Joe Sandbox Cloud Basic Analysis Report
Create Interactive Tour

Windows Analysis Report
lz8n630Nxt

Overview

General Information

Sample Name:lz8n630Nxt (renamed file extension from none to exe)
Analysis ID:588372
MD5:3b3a50b242841e1789a919b1291051f1
SHA1:7b74a50352bb16ba94201c8a9e35b3c1d8a9dc8c
SHA256:9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37
Tags:exe

Detection

Score:48
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Checks for available system drives (often done to infect USB drives)
PE file contains sections with non-standard names

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • lz8n630Nxt.exe (PID: 6548 cmdline: "C:\Users\user\Desktop\lz8n630Nxt.exe" MD5: 3B3A50B242841E1789A919B1291051F1)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Joe Sandbox Signatures

  • • AV Detection
  • • Compliance
  • • Spreading
  • • Networking
  • • System Summary
  • • Data Obfuscation
  • • Malware Analysis System Evasion
  • • Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: lz8n630Nxt.exeVirustotal: Detection: 38%Perma Link
Source: lz8n630Nxt.exeReversingLabs: Detection: 38%
Source: lz8n630Nxt.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: z:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: x:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: v:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: t:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: r:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: p:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: n:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: l:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: j:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: h:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: f:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: b:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: y:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: w:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: u:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: s:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: q:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: o:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: m:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: k:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: i:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: g:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: e:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: c:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: a:Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Application Data\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Application Data\Application Data\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Jump to behavior
Source: RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html0.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html5.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html14.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html19.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html3.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html1.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html4.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html15.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html8.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html12.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html10.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html11.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html17.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html2.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html7.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html21.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html20.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html6.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html18.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html9.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html16.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html13.0.drString found in binary or memory: </b></p><p class="line2"></p></div></div><div class="col-md-5"> <div class="v1"> <iframe width="380" height="200" src="https://www.youtube.com/embed/scLoZQRi4eE"></iframe> </div><div class="v2"> <iframe width="380" height="200" src="https://player.vimeo.com/video/682484326?h=6a561cb963"></iframe> </div><div class="v3"> <iframe width="380" height="200" src="https://player.vimeo.com/video/682485106?h=1f808323cd"></iframe> </div></div></div></div><script src="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js" integrity="sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM" crossorigin="anonymous"></script> </body> <style>body{background-color: rgb(199 equals www.youtube.com (Youtube)
Source: lz8n630Nxt.exeString found in binary or memory: </b></p><p class="line2"></p></div></div><div class="col-md-5"> <div class="v1"> <iframe width="380" height="200" src="https://www.youtube.com/embed/scLoZQRi4eE"></iframe> </div><div class="v2"> <iframe width="380" height="200" src="https://player.vimeo.com/video/682484326?h=6a561cb963"></iframe> </div><div class="v3"> <iframe width="380" height="200" src="https://player.vimeo.com/video/682485106?h=1f808323cd"></iframe> </div></div></div></div><script src="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js" integrity="sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM" crossorigin="anonymous"></script> </body> <style>body{background-color: rgb(199, 5, 5);}.p1{margin-top: 30px;}.p1, .p2, .p3, .p4, .p5, .p6{color: white; text-align: center;}.p1, .p2{font-size: 36px; margin-bottom: 0;}.p3{margin-top: 50px; font-size: 18px;}.p4{font-size: 18px;}.p5{margin-top: 10px; font-size: 20px;}.p6{font-size: 24px;}hr{border-top: 5px solid white;}.line1, .line2{width: 90%; margin: 0 auto; height: 2px; background-color: white;}.line1{margin-top: 50px; margin-bottom: 10px;}.v1{margin-top: 60px; margin-left: 60px; margin-bottom: 20px;}.v3{margin-top: 20px; margin-left: 60px;}</style></html> equals www.youtube.com (Youtube)
Source: lz8n630Nxt.exeString found in binary or memory: </b></p><p class="line2"></p></div></div><div class="col-md-5"> <div class="v1"> <iframe width="380" height="200" src="https://www.youtube.com/embed/scLoZQRi4eE"></iframe> </div><div class="v2"> <iframe width="380" height="200" src="https://player.vimeo.com/video/682484326?h=6a561cb963"></iframe> </div><div class="v3"> <iframe width="380" height="200" src="https://player.vimeo.com/video/682485106?h=1f808323cd"></iframe> </div></div></div></div><script src="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/js/bootstrap.bundle.min.js" integrity="sha384-MrcW6ZMFYlzcLA8Nl+NtUVF0sA7MsXsP1UyJoMp4YLEuNSfAP+JcXn/tWtIaxVXM" crossorigin="anonymous"></script> </body> <style>body{background-color: rgb(199, 5, 5);}.p1{margin-top: 30px;}.p1, .p2, .p3, .p4, .p5, .p6{color: white; text-align: center;}.p1, .p2{font-size: 36px; margin-bottom: 0;}.p3{margin-top: 50px; font-size: 18px;}.p4{font-size: 18px;}.p5{margin-top: 10px; font-size: 20px;}.p6{font-size: 24px;}hr{border-top: 5px solid white;}.line1, .line2{width: 90%; margin: 0 auto; height: 2px; background-color: white;}.line1{margin-top: 50px; margin-bottom: 10px;}.v1{margin-top: 60px; margin-left: 60px; margin-bottom: 20px;}.v3{margin-top: 20px; margin-left: 60px;}</style></html>( equals www.youtube.com (Youtube)
Source: RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html13.0.drString found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: lz8n630Nxt.exe, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html0.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html5.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html14.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html19.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html3.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html1.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html4.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html15.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html8.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html12.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html10.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html11.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html17.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html2.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html7.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html21.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html20.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html6.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html18.0.drString found in binary or memory: https://player.vimeo.com/video/682484326?h=6a561cb963
Source: lz8n630Nxt.exe, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html0.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html5.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html14.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html19.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html3.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html1.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html4.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html15.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html8.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html12.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html10.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html11.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html17.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html2.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html7.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html21.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html20.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html6.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html18.0.drString found in binary or memory: https://player.vimeo.com/video/682485106?h=1f808323cd
Source: lz8n630Nxt.exe, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html0.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html5.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html14.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html19.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html3.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html1.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html4.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html15.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html8.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html12.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html10.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html11.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html17.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html2.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html7.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html21.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html20.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html6.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html18.0.drString found in binary or memory: https://www.youtube.com/embed/scLoZQRi4eE
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile created: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.htmlJump to behavior
Source: lz8n630Nxt.exeVirustotal: Detection: 38%
Source: lz8n630Nxt.exeReversingLabs: Detection: 38%
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile created: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.htmlJump to behavior
Source: lz8n630Nxt.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\lz8n630Nxt.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: lz8n630Nxt.exeString found in binary or memory: --help
Source: lz8n630Nxt.exeString found in binary or memory: --help
Source: lz8n630Nxt.exeString found in binary or memory: Duplicate of argument name: --helphelp found insteadPoisitional argument expected at the end, but argument , but argument Poisitional argument expected in position Required argument not found: expected in position Argument ---Current argument left open'Unrecognized command line option 'Malformed argument: Too few arguments given for Too many arguments given for _encrypt_file\find_files_recursive\*find_paths_recursiveDllLoadImport\\?\:mainrpathlpathMicrosoft Corporationnet%p
Source: lz8n630Nxt.exeString found in binary or memory: Duplicate of argument name: --helphelp found insteadPoisitional argument expected at the end, but argument , but argument Poisitional argument expected in position Required argument not found: expected in position Argument ---Current argument left open'Unrecognized command line option 'Malformed argument: Too few arguments given for Too many arguments given for _encrypt_file\find_files_recursive\*find_paths_recursiveDllLoadImport\\?\:mainrpathlpathMicrosoft Corporationnet%p
Source: NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf.putinwillburninhell.0.drBinary string: \Device\HarddiskVolume4\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf
Source: classification engineClassification label: mal48.winEXE@1/31@0/0
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile read: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ad05575-8857-4850-9277-11b85bdb8e09}\InProcServer32Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeMutant created: \Sessions\1\BaseNamedObjects\????4?????n
Source: lz8n630Nxt.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: lz8n630Nxt.exeStatic PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: lz8n630Nxt.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: lz8n630Nxt.exeStatic PE information: section name: _RDATA
Source: C:\Users\user\Desktop\lz8n630Nxt.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Application Data\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Application Data\Application Data\Application Data\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeFile opened: C:\Documents and Settings\Default\Local Settings\Application Data\Jump to behavior
Source: C:\Users\user\Desktop\lz8n630Nxt.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
1
Replication Through Removable Media		2
Command and Scripting Interpreter		Path InterceptionPath InterceptionDirect Volume AccessOS Credential Dumping1
Process Discovery		1
Replication Through Removable Media		Data from Local SystemExfiltration Over Other Network Medium1
Ingress Tool Transfer		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS Memory11
Peripheral Device Discovery		Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account Manager2
File and Directory Discovery		SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDS2
System Information Discovery		Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 588372 Sample: lz8n630Nxt Startdate: 14/03/2022 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 5 lz8n630Nxt.exe 263 2->5         started        process3 file4 8 C:\bootTel.dat.putinwillburninhell, COM 5->8 dropped

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
lz8n630Nxt.exe38%VirustotalBrowse
lz8n630Nxt.exe9%MetadefenderBrowse
lz8n630Nxt.exe38%ReversingLabsWin64.Ransomware.Encoder

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

SourceDetectionScannerLabelLink
dual-a-0001.dc-msedge.net0%VirustotalBrowse

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
dual-a-0001.dc-msedge.net
131.253.33.200
truefalseunknown
NameSourceMaliciousAntivirus DetectionReputation
https://player.vimeo.com/video/682484326?h=6a561cb963lz8n630Nxt.exe, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html0.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html5.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html14.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html19.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html3.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html1.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html4.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html15.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html8.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html12.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html10.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html11.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html17.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html2.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html7.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html21.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html20.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html6.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html18.0.drfalse
    		high
    https://cdn.jsdelivr.net/npm/bootstrapRUSSKIJ VOENNIJ KORABL IDI NAHUJ.html13.0.drfalse
      		high
      https://www.youtube.com/embed/scLoZQRi4eElz8n630Nxt.exe, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html0.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html5.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html14.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html19.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html3.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html1.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html4.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html15.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html8.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html12.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html10.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html11.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html17.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html2.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html7.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html21.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html20.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html6.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html18.0.drfalse
        		high
        https://player.vimeo.com/video/682485106?h=1f808323cdlz8n630Nxt.exe, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html0.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html5.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html14.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html19.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html3.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html1.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html4.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html15.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html8.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html12.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html10.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html11.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html17.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html2.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html7.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html21.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html20.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html6.0.dr, RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html18.0.drfalse
          		high

          World Map of Contacted IPs

          ⊘No contacted IP infos

          General Information

          Joe Sandbox Version:34.0.0 Boulder Opal
          Analysis ID:588372
          Start date:14.03.2022
          Start time:09:59:22
          Joe Sandbox Product:CloudBasic
          Overall analysis duration:0h 9m 14s
          Hypervisor based Inspection enabled:false
          Report type:full
          Sample file name:lz8n630Nxt (renamed file extension from none to exe)
          Cookbook file name:default.jbs
          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
          Number of analysed new started processes analysed:12
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • HDC enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Detection:MAL
          Classification:mal48.winEXE@1/31@0/0
          EGA Information:Failed
          HDC Information:Failed
          HCA Information:
          • Successful, ratio: 100%
          • Number of executed functions: 0
          • Number of non-executed functions: 0
          Cookbook Comments:
          • Adjust boot time
          • Enable AMSI
          • Override analysis time to 240s for sample files taking high CPU consumption
          • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
          • Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.50.102.62, 40.126.31.8, 40.126.31.137, 20.190.159.134, 40.126.31.141, 40.126.31.139, 40.126.31.1, 20.190.159.136, 40.126.31.135, 51.104.136.2, 40.127.240.158
          • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, www.tm.lg.prod.aadmsa.akadns.net, settings-prod-neu-2.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, settings-win.data.microsoft.com, www.tm.a.prd.aadg.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, arc.msn.com, login.msa.msidentity.com, e12564.dspb.akamaiedge.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, login.live.com, arc.trafficmanager.net, settings-prod-neu-1.northeurope.cloudapp.azure.com, atm-settingsfe-prod-geo.trafficmanager.net
          • Not all processes where analyzed, report is missing behavior information
          • Report size getting too big, too many NtOpenFile calls found.
          • Report size getting too big, too many NtQueryValueKey calls found.

          Simulations

          Behavior and APIs

          ⊘No simulations

          Joe Sandbox View / Context

          IPs

          ⊘No context

          Domains

          MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
          dual-a-0001.dc-msedge.netSCANNED_12032022675409123999.exeGet hashmaliciousBrowse
          • 131.253.33.200
          revised BL.pdf.exeGet hashmaliciousBrowse
          • 131.253.33.200
          PALLET MOLD OFFER ENQUIRY.exeGet hashmaliciousBrowse
          • 131.253.33.200
          PO 6A1108.exeGet hashmaliciousBrowse
          • 131.253.33.200
          RFQ_Order25347_pdf.exeGet hashmaliciousBrowse
          • 131.253.33.200
          ConsoleAppVV.exeGet hashmaliciousBrowse
          • 131.253.33.200
          sDoa1npQ472e289.exeGet hashmaliciousBrowse
          • 131.253.33.200
          NEW P.O.exeGet hashmaliciousBrowse
          • 131.253.33.200
          SUPPLY OF YOUR PRODUCTS_PDF_________________________________....exeGet hashmaliciousBrowse
          • 131.253.33.200
          REQUISITION 202274-IR-P00128.vbsGet hashmaliciousBrowse
          • 13.107.22.200
          Mlg5D2Pl2b.exeGet hashmaliciousBrowse
          • 131.253.33.200
          COTIZACI#U00d3N.exeGet hashmaliciousBrowse
          • 131.253.33.200
          RF50113025776.xlsmGet hashmaliciousBrowse
          • 131.253.33.200
          Scan Doc.exeGet hashmaliciousBrowse
          • 131.253.33.200
          ZMA06SUoVe.exeGet hashmaliciousBrowse
          • 131.253.33.200
          vem.exeGet hashmaliciousBrowse
          • 131.253.33.200
          SOA.exeGet hashmaliciousBrowse
          • 131.253.33.200
          SKM_B3350191107102.exeGet hashmaliciousBrowse
          • 131.253.33.200
          Seatbelt-TestVersion.exeGet hashmaliciousBrowse
          • 13.107.22.200
          Traffic Finesinvoice 276252728736533737.pdf .exeGet hashmaliciousBrowse
          • 131.253.33.200

          ASNs

          ⊘No context

          JA3 Fingerprints

          ⊘No context

          Dropped Files

          ⊘No context

          Created / dropped Files

          C:\.rnd64.putinwillburninhell

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:data
          Category:dropped
          Size (bytes):72
          Entropy (8bit):5.388471355518838
          Encrypted:false
          SSDEEP:3:j72V4YmMMKKbtR6FCxsHLRn:CWmeml
          MD5:BB0E0BAC5CADEC366A15D3DB82D91A9D
          SHA1:156DB870742149B7114CAB833906982F9602F9AB
          SHA-256:178E4B191DBC97EFB1A6F63674234D65C3CCFC3D04929AD068CBB4AC357312F9
          SHA-512:21EE6B43F14A8F73F64CFC780DE50930DCEAB9F30F57E737339D9624635B69373BCF71F9C596EE89B9FDD989CAA8B94AB3F7EC25A0AC6327FCC81A7C312D5F1D
          Malicious:false
          Reputation:low
          Preview:-{...9o]...9.W...=..}._)..0.okv~.......You think this bad neighborhood?

          C:\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\Microsoft\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini.putinwillburninhell

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:data
          Category:dropped
          Size (bytes):152
          Entropy (8bit):6.575960635236883
          Encrypted:false
          SSDEEP:3:Y3+xobGmfA+1REGplMDD1m+1Qq/rvTEVxcioXdAj6RsKF6FCxsHLRn:Y3+xBmoMLiaSLeu86sHeml
          MD5:14294D4D7FB303786589BD598408563E
          SHA1:0FB91AB0740246AA8918F7407BC607858C698C87
          SHA-256:AE0E0E353EE8F6F72C997568A6BF5AF87B25A55C690418052301426A46DBFB71
          SHA-512:BAF03C9ADE4EEAA37109CF9A5AFBC242549998CDC094B45FCDF5A2AB90FAD42F3CC35B2F84C06C30285973B2C8B72846AEB1239E53B3708F9793D3CB79B2ACD4
          Malicious:false
          Reputation:low
          Preview:...5..P..M.A.84uH...se.p;...G.`.%.s.....a.9..O).5....Y......-.5......t.agz..,..+.......GM..E.(DI.A.=4L..?W.....You think this bad neighborhood?

          C:\Users\Default\AppData\Local\Microsoft\Windows\History\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\Microsoft\Windows\INetCache\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:modified
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Local\Temp\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Reputation:low
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Roaming\Microsoft\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\AppData\Roaming\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\Desktop\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\Documents\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\Downloads\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\Favorites\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\Links\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\Music\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\NTUSER.DAT.LOG1.putinwillburninhell

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:data
          Category:dropped
          Size (bytes):57416
          Entropy (8bit):3.959870330931407
          Encrypted:false
          SSDEEP:384:uP067bQRJwY0DFdLYqvtj99P32dhjcHL0yl+K+XHH35hfB7/h+Dgqqh:uP0FJwY0Dv1v9LPl+K+XHH35hfB7/h+G
          MD5:C80E0181D643C5ACBA6F311E9E65B131
          SHA1:230E2B572968786D87EC375883CA10CF348AC7CD
          SHA-256:F78DFAE01E1D708CE9E3FD971AC87B47F4CCFBB09601959E4C1CACA18A6149BB
          SHA-512:B48A0319A06869228B727643C7956C8A3DB3F41E8734284A2B6AF85762691F545E380F71B598F8F41534BE3049ED50B7B4B3494AED07CE20551169EC2B5A8F32
          Malicious:false
          Preview:..o.k....m...Od.(-?.".......ci&.&.=....k.J..%.<.n]U..;.a...%v.g^.i..lXz...M.......Z.z...i6.w....'.`uY....4....O.6..?[....I..26....$Pv.../S.]q..n1..Q.5..0..9..Hr.X.d...|.$../."K.{`GX.veV'..oKT....!....L.g.....R.c....-.<..._.}]?,......D...C....r6..rhS....z.I....J.......(V.]_@D..`..O;....I|...o.LY..(.&2.lG.h...\t....B..;..DoH.....05+0/-...,;..w...+.....H^]../.f.G.O[.9..q.....}..B..T..E..k.atY.wjA7h.....b.-....I..RZ.m....8..:t..(....GXT..&..t~.p.r..0+.}.n....u..E4..{k..9...oAI.-....G.h+..+...#.DK%.x.4K.,..@..Ix....mW2@]...J...3q.....;....!....=..p....6NrJ....|)..:.Oym..X[..c......Z..-...W.V"m.%2v..y.......|.~.I...].@d.R.q..V,..)./.C.....`&...]..d....a..n.|^...OqU4..)b.zS....Z.X.v..D.....[...#.+S...?^w.lQ..#.7V..y........t...W..,...^.B.=..<_..............h=c...i.fl1.*.B`....f5.gO.Z.-...h.8.o....d..^+... .=.G@6..R.8.+.`..t........o.(.....Z...9..EL..]......./s.....PV...._8..._.bm.8>Zs..SNaQ..H....s.'B#<..}................:.)..Rl..:N.l"...1..U..l....n..p

          C:\Users\Default\NTUSER.DAT.LOG2.putinwillburninhell

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:data
          Category:dropped
          Size (bytes):72
          Entropy (8bit):5.392147223664537
          Encrypted:false
          SSDEEP:3:nTXHCPQ6gl8O6FCxsHLRn:nTXio5l8eml
          MD5:C61B4A42D6DD4D79A170C50AE4FF9902
          SHA1:89ECB74B3D6BEDE518FA9F993A994DBA13322605
          SHA-256:60D3B8545716FB9C1F66AA8B86013825EE5CAA7BD4F669E7D83BAEC04544D4D3
          SHA-512:E05352F2B6CBCDEB30CB041B9FA339D63A0C62885A16E5D4E68352CB88043A65B7B72BFDA13B69E8E61129DE240531D0FE9C1B7EE55252418527372A2347AF49
          Malicious:false
          Preview:;.la."..ew..6i.9.....=....5;SP.u.D.E....You think this bad neighborhood?

          C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TM.blf.putinwillburninhell

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:data
          Category:dropped
          Size (bytes):65608
          Entropy (8bit):1.6475171834645614
          Encrypted:false
          SSDEEP:192:SSSxO36J6mkpKaDeFb4nWDVmTRbPhXuo7fMFj6NL4:96uos+uRrMUNL4
          MD5:34F442CD1D5AEB35C76FE09176D0549A
          SHA1:3AFB98C3FC818706980458F6441C6CD16955B13A
          SHA-256:1270869512C1804F0A0FC6414D50CED8E7046F4CA3158AF473525F49BD525C82
          SHA-512:71CC8ABB9281E491C39DD2B555567B6CF09B65F47E07400D0F32BB7BEA53B2FF83973641598FEF406C5D849CAF72F8777F004A1DA9A7B382253D96E8676D90AD
          Malicious:false
          Preview:.@M1.P."..(..>TKM......q......M.....T.............R.;.'.>.EHQ.X.[.B....../..U...B.......X..n....(.Qk|.:.l-...(..'( ......n...>g.....b....M..._.i..=).,j.(.....oZ.Kspg.xZe;......9@..L.h.TCX....Hw....3].-3.{..,f..7.#".+?*.....O...YF......o..i'~.....:.D.P...pC...rp...3./.&7.UFY..P.....#...rKx.(..c.5.-?........h...,#a...r/G.t..5._bU.ts.l.jD.-p..=.e=3#....Y(!I..T]d....cQ..(]..s;..]M5...".eFo.w...@l.....$.}.{.E.!P...lS@H...5.6s.'..c...7@.gT.+{.*.E...f.....%..z.x].T.s.....`.>@..S...Eq....q[..Z.j ^N..NX.$?;t.....-G@N.%GY......f...=...d.2(..../.....|q.TC.m.*.;.g7.,...cq.}Q.S.......?..,f.X.XE.7.@...d$].*m...n.@/...I...H}..O.(-...=.k..T".5]<.D...........>...g..P.L@..9........u..(......*..d.5')u.:.1...e.....l &P7......j..Q....Q.2...n....?.o...:"wr.4.;..h@?..yw........bU.+.........@T.d$...?..+...i..T.~.D..E.p..j...(S(....j.,N.R...S.M\..o..W".b X...(..bG."....u.+....L[k.SzO....Q..+k22g$..>..C.E.I..crs.ks.DzH.^(.l...}.Fs4.....(}..c..-.l.F....B.+

          C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000001.regtrans-ms.putinwillburninhell

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:data
          Category:dropped
          Size (bytes):524360
          Entropy (8bit):1.5379434471939986
          Encrypted:false
          SSDEEP:1536:2POh/igLK/6ucY1iq+CrpvAdeLgUW1H6x48/8EdA53d8cDdF5Hq:2Wh/hL9ZY1iq+CadeLG1H6SXYAZ++jq
          MD5:3F9EC2724FD5C498BCE589506C542B70
          SHA1:7E74F2D9951A1E5FA2384E5C8F3B7DE1A0D9A086
          SHA-256:6B0034260BA7488A4E886DE5582697386E7DCD7EEA1009F9B9951BD0F0E05D6A
          SHA-512:9D723E6C2BD926F3F88BDCAA20800FB7DD163A3226630382B07D35E3DF0465A7447238BBCCFD2B4CF0DF90DFAEB3F43AD733397B77E7585D7F8E8B12FA1006F6
          Malicious:false
          Preview:K....Y.N..?..8m.U... ..8..D....:..`.fz.`X.e #R.....zS.q."].W..6.h........S.X..?..6.+......G.....F.'.....V.`....b&...=...YK..I..~k...G.Wu..Y......Sy....8y.*.;.>mt...8PE.......H.a.=.......{..Nv....]E...\+y.vY.2o..%....~.L2T.q.+u..s.O..l&D.G.{..m....Ql.@.Ys....dX.t....pn....V....m.*7...zJ20#G._..:%Xm._...n...f.....%..R].9w..+Z......X.....j]..,..C.D..0.......i^...GRi.....&.7o...&!.k. .0-4.R}.@*}s..>.....|...q.d.d.$s!x..R.iC...........,..#f.3.b.p5G_S2?Z.U.............^t_R....r.zz...?.g.b.X.oT,.M...i.Y..f{...7.....L..^......X....@.}..D..f...Os.z!.n..=.h.YK).`..k...H2O.u.9)P`.)i8.....Y.-7..."n.)_..|R...z.X...&Ae.%.T...w.|4... .U.'.S<776........sH.lP.EK.Z.....U...1....G.9..B..`.....7]:p...../.<....hk."..2..Hg.A..qZ....-'..Pz.pH$1jX....l.mO.9..a....W.R .]*..P..Xb4.\...s...... el[.0{...........'5....g..SgG*..sa=...3c6...q...A'.>.JV>.!n./.-..7.n;..@.a.j......R.$.t..){.e._.]t.W..>>..).,.?.3.T.M.d8.\=...5U..lz^..........U.8.... .{nh..Y.E.c.....i...

          C:\Users\Default\NTUSER.DAT{8ebe95f7-3dcb-11e8-a9d9-7cfe90913f50}.TMContainer00000000000000000002.regtrans-ms.putinwillburninhell

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:data
          Category:dropped
          Size (bytes):524360
          Entropy (8bit):1.5381987617983295
          Encrypted:false
          SSDEEP:1536:quHDRQzeNlrC6Dv/JBbhgB2eHPBz45CTRJh9hBF52/k5lgDZN31UsNB:q4DllVv/JBNUVHRPTfhEKOtLUE
          MD5:0BEB408BDD0735F7ADA5C282FACCFEAB
          SHA1:A15D2E086BBB06623C29F1694BF7EEE17E74009F
          SHA-256:58715D24AD275DDB9FCCDAC53B3D5B71E5B56EE460E465B50A0E9FE81DD3A917
          SHA-512:63C30FDC3B355EB75AB3EA4929D60E7CBF3B766CDA7772910BC4C032A6124690534FECDEB5978A9655B215B61484B21036488E82B84A93B483C8EAC1EE0CF37E
          Malicious:false
          Preview:........'$.:A...o..Z.#..~........M..~)S9..[P9^D.G..U....j.....q,.......L-9.bNKg.vm....1...\...w{...T..D..x^....Y..O|=..K..9N..+<.|g..'ZhY.......5U.......>.nr$......(]...@..V~..8X.i..N...'...s?.MX.K.P.......>...LR......W..m#..|j.D.2..'.?p2X..#d8w..F..e.p.M4.Um.........W.........[)+...q.2..t.d.%..7> .....FJ...@.Gnt.....3F$a...b.#l.HIe...!..LX.....k.V&.t.f[..%....wB...aH..Uh.......B.>>)Rc........j...,mBG<.(S.AG.....2.>.*=..h...g*.OF.@BY.0..K...%.NW...N..Y.mdo'y....vEk.F.0}.7E.^,...*..!...d.2D.....=..g.|m.?...e......s2.h.O.Z.Gz....-.F....| Ha"$Qut?VE.G....Z..C.A=.......n...9....(.....V..%..-....U.=...56dn..ZS'..j*.`..>v.F#....m+..=|U.}.R....H<W<o@......<p$)..P...\.v].^y.~\.S.l.E.R.`m""R.J#d..k. .i.C~..,0>.n..Oj..?.B.X.R..g......ME...Z..u.....1....B.6..B.3.Z_1.BU.MO.9.f.Oe...]:.@<..@.....k...w....>U.3....=...vaJ.s.,...y.u..h......Z>h T;H.1_....a.....I>.........c.....;..[.4+9m.$..j.....F#}E.v.d...}.2.4..V...{........E...\..a..m.qT..4...<.

          C:\Users\Default\Pictures\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\Default\Videos\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\Users\RUSSKIJ VOENNIJ KORABL IDI NAHUJ.html

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
          Category:dropped
          Size (bytes):2443
          Entropy (8bit):5.69547450486093
          Encrypted:false
          SSDEEP:48:0+IS21JmUxmxCI9K7JCGfIpvcT63HH/ysclal/Y2X0xIaDnIkS6RL:QS21JBGCUK7gGfIJcaHp/Y2kxIaDnIkX
          MD5:115563E32E20DA5BCE091141B11BAA7B
          SHA1:10F644DEFBC17D72103BE3CA8DCE5B0411EB60DB
          SHA-256:6858C46E0D7096A60C346A66978BE8AC2A675F8EB73C362C55C143F8B52FD5B0
          SHA-512:750834111865433886BE946F432A4114099C317EDF916687DAC8C443C400DD5D9E62D0BACFA3E6B143E65EA1DB9023F34F56CC574C8CDE442AAA55AFA22DB722
          Malicious:false
          Preview:<!doctype html><html lang="ru"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous"> <title></title> </head> <body> <div class="container-fluid"> <div class="row"> <div class="col-md-7"> <div class="row"> <p class="p1"><b>... <span style="color: black;">..</span> ...... ........</b></p><p class="p2"><b>.... ........... <span style="color: black;">.....</span></b></p><p class="p3"><b>...... ........ ....., ... ........., ... . ........ </b> <br>...... ..... ...... ..... ...., ..... ....., ........ . ....... <br>.... ...... . ....., . ........, ......... . ........

          C:\bootTel.dat.putinwillburninhell

          Download File
          Process:C:\Users\user\Desktop\lz8n630Nxt.exe
          File Type:COM executable for DOS
          Category:dropped
          Size (bytes):152
          Entropy (8bit):6.5127393163261145
          Encrypted:false
          SSDEEP:3:7wTP5rwxPNutAIewVwHYUfBmlM0pPDYTaoLkUqLpM6MfcipzF6FCxsHLRn:7wtCuAjwaHBY1ETaoLkUwafyeml
          MD5:F0608486442E756B1C0C9A02E9AC454B
          SHA1:623B58D08021CB3E54A9200D15B9192609D903B4
          SHA-256:67F203434D6E5071301F2830E20581482D5E31F71CF46FB96AF3C422D606CCE3
          SHA-512:148767C4B516C65D50CBA05D5EB16AE1B2F42C8ECF4148069954DCB64CD8128547F00D3BB3666EAE5252D273801B5F40DCDDB7ADC0216DCB984D8256B3E1C1E1
          Malicious:false
          Preview:.+....u|..].|......j......-{U~R.........-@.@.).`....I..0..G...uC;7.P&....#...w..89.;|o*C.;U@.;.7Z0.........$B.. 3.....You think this bad neighborhood?

          Static File Info

          General

          File type:PE32+ executable (GUI) x86-64, for MS Windows
          Entropy (8bit):6.420499115109873
          TrID:
          • Win64 Executable GUI (202006/5) 92.65%
          • Win64 Executable (generic) (12005/4) 5.51%
          • Generic Win/DOS Executable (2004/3) 0.92%
          • DOS Executable Generic (2002/1) 0.92%
          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
          File name:lz8n630Nxt.exe
          File size:502272
          MD5:3b3a50b242841e1789a919b1291051f1
          SHA1:7b74a50352bb16ba94201c8a9e35b3c1d8a9dc8c
          SHA256:9f3c1668ee44bfcd1afd599215f5bd73c76609776b78cb04bb6ef1121cc80d37
          SHA512:ee56efff743ace5d667536acc2134d1f8add17cf8c19787e37a0b86d1a12cf975a26e8920cdf5b5941b698fc0fc5d1450852f80afef95de0e84f254433e39e77
          SSDEEP:6144:7Y0LySTPTe8hgrHgNFvHKELxSwy4GFY7s/7p2CAVO8x3ohRlIOibFQ:7vGaPTe8SgDKElS9NZ7pjAD3oXribW
          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)i..H...H...H...#...H...#...H...#..^H...#...H...H..fH..D9...H..D9...H..D9...H..b:...H..b:...H..Rich.H..................PE..d..

          File Icon

          Icon Hash:00828e8e8686b000

          Static PE Info

          General

          Entrypoint:0x140030f8c
          Entrypoint Section:.text
          Digitally signed:false
          Imagebase:0x140000000
          Subsystem:windows gui
          Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
          DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
          Time Stamp:0x62224949 [Fri Mar 4 17:15:53 2022 UTC]
          TLS Callbacks:
          CLR (.Net) Version:
          OS Version Major:6
          OS Version Minor:0
          File Version Major:6
          File Version Minor:0
          Subsystem Version Major:6
          Subsystem Version Minor:0
          Import Hash:5fc54744cef988b57c81266931fa99ba
          Instruction
          dec eax
          sub esp, 28h
          call 00007FECFC9CFD74h
          dec eax
          add esp, 28h
          jmp 00007FECFC9CF4EFh
          int3
          int3
          inc eax
          push ebx
          dec eax
          sub esp, 20h
          dec eax
          mov ebx, ecx
          xor ecx, ecx
          call dword ptr [0002A30Fh]
          dec eax
          mov ecx, ebx
          call dword ptr [0002A2FEh]
          call dword ptr [0002A188h]
          dec eax
          mov ecx, eax
          mov edx, C0000409h
          dec eax
          add esp, 20h
          pop ebx
          dec eax
          jmp dword ptr [0002A17Ch]
          dec eax
          mov dword ptr [esp+08h], ecx
          dec eax
          sub esp, 38h
          mov ecx, 00000017h
          call 00007FECFC9D1E78h
          test eax, eax
          je 00007FECFC9CF679h
          mov ecx, 00000002h
          int 29h
          dec eax
          lea ecx, dword ptr [00047447h]
          call 00007FECFC9CF83Fh
          dec eax
          mov eax, dword ptr [esp+38h]
          dec eax
          mov dword ptr [0004752Eh], eax
          dec eax
          lea eax, dword ptr [esp+38h]
          dec eax
          add eax, 08h
          dec eax
          mov dword ptr [000474BEh], eax
          dec eax
          mov eax, dword ptr [00047517h]
          dec eax
          mov dword ptr [00047388h], eax
          dec eax
          mov eax, dword ptr [esp+40h]
          dec eax
          mov dword ptr [0004748Ch], eax
          mov dword ptr [00047362h], C0000409h
          mov dword ptr [0004735Ch], 00000001h
          mov dword ptr [00047366h], 00000001h
          mov eax, 00000008h
          NameVirtual AddressVirtual Size Is in Section
          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IMPORT0x73efc0x78.rdata
          IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x7a0000x3870.pdata
          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
          IMAGE_DIRECTORY_ENTRY_BASERELOC0x7f0000xe7c.reloc
          IMAGE_DIRECTORY_ENTRY_DEBUG0x6d4580x1c.rdata
          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
          IMAGE_DIRECTORY_ENTRY_TLS0x6d6000x28.rdata
          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x6d4800x138.rdata
          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IAT0x5b0000x470.rdata
          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

          Sections

          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
          .text0x10000x59e0c0x5a000False0.500775824653zlib compressed data6.52711501846IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          .rdata0x5b0000x19e160x1a000False0.456392728365data5.25838898481IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
          .data0x750000x4b340x1a00False0.170222355769data3.42088422234IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
          .pdata0x7a0000x38700x3a00False0.477033943966data5.68368991205IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
          _RDATA0x7e0000x940x200False0.212890625data1.44880110252IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
          .reloc0x7f0000xe7c0x1000False0.37109375data5.26067870138IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
          DLLImport
          SHELL32.dllSHEmptyRecycleBinA
          ADVAPI32.dllOpenSCManagerA, CryptGenRandom, CryptAcquireContextW, CloseServiceHandle, ControlService, EnumDependentServicesA, QueryServiceStatusEx, OpenServiceA, CryptReleaseContext
          RstrtMgr.DLLRmStartSession, RmEndSession, RmRegisterResources, RmGetList
          MPR.dllWNetCloseEnum, WNetEnumResourceW, WNetOpenEnumW, WNetGetConnectionW
          KERNEL32.dlllstrcpyW, FlushFileBuffers, HeapSize, WriteConsoleW, HeapReAlloc, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, ReadConsoleW, HeapAlloc, HeapFree, GetProcessHeap, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, ReleaseSemaphore, WaitForSingleObject, lstrlenW, CreateSemaphoreA, FindFirstVolumeW, FindNextVolumeW, FindVolumeClose, GetDriveTypeW, GetVolumePathNamesForVolumeNameW, CloseHandle, GetLastError, Sleep, GetCurrentProcess, TerminateProcess, OpenProcess, GetTickCount, GetProcAddress, lstrcmpW, SetVolumeMountPointW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, MultiByteToWideChar, GetCurrentThreadId, CreateFileW, FindClose, FindFirstFileW, FindNextFileW, GetFileSizeEx, GetLogicalDrives, ReadFile, SetFileAttributesW, SetFilePointerEx, WriteFile, CreateMutexW, OpenMutexW, WaitForMultipleObjects, GetCurrentProcessId, CreateThread, ExitThread, SetProcessShutdownParameters, GetSystemInfo, FreeLibrary, lstrcmpiW, lstrcatW, MoveFileExW, WideCharToMultiByte, MoveFileW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, GetModuleHandleW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, FormatMessageA, GetStringTypeW, LocalFree, EncodePointer, DecodePointer, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, SetEndOfFile, RtlPcToFileHeader, RaiseException, RtlUnwindEx, LoadLibraryExW, GetTimeZoneInformation, GetCommandLineA, GetCommandLineW, DeleteFileW, GetFileType, GetConsoleOutputCP, GetConsoleMode, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, GetStdHandle, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, SetStdHandle

          Network Behavior

          ⊘No network behavior found

          Statistics

          CPU Usage

          0100200s020406080100

          Click to jump to process

          Memory Usage

          0100200s0.0051015MB

          Click to jump to process

          System Behavior

          General

          Target ID:0
          Start time:10:00:33
          Start date:14/03/2022
          Path:C:\Users\user\Desktop\lz8n630Nxt.exe
          Wow64 process (32bit):false
          Commandline:"C:\Users\user\Desktop\lz8n630Nxt.exe"
          Imagebase:0x7ff7162b0000
          File size:502272 bytes
          MD5 hash:3B3A50B242841E1789A919B1291051F1
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:low
          Show Windows behavior

          File Activities

          Show Windows behavior

          Section Activities

          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
          Show Windows behavior

          Mutex Activities

          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
          Show Windows behavior

          Thread Activities

          Show Windows behavior

          Memory Activities

          Show Windows behavior

          System Activities

          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
          There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

          Disassembly

          ⊘No disassembly