153c596576188013fd7ed9fa9b136
Instruction ID: 6541fa3d959820dbf007a5c8209173d911f5951c92efc5d8b5e4129e856c307d
Opcode Fuzzy Hash: 399be2a6758fa488fa2026f61e374f9e90f153c596576188013fd7ed9fa9b136
Instruction Fuzzy Hash: B88322706196CD8FEBB2DF2888547E93BE1FF16344F5401AAD84CCB292DB789A44CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF819905571 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

H1Gx, xrefs: 00007FF819905683

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID: H1Gx
API String ID: 0-3148546213
Opcode ID: 875e743fb561eaba41c38eec1abffab8cc7b235603db3d9ba60cf91d06ef9148
Instruction ID: 41f952fbb830640e556452462155bcae16976bac9b5c96d1e50457d9ff947cc0
Opcode Fuzzy Hash: 875e743fb561eaba41c38eec1abffab8cc7b235603db3d9ba60cf91d06ef9148
Instruction Fuzzy Hash: F751B471518A8C9FDF81EF18C889BD83BE0FF29355F5511A6E849C7262CB74E884CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FC95D Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

Pl9v, xrefs: 00007FF8198FC9F3

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID: Pl9v
API String ID: 0-476494665
Opcode ID: 3f75041c9a68826853bf08ae36e94e63e5eea6d6e55fdaeb6bda28e76ea76534
Instruction ID: 03e4f3f5a2135fcb87efea36b72e5956ee4d4cb595377f3ae2d400e15e362583
Opcode Fuzzy Hash: 3f75041c9a68826853bf08ae36e94e63e5eea6d6e55fdaeb6bda28e76ea76534
Instruction Fuzzy Hash: D5413A71A1CB85CFD7A4EF18C885AAAB7E0FF99740F04486ED08DC7156DE346881CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FC951 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

Pl9v, xrefs: 00007FF8198FC9F3

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID: Pl9v
API String ID: 0-476494665
Opcode ID: 7e057b4c33990ee363835b73119a5f65917e618b45c2780e22b0493ba96a9623
Instruction ID: 7813a3a73a7cdcd9a726483952a8598a90a9990e3a42170e240279e533c4e3ac
Opcode Fuzzy Hash: 7e057b4c33990ee363835b73119a5f65917e618b45c2780e22b0493ba96a9623
Instruction Fuzzy Hash: FD31B875A18B85CFDAB0EF18C495BAA77E0FF99741F108969D0CDC3156DE346841CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF819905CA5 Relevance: 1.0, Instructions: 990COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4239db5679be8c56a0690d0b6779777daf2b39a4705eb58ed5fa0c8fd68de480
Instruction ID: 9831f94a8e56d56e906db8c0cf4f475277f194addbe0f04ad1ed96c934186707
Opcode Fuzzy Hash: 4239db5679be8c56a0690d0b6779777daf2b39a4705eb58ed5fa0c8fd68de480
Instruction Fuzzy Hash: 2482FE71509BCC8FDBA6DF288894BE83BB1EF5A341F45419AD84CCF2A3DA349A44C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF819906804 Relevance: .5, Instructions: 512COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2ef042cb5dad8a8fbc8d58adae967a7d12c2c55b55e7dedccd7fb97c3011b1f
Instruction ID: ea78f2e64063cebad5279cc20014e1bdcbe97a9323488ef0e27a3a9f86669449
Opcode Fuzzy Hash: e2ef042cb5dad8a8fbc8d58adae967a7d12c2c55b55e7dedccd7fb97c3011b1f
Instruction Fuzzy Hash: E312E271618A8C8FDBA6DF2CC854BD83BE0FF1A341F4541A6E84DCB262DB349984CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F0189 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f21611055a16e1c796d158293cd5bb21a5f7b81b12c067217275a1dd2464217
Instruction ID: 2bac847fb789732b271834944bd2cae905a001196f9251d331279d9af6b9b54e
Opcode Fuzzy Hash: 4f21611055a16e1c796d158293cd5bb21a5f7b81b12c067217275a1dd2464217
Instruction Fuzzy Hash: 56B15952D0EBC64FD787DB3848216297FB19F5728578A00EBC088CF2E7D5289D49C366

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FC3D1 Relevance: .3, Instructions: 290COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3b08b8b596cdf665f372b5148622f3c73e523ad1f9d13774c89444eeab1ccfc
Instruction ID: 757d4a716d7029e882c5f6dc9bf6196ed0d884449de2bc2b4bfa18aa402aaa92
Opcode Fuzzy Hash: c3b08b8b596cdf665f372b5148622f3c73e523ad1f9d13774c89444eeab1ccfc
Instruction Fuzzy Hash: 48A16D62A1DBC88FE746DB3888606257FF1EF67385B4905DED488CB2A3D9249D44C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F7E26 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48d3cee29a0b9a9ad5eb8f8159dece6b1e04105247df6eed519215d25af51419
Instruction ID: e5356b3980c1434e06e14cde428a3bf662d5ade424cc9851172ec3721e7cb1ae
Opcode Fuzzy Hash: 48d3cee29a0b9a9ad5eb8f8159dece6b1e04105247df6eed519215d25af51419
Instruction Fuzzy Hash: 8B91517152898D9FEB94EF18C885BE93BE0FF58394F94116AF80EC7192DB349885CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F9669 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f74e460fdfa19e3cbd9f18c2177c15308dd3f390ff883cbdd403ed3281bcf66
Instruction ID: 7bc35155904b5932911a8331943d36f7b679286fc1b519142ce755b17a8934ad
Opcode Fuzzy Hash: 5f74e460fdfa19e3cbd9f18c2177c15308dd3f390ff883cbdd403ed3281bcf66
Instruction Fuzzy Hash: 07912F70528A8D9FDB94DF18C898BE93BE0FF58355F941169F80DC7192DB359884CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FB28F Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3466bdcdae17e72929b300ba0becda0880fec45417ffc78bfc806da4f7bfbd
Instruction ID: 674bc57a5bf5842e918582c4832ae1497fd35e8c6f4a4f4ee414fe03f0807a4a
Opcode Fuzzy Hash: 8a3466bdcdae17e72929b300ba0becda0880fec45417ffc78bfc806da4f7bfbd
Instruction Fuzzy Hash: B5A1A470618A8DCFDBA5DF28C884BE93BE0FF19345F44416AE84DCB291DB74A984CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F937D Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26ce239e1185c050ec2980d50963d5168f1fe3e0edab51aa8d7ff53e5bdd58b0
Instruction ID: 16423b7daa256b39ca045f4329137b209dde69b300c7eb9050c48aeafb1da046
Opcode Fuzzy Hash: 26ce239e1185c050ec2980d50963d5168f1fe3e0edab51aa8d7ff53e5bdd58b0
Instruction Fuzzy Hash: D471B230918A8D8FEB94DF28C885BF93BE1FF59354F5401AAE84DC7192DE399884C784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F47C1 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97fd500144f34a8a8d918f2010b86194d120e0d34fc60150b0dc0296d0ba3fb2
Instruction ID: 381766d89a167ae1ee3fa4c23e54b7a5670f9fb4d3d10ed7d427e5d6e644f6a4
Opcode Fuzzy Hash: 97fd500144f34a8a8d918f2010b86194d120e0d34fc60150b0dc0296d0ba3fb2
Instruction Fuzzy Hash: 09812C71618A8D9FEB91DF28C845BE87FE0FF19344F5511AAE84CC7292DB349984CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF819905749 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8578f47734776d1a68bee0fabb17e6014490f0f3d14623060030eb2589de1d17
Instruction ID: 3eb7ee04e1e5e9b3eec98bde726c240c6268a57c750af56e0fdb25d3028b1713
Opcode Fuzzy Hash: 8578f47734776d1a68bee0fabb17e6014490f0f3d14623060030eb2589de1d17
Instruction Fuzzy Hash: 76713F71918ACD8FEB91DF28C8457E83BE0FF19384F5501A6E85DC7292DB34A984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F9B26 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d44e1fdd0aecbf4fc113c74d8ff0cd4c006a99ae639643777c41084b07fe0b9
Instruction ID: 149cdc60d02f6c24fd1c5185bd62220c2f75fe31a224d93b23c0822cc0a6e1cd
Opcode Fuzzy Hash: 9d44e1fdd0aecbf4fc113c74d8ff0cd4c006a99ae639643777c41084b07fe0b9
Instruction Fuzzy Hash: F071C670918A8D8FEB94DF28C845BE87BE0FF19394F654165E80DC7292DB35E984CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F4595 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4097ad687e9f4ae35e7f91bf19e2fd444ffac651c61af9d8d8795efd9318d33
Instruction ID: 7711c2b1a8d0e5366befbad4b4bc6c8d9f82207b79d2728aae236f012897479c
Opcode Fuzzy Hash: c4097ad687e9f4ae35e7f91bf19e2fd444ffac651c61af9d8d8795efd9318d33
Instruction Fuzzy Hash: 6761DA71909BCC8FDB86DF2C8854A993FF0FF1A381F55419AE848CB2A2DA34D944CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F5559 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b6019891141973508b2eff642612f50333738b235e50a7a1c6de59557db918
Instruction ID: 95c1d350103170cff92a68627418ba06c10f763163eab7048d5b92c1fd04158f
Opcode Fuzzy Hash: 50b6019891141973508b2eff642612f50333738b235e50a7a1c6de59557db918
Instruction Fuzzy Hash: 74518E7151CB8C8FDBA5DF18C845BE97BE0FB19310F50416AE84DC7252DB34A649CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FB075 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3bb2852fcc761fd0fb7b8d3bf18d3039573da47700e3e365aac99237984dc0
Instruction ID: 0d8f0bacb8dcb097d5282ba4f5520d4bc37a7c248277bdc80fd8cc5989ab5319
Opcode Fuzzy Hash: 1a3bb2852fcc761fd0fb7b8d3bf18d3039573da47700e3e365aac99237984dc0
Instruction Fuzzy Hash: 42613D71918B8D8FEB91DF28C855BA93FE0FF19344F5441A9E84CCB292CB789944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F45C0 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d2c17ceab5ba5fad2f82112a6723301f039625350a27f7e4b135b2331680b6f
Instruction ID: a4f2693c4cbc9bf3754acaf299cdfd2e770c7eb100d3b22959509c765c388032
Opcode Fuzzy Hash: 7d2c17ceab5ba5fad2f82112a6723301f039625350a27f7e4b135b2331680b6f
Instruction Fuzzy Hash: 1151D871918B8C8FDB82EF2CC854B993FE0FF1A385F554196E849CB292DA34D9848B51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F41E5 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc2da13f6ea33860273676d928275451db7313987b0683b9401346e3433f93a
Instruction ID: 3f343e97879bba168a221ef458aed7ab18ecfe2b4e1b3429a0cdb3db9b3372ee
Opcode Fuzzy Hash: 6fc2da13f6ea33860273676d928275451db7313987b0683b9401346e3433f93a
Instruction Fuzzy Hash: 5F51AF3191DBC98FDB46DF2CC851BA93FE0FF56344F5901AAE848CB193DA28A984C751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF819904F35 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4af41c70435359196f56af5684cd538e113026f39fb36e81d87de4d6b9bbea1
Instruction ID: 6bd572dc1e93e69047f246c26c99fd4897aaed62979fc90d874ea4005114e38c
Opcode Fuzzy Hash: c4af41c70435359196f56af5684cd538e113026f39fb36e81d87de4d6b9bbea1
Instruction Fuzzy Hash: 4D41A16291DBC94FD792DB2C88556297FF0FF9B390F4905EAE088CB1A3D6289C448752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FAED5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1655f74642e6306964cac2c03f9be8d2c1f3a5dc0a9cf52ba471be3c8dd7b44
Instruction ID: 6c11d04d6b4251f7d61bb631a7097153b0e522f5dc40b5055d7a0401c78aba13
Opcode Fuzzy Hash: b1655f74642e6306964cac2c03f9be8d2c1f3a5dc0a9cf52ba471be3c8dd7b44
Instruction Fuzzy Hash: 5B41846291DBC58FD392DB2C88517257FF0FF9A390F4505EAE089CB2A3D6249C44C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF819904111 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31f758ec2b894518d4a1b2912bd5974841038f2f2deda9d86a9cdf737f78361d
Instruction ID: de645edaddef75979f2cb55a80d3ed17fbe92bc9607d2749c473f568e3a5c9ba
Opcode Fuzzy Hash: 31f758ec2b894518d4a1b2912bd5974841038f2f2deda9d86a9cdf737f78361d
Instruction Fuzzy Hash: D041AE3151CACD9FDB81DF28C885BE93BA0FF15344F4801A9E858C7192D778E954CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF819904765 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c037c933b1c278b0c15c7d907be2a1273a5721dd572406bb9312fdd81d8f6f
Instruction ID: 1f08c3e1e0a3b9dccc6087e1eef45fff123ab91010c4b29bdd00f6a11209de5a
Opcode Fuzzy Hash: 40c037c933b1c278b0c15c7d907be2a1273a5721dd572406bb9312fdd81d8f6f
Instruction Fuzzy Hash: DB31D87180DFC89FD781DF2C84497257BE4FF59350F4806F9E08CCB1A2EA2899448701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF819905A21 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 520a8940b8098d37bfe1af45a5bed6bce03fca8b37e4cc0a438e498dae607501
Instruction ID: 08eb30d38b8e477c03aa5d0abbc0a3c536f92c2973a61b432b5f0e76452bcc0f
Opcode Fuzzy Hash: 520a8940b8098d37bfe1af45a5bed6bce03fca8b37e4cc0a438e498dae607501
Instruction Fuzzy Hash: 6221947190DBC84FD382DF288869A197FF0FF5A350F5905EEE088CB1A3DA289945C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF819904C05 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1940c2609dadefe571c42bbee9bbc44257ffc82f34b574369898ed8902e64fda
Instruction ID: d7bcc2666c7b9c84e0ddc10d9dd8d34d72f576fdf32d1ba73d174648a9514794
Opcode Fuzzy Hash: 1940c2609dadefe571c42bbee9bbc44257ffc82f34b574369898ed8902e64fda
Instruction Fuzzy Hash: 6121847181CBC89FD381DF288459B557FE0FF5A344F4805EEE088C71A2EA289944C712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F43B1 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 884a9a117059cafd6b5428d620f121ab4855177fd77a4178bb717d4162a10bab
Instruction ID: 51481bfd778aba138038b3c91a2ddc05671c3397b1894ce7047177cac25b5b56
Opcode Fuzzy Hash: 884a9a117059cafd6b5428d620f121ab4855177fd77a4178bb717d4162a10bab
Instruction Fuzzy Hash: 7121AE71919A8D9FEB41DF28C8897E83FA0FF29394F4442A6E84CCB152D638D894C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FC6B1 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93e6a5948b145d545b958bc5b586c820d27655402d1d4a220deab27d136d41c2
Instruction ID: ddace57e69b4934d487ff84ba0479fa52392aaa5f25844d6617139a4ead8d402
Opcode Fuzzy Hash: 93e6a5948b145d545b958bc5b586c820d27655402d1d4a220deab27d136d41c2
Instruction Fuzzy Hash: 9E11307191CE889FE381DF28C445B6ABBE1FF99354F841A69F08DD71A2D7289944C702

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FABFD Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c55c062ff327b5eaa780c0056a33105d65b81818306559220bf654a3a8362cd
Instruction ID: f7dc63dceca612d5b89f8f0a4b242c9c452a0c69e26a0ebad9556bcc34c887fb
Opcode Fuzzy Hash: 2c55c062ff327b5eaa780c0056a33105d65b81818306559220bf654a3a8362cd
Instruction Fuzzy Hash: B611E96191DAC84FD3D1DF288846B65BFE0FF95254F5446AED0CCC7192EA3499448712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198F44B9 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 147d73b553680297ee8d5d43c6c5233ec672bb9b4164eed02b90ac47b890e1c7
Instruction ID: bb80537d28055354e7694182e3eb6c783ef7fd3461b4eb1818261ca782826ebc
Opcode Fuzzy Hash: 147d73b553680297ee8d5d43c6c5233ec672bb9b4164eed02b90ac47b890e1c7
Instruction Fuzzy Hash: 6E018C71819ACD9FDB41DF2888597A83FE0FF19354F5592EBE848CB092D738A584CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FAD43 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49e91003bbdae598299f218cb381fe0a87e013f495d668b13a0c0740d133d1b
Instruction ID: dcbec12b575438a0d98fd1db3662e6e37bd84ae49a968f6e9244cab914d766da
Opcode Fuzzy Hash: c49e91003bbdae598299f218cb381fe0a87e013f495d668b13a0c0740d133d1b
Instruction Fuzzy Hash: 86F06221A1CBC98FD391DF588451539B7E0FF8A395F8005BAE08DC7282DA2898418712

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8198FACC4 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.603075177.00007FF8198F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8198F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff8198f0000_1n8xsH3cmA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6bb5cf221ed345004f92f6b0b03b06d0924b4419d31f10de43f30c06028b06a
Instruction ID: 530df406b6fcbbd1fe80ab7f31456776a4f8368a3d48355a48c7acb639e3b47c
Opcode Fuzzy Hash: f6bb5cf221ed345004f92f6b0b03b06d0924b4419d31f10de43f30c06028b06a
Instruction Fuzzy Hash: FFF03061A1CAC9CFD391DF5C8451639B7E0FF8A395F9405BAF08DCB682EA2899418712

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	To disguise the source of malicious traffic, adversaries may chain together multiple proxies. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Network protocol analysis
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1n8xsH3cmA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\3D Objects\desktop.ini.tor

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\container.dat.tor

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat.tor

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\container.dat.tor

C:\Users\user\AppData\Local\Temp\Cry.img

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.tor

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.tor

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.tor

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.tor

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.tor

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.tor

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.tor

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.tor

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tor

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL.tor

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL.tor

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL.tor

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL.tor

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.tor

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl.tor

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL.tor

C:\Users\user\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL.tor

Windows Analysis Report
1n8xsH3cmA.exe