Edit tour

Windows Analysis Report
2005.exe

Overview

General Information

Sample name:	2005.exe
Analysis ID:	1528311
MD5:	940c75b80536e5c7d686c5847c51ad2b
SHA1:	1edd8c4294d91737f05abf1b88215b2c13ea3f0c
SHA256:	a1b39e60f3d07c2ae8b375211e7dbac4efc0011444e9b09e6e37a496554fdb86
Infos:

Detection

Dice

Score:	96
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Dice Ransomware

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Deletes shadow drive data (may be related to ransomware)

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Checks for available system drives (often done to infect USB drives)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64native

2005.exe (PID: 8016 cmdline: "C:\Users\user\Desktop\2005.exe" MD5: 940C75B80536E5C7D686C5847C51AD2B)

WMIC.exe (PID: 8104 cmdline: wmic.exe SHADOWCOPY /nointeractive MD5: 82BB8430531876FBF5266E53460A393E)

conhost.exe (PID: 8184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WMIC.exe (PID: 7376 cmdline: wmic.exe SHADOWCOPY /nointeractive MD5: 82BB8430531876FBF5266E53460A393E)

conhost.exe (PID: 7404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WMIC.exe (PID: 7592 cmdline: wmic.exe SHADOWCOPY /nointeractive MD5: 82BB8430531876FBF5266E53460A393E)

conhost.exe (PID: 7604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WMIC.exe (PID: 2156 cmdline: wmic.exe SHADOWCOPY /nointeractive MD5: 82BB8430531876FBF5266E53460A393E)

conhost.exe (PID: 4932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

WMIC.exe (PID: 4640 cmdline: wmic.exe SHADOWCOPY /nointeractive MD5: 82BB8430531876FBF5266E53460A393E)

conhost.exe (PID: 1784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DICELOADER	A RAT written in .NET, used by FIN7 since 2021. In some instances dropped by ps1.powertrash.	No Attribution	https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319 https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/ https://www.mandiant.com/resources/blog/evolution-of-fin7	https://malpedia.caad.fkie.fraunhofer.de/details/win.diceloader

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
2005.exe	MALWARE_Win_RanzyLocker	Detects RanzyLocker / REntS ransomware	ditekSHen	0x1bad0:$hr1: 776261646D696E2044454C4554452053595354454D53544154454241434B5550 0x1bb18:$hr1: 776261646D696E2044454C4554452053595354454D53544154454241434B5550 0x1ba88:$hr2: 776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665 0x1bb78:$hr3: 626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F 0x1bb18:$hr4: 776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374 0x1bbd8:$hr5: 626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573 0x1bc58:$hr6: 76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574 0x1ba18:$hx1: 476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838 0x1bd50:$hx2: 534F4654574152455C4D6963726F736F66745C45524944 0x1bdf4:$hx3: 227375626964223A22 0x1bddc:$hx4: 226E6574776F726B223A22 0x1ba70:$hx5: 726561646D652E747874 0x1bf78:$hx6: -nolan 0x208b:$o1: 8D 45 E9 89 9D 54 FF FF FF 88 9D 44 FF FF FF 3B 0x478c:$o2: 8B 44 24 24 8B 4C 24 34 40 8B 54 24 38 89 44 24 0x4945:$o3: 8B 44 24 2C 8B 7C 24 1C 89 44 24 34 8B 44 24 28 0x49f8:$o4: 8B 44 24 28 8B 4C 24 34 05 00 00 A0 00 89 44 24

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: 2005.exe PID: 8016	JoeSecurity_diceransom	Yara detected Dice Ransomware	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.2005.exe.400000.0.unpack	MALWARE_Win_RanzyLocker	Detects RanzyLocker / REntS ransomware	ditekSHen	0x1bad0:$hr1: 776261646D696E2044454C4554452053595354454D53544154454241434B5550 0x1bb18:$hr1: 776261646D696E2044454C4554452053595354454D53544154454241434B5550 0x1ba88:$hr2: 776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665 0x1bb78:$hr3: 626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F 0x1bb18:$hr4: 776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374 0x1bbd8:$hr5: 626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573 0x1bc58:$hr6: 76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574 0x1ba18:$hx1: 476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838 0x1bd50:$hx2: 534F4654574152455C4D6963726F736F66745C45524944 0x1bdf4:$hx3: 227375626964223A22 0x1bddc:$hx4: 226E6574776F726B223A22 0x1ba70:$hx5: 726561646D652E747874 0x1bf78:$hx6: -nolan 0x208b:$o1: 8D 45 E9 89 9D 54 FF FF FF 88 9D 44 FF FF FF 3B 0x478c:$o2: 8B 44 24 24 8B 4C 24 34 40 8B 54 24 38 89 44 24 0x4945:$o3: 8B 44 24 2C 8B 7C 24 1C 89 44 24 34 8B 44 24 28 0x49f8:$o4: 8B 44 24 28 8B 4C 24 34 05 00 00 A0 00 89 44 24
0.2.2005.exe.400000.0.unpack	MALWARE_Win_RanzyLocker	Detects RanzyLocker / REntS ransomware	ditekSHen	0x1bad0:$hr1: 776261646D696E2044454C4554452053595354454D53544154454241434B5550 0x1bb18:$hr1: 776261646D696E2044454C4554452053595354454D53544154454241434B5550 0x1ba88:$hr2: 776D69632E65786520534841444F57434F5059202F6E6F696E746572616374697665 0x1bb78:$hr3: 626364656469742E657865202F736574207B64656661756C747D207265636F76657279656E61626C6564204E6F 0x1bb18:$hr4: 776261646D696E2044454C4554452053595354454D53544154454241434B5550202D64656C6574654F6C64657374 0x1bbd8:$hr5: 626364656469742E657865202F736574207B64656661756C747D20626F6F74737461747573706F6C6963792069676E6F7265616C6C6661696C75726573 0x1bc58:$hr6: 76737361646D696E2E6578652044656C65746520536861646F7773202F416C6C202F5175696574 0x1ba18:$hx1: 476C6F62616C5C33353335354641352D303745392D343238422D423541352D314338384341423242343838 0x1bd50:$hx2: 534F4654574152455C4D6963726F736F66745C45524944 0x1bdf4:$hx3: 227375626964223A22 0x1bddc:$hx4: 226E6574776F726B223A22 0x1ba70:$hx5: 726561646D652E747874 0x1bf78:$hx6: -nolan 0x208b:$o1: 8D 45 E9 89 9D 54 FF FF FF 88 9D 44 FF FF FF 3B 0x478c:$o2: 8B 44 24 24 8B 4C 24 34 40 8B 54 24 38 89 44 24 0x4945:$o3: 8B 44 24 2C 8B 7C 24 1C 89 44 24 34 8B 44 24 28 0x49f8:$o4: 8B 44 24 28 8B 4C 24 34 05 00 00 A0 00 89 44 24

HTTP traffic detected: GET /nexus/rules?Application=officeclicktorun.exe&Version=16.0.14326.20384&ClientId=%7bB0D7ECDF-3EEF-4767-BB67-27861CCFA721%7d&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.14326.20384& HTTP/1.1Connection: Keep-AliveAccept: application/vnd.ms-nexus-rules-v16+xmlAccept-Encoding: gzipIf-Modified-Since: Mon, 07 Oct 2024 14:16:33 GMTUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.14326; Pro)X-MS-Collection-Policy: ExternalRestrictive, HeartbeatX-MS-Process-Session-Id: {7E978EA8-AD6B-4BED-887D-8CF0E69AE9DF}Host: nexusrules.officeapps.live.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443

Source: unknown

HTTPS traffic detected: 52.111.227.14:443 -> 192.168.11.30:49773 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\Users\user\Documents\RAYHIWGKDI\readme.txt

Dropped file: Your data are STOLEN and your servers is LOCKED.The data will be published on TOR website if you do not contact with us. You can contact us directly for further instructions through emails:ccfarmy@tutanota.comccfarmy@protonmail.comIn subject write your personal id (below).Recovery information:key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9personal id: ARQOOLG

Jump to dropped file

Yara detected Dice Ransomware

Source: Yara match

File source: Process Memory Space: 2005.exe PID: 8016, type: MEMORYSTR

Deletes shadow drive data (may be related to ransomware)

Source: 2005.exe, 00000000.00000002.115419026016.000000000066D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )gC:\Windows\System32\OpenSSH\vssadmin.exe Delete Shadows \All \Quiet.exe.
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete Shadows \All.exee:
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system\vssadmin.exe Delete Shadowse
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\vssadmin.exe Delete Shadows \All.exe
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\OpenSSH\vssadmin.exe Deleteg
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\OpenSSH\vssadmin.exe DeleteI
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\SYSTEM32\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\Wbem\vssadmin.exe Deletexe
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\vssadmin.exe Delete ShadowsU
Source: 2005.exe, 00000000.00000003.114232661054.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete Shadows \All.exee:
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system\vssadmin.exe Delete Shadowse
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\vssadmin.exe Delete Shadows \All.exe
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\OpenSSH\vssadmin.exe Deleteg
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\OpenSSH\vssadmin.exe DeleteI
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\SYSTEM32\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\Wbem\vssadmin.exe Deletexe
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\vssadmin.exe Delete ShadowsU
Source: 2005.exe, 00000000.00000003.114232293852.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete Shadows \All.exee:
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system\vssadmin.exe Delete Shadowse
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\vssadmin.exe Delete Shadows \All.exe
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\OpenSSH\vssadmin.exe Deleteg
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\OpenSSH\vssadmin.exe DeleteI
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\SYSTEM32\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\Wbem\vssadmin.exe Deletexe
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\vssadmin.exe Delete ShadowsU
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete
Source: 2005.exe, 00000000.00000003.114231822326.0000000000692000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete Shadows \All.exee:
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system\vssadmin.exe Delete Shadowse
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\vssadmin.exe Delete Shadows \All.exe
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\OpenSSH\vssadmin.exe Deleteg
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\OpenSSH\vssadmin.exe DeleteI
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\SYSTEM32\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\System32\Wbem\vssadmin.exe Deletexe
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete Shadows
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\vssadmin.exe Delete ShadowsU
Source: 2005.exe, 00000000.00000003.114232503357.0000000000693000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\C:\Windows\system32\vssadmin.exe Delete
Source: 2005.exe, 00000000.00000002.115418247975.0000000000030000.00000004.00000020.00040000.00000000.sdmp	Binary or memory string: C:\Windows\SysWOW64\Wbem\wmic.exe\??\C:\Windows\SysWOW64\Wbem\wmic.exe88382-37782,en-USenwmicC:\Windows\vssadmin.exe Delete Shadows \All \Quiet.exeooHDP

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\2005.exe	File moved: C:\Users\user\Desktop\NIKHQAIQAU.docx	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File deleted: C:\Users\user\Desktop\NIKHQAIQAU.docx	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File moved: C:\Users\user\Desktop\QNCYCDFIJJ.mp3	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File moved: C:\Users\user\Desktop\RAYHIWGKDI\WKXEWIOTXI.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File deleted: C:\Users\user\Desktop\RAYHIWGKDI\WKXEWIOTXI.xlsx	Jump to behavior

Source: C:\Users\user\Desktop\2005.exe

Code function: 0_2_0040586B CryptStringToBinaryA,GetProcessHeap,HeapAlloc,CryptStringToBinaryA,CryptImportKey,GetProcessHeap,HeapFree,

0_2_0040586B

System Summary

Malicious sample detected (through community Yara rule)

Source: 2005.exe, type: SAMPLE	Matched rule: Detects RanzyLocker / REntS ransomware Author: ditekSHen
Source: 0.0.2005.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RanzyLocker / REntS ransomware Author: ditekSHen
Source: 0.2.2005.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RanzyLocker / REntS ransomware Author: ditekSHen

Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00416820	0_2_00416820
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00404687	0_2_00404687
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_0041477D	0_2_0041477D

Source: C:\Users\user\Desktop\2005.exe	Code function: String function: 00414EED appears 35 times
Source: C:\Users\user\Desktop\2005.exe	Code function: String function: 00401D0F appears 81 times
Source: C:\Users\user\Desktop\2005.exe	Code function: String function: 00408F50 appears 34 times

Source: 2005.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2005.exe, type: SAMPLE	Matched rule: MALWARE_Win_RanzyLocker author = ditekSHen, description = Detects RanzyLocker / REntS ransomware
Source: 0.0.2005.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RanzyLocker author = ditekSHen, description = Detects RanzyLocker / REntS ransomware
Source: 0.2.2005.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RanzyLocker author = ditekSHen, description = Detects RanzyLocker / REntS ransomware

Source: classification engine

Classification label: mal96.rans.evad.winEXE@16/270@0/100

Source: C:\Users\user\Desktop\2005.exe

Code function: 0_2_004078AF CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,Process32NextW,TerminateProcess,CloseHandle,CloseHandle,

0_2_004078AF

Source: C:\Users\user\Desktop\2005.exe

File created: C:\Users\Default\readme.txt

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7604:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7404:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4932:304:WilStaging_02
Source: C:\Users\user\Desktop\2005.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\35355FA5-07E9-428B-B5A5-1C88CAB2B488
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8184:304:WilStaging_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1784:304:WilStaging_02

Source: C:\Users\user\Desktop\2005.exe	Command line argument: -nolan		0_2_00406884
Source: C:\Users\user\Desktop\2005.exe	Command line argument: xqh		0_2_00406884

Source: 2005.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2005.exe

File read: C:\$Recycle.Bin\S-1-5-21-3425316567-2969588382-3778222414-1003\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2005.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2005.exe

ReversingLabs: Detection: 91%

Source: unknown	Process created: C:\Users\user\Desktop\2005.exe "C:\Users\user\Desktop\2005.exe"
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior

Source: C:\Users\user\Desktop\2005.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: dfscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: msxml6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\2005.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4a04656d-52aa-49de-8a09-cb178760e748}\InProcServer32

Jump to behavior

Source: 2005.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00414E93 push ecx; ret		0_2_00414EA6
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00408F96 push ecx; ret		0_2_00408FA9

Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\Default\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\Dylan\Desktop\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\Dylan\Favorites\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\Dylan\Links\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\Dylan\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\Dylan\Searches\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Desktop\BPMLNOBVSB\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Desktop\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Desktop\NIKHQAIQAU\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Desktop\RAYHIWGKDI\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Documents\BPMLNOBVSB\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Documents\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Documents\NIKHQAIQAU\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Documents\RAYHIWGKDI\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Downloads\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Favorites\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Links\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\user\Searches\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\Public\Desktop\readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File created: C:\Users\Public\Libraries\readme.txt	Jump to behavior

Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\2005.exe

Code function: GetAdaptersInfo,GetAdaptersInfo,GetAdaptersInfo,

0_2_00406E73

Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_004061A6 FindFirstFileW,PostQueuedCompletionStatus,FindNextFileW,FindClose,		0_2_004061A6
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_0040EF8C FindFirstFileExW,		0_2_0040EF8C

Source: C:\Users\user\Desktop\2005.exe

Code function: 0_2_00407E01 GetSystemInfo,CreateIoCompletionPort,

0_2_00407E01

Source: 2005.exe, 00000000.00000002.115420756551.0000000002C40000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114326991795.0000000002C42000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK
Source: 2005.exe, 00000000.00000002.115419026016.000000000066D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicshutdownrf
Source: 2005.exe, 00000000.00000003.114250939954.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114302616475.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114276557619.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114287454500.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114467113100.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114485214468.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114274291921.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114520734476.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114371646419.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114294682733.0000000002C49000.00000004.00000020.00020000.00000000.sdmp, 2005.exe, 00000000.00000003.114244720065.0000000002C4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 2005.exe, 00000000.00000002.115419026016.000000000066D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Users\user\Desktop\2005.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\2005.exe

Code function: 0_2_004077F2 GetCurrentProcess,CheckRemoteDebuggerPresent,IsDebuggerPresent,

0_2_004077F2

Source: C:\Users\user\Desktop\2005.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\2005.exe

Code function: 0_2_004077F2 GetCurrentProcess,CheckRemoteDebuggerPresent,IsDebuggerPresent,

0_2_004077F2

Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_0040CBBD mov eax, dword ptr fs:[00000030h]	0_2_0040CBBD
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_0040EC7B mov eax, dword ptr fs:[00000030h]	0_2_0040EC7B
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_0040EC37 mov eax, dword ptr fs:[00000030h]	0_2_0040EC37

Source: C:\Users\user\Desktop\2005.exe

Code function: 0_2_0040586B CryptStringToBinaryA,GetProcessHeap,HeapAlloc,CryptStringToBinaryA,CryptImportKey,GetProcessHeap,HeapFree,

0_2_0040586B

Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_0040BB67 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040BB67
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_0040844D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040844D
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00408D50 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00408D50
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00408EE6 SetUnhandledExceptionFilter,	0_2_00408EE6

Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic.exe SHADOWCOPY /nointeractive	Jump to behavior

Source: C:\Users\user\Desktop\2005.exe

Code function: 0_2_00408B70 cpuid

0_2_00408B70

Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Default\NTUSER.DAT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Dylan\Desktop\Excel.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Dylan\Desktop\PowerPoint.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Dylan\Desktop\Word.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Dylan\Favorites\Bing.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Dylan\Links\Desktop.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Dylan\Links\Downloads.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Dylan\NTUSER.DAT VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Dylan\Searches\Indexed Locations.search-ms VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\Dylan\Searches\winrt--{S-1-5-21-3425316567-2969588382-3778222414-1002}-.searchconnector-ms VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB\BPMLNOBVSB.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB\FENIVHOIKN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB\SFPUSAFIOL.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB\UOOJJOZIRH.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB\VAMYDFPUND.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB\WKXEWIOTXI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\BPMLNOBVSB.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\CURQNKVOIX.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\Excel.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\FENIVHOIKN.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\FENIVHOIKN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\LSBIHQFDVT.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\NIKHQAIQAU\BPMLNOBVSB.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\NIKHQAIQAU\CURQNKVOIX.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\NIKHQAIQAU\FENIVHOIKN.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\NIKHQAIQAU\NIKHQAIQAU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\NIKHQAIQAU\RAYHIWGKDI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\NIKHQAIQAU\WKXEWIOTXI.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\NIKHQAIQAU.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\QNCYCDFIJJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\RAYHIWGKDI\LSBIHQFDVT.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\RAYHIWGKDI\QNCYCDFIJJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\RAYHIWGKDI\RAYHIWGKDI.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\RAYHIWGKDI\SQRKHNBNYN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\RAYHIWGKDI\WKXEWIOTXI.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\RAYHIWGKDI.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\SFPUSAFIOL.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\SQRKHNBNYN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\UOOJJOZIRH.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\VAMYDFPUND.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\WKXEWIOTXI.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\WKXEWIOTXI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\WKXEWIOTXI.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Desktop\Word.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\BPMLNOBVSB\BPMLNOBVSB.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\BPMLNOBVSB\SFPUSAFIOL.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\BPMLNOBVSB\WKXEWIOTXI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\BPMLNOBVSB.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\FENIVHOIKN.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\FENIVHOIKN.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\LSBIHQFDVT.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\NIKHQAIQAU\BPMLNOBVSB.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\NIKHQAIQAU\RAYHIWGKDI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\NIKHQAIQAU\WKXEWIOTXI.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\RAYHIWGKDI\LSBIHQFDVT.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\RAYHIWGKDI\RAYHIWGKDI.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\RAYHIWGKDI\SFPUSAFIOL.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\RAYHIWGKDI\WKXEWIOTXI.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\RAYHIWGKDI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\SFPUSAFIOL.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\SQRKHNBNYN.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\UOOJJOZIRH.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\VAMYDFPUND.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\WKXEWIOTXI.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Documents\WKXEWIOTXI.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Downloads\BPMLNOBVSB.docx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Downloads\CURQNKVOIX.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Downloads\QNCYCDFIJJ.mp3 VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Downloads\RAYHIWGKDI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Downloads\UOOJJOZIRH.png VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Downloads\VAMYDFPUND.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Downloads\WKXEWIOTXI.pdf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Downloads\WKXEWIOTXI.xlsx VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Favorites\Amazon.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Favorites\Facebook.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Favorites\Live.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Favorites\NYTimes.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Favorites\Twitter.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Favorites\Wikipedia.url VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Links\Desktop.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\Links\Downloads.lnk VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	Queries volume information: C:\Users\user\NTUSER.DAT VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2005.exe

Code function: 0_2_0040E970 GetSystemTimeAsFileTime,

0_2_0040E970

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	11 Data Encrypted for Impact
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	2 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	23 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
2005.exe	100%	Avira	HEUR/AGEN.1319080
2005.exe	92%	ReversingLabs	Win32.Ransomware.FileCrypter
2005.exe	100%	Joe Sandbox ML

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.11.209
192.168.11.207
192.168.11.208
192.168.11.205
192.168.11.206
192.168.11.203
192.168.11.204
192.168.11.201
192.168.11.202
192.168.11.200
192.168.11.28
192.168.11.27
192.168.11.29
192.168.11.24
192.168.11.23
192.168.11.26
192.168.11.25
192.168.11.20
192.168.11.22
192.168.11.21
192.168.11.17
192.168.11.16
192.168.11.19
192.168.11.18
192.168.11.13
192.168.11.12
192.168.11.15
192.168.11.14
192.168.11.11
192.168.11.10
192.168.11.199
192.168.11.197
192.168.11.198
192.168.11.188
192.168.11.189
192.168.11.186
192.168.11.187
192.168.11.195
192.168.11.196
192.168.11.193
192.168.11.194
192.168.11.191
192.168.11.192
192.168.11.190
192.168.11.179
192.168.11.177
192.168.11.178
192.168.11.175
192.168.11.176
192.168.11.184
192.168.11.185
192.168.11.182
192.168.11.183
192.168.11.180
192.168.11.181
192.168.11.168
192.168.11.169
192.168.11.166
192.168.11.89
192.168.11.167
192.168.11.164
192.168.11.165
192.168.11.86
192.168.11.173
192.168.11.85
192.168.11.174
192.168.11.88
192.168.11.171
192.168.11.87
192.168.11.172
192.168.11.82
192.168.11.81
192.168.11.170
192.168.11.84
192.168.11.83
192.168.11.80
192.168.11.159
192.168.11.157
192.168.11.158
192.168.11.79
192.168.11.155
192.168.11.78
192.168.11.156
192.168.11.153
192.168.11.154
192.168.11.75
192.168.11.162
192.168.11.74
192.168.11.163
192.168.11.77
192.168.11.160
192.168.11.76
192.168.11.161
192.168.11.71
192.168.11.70
192.168.11.73
192.168.11.72
192.168.11.148
192.168.11.149
192.168.11.146

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1528311
Start date and time:	2024-10-07 19:23:38 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2005.exe
Detection:	MAL
Classification:	mal96.rans.evad.winEXE@16/270@0/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 30 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172
Excluded domains from analysis (whitelisted): 1.11.168.192.in-addr.arpa, ctldl.windowsupdate.com, nexusrules.officeapps.live.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: 2005.exe

Simulations

Behavior and APIs

Time	Type	Description
13:25:43	API Interceptor	5x Sleep call for process: WMIC.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	52.111.227.14
	https://cloudshare.weil.com/invitations?share=f213408950da5c01bcf2	Get hash	malicious	Unknown	Browse	52.111.227.14
	https://dsdhie.org/dsjhem	Get hash	malicious	Unknown	Browse	52.111.227.14
	https://66e41162be8b44fa4ef98165--lively-meringue-d6fcef.netlify.app/	Get hash	malicious	Unknown	Browse	52.111.227.14
	https://doccloudshareddrive.com/?auth=1&shareable=true&access=restricted&check_type=password&timestamp=2024-10-07T16%3A53%3A27.609Z&priority=high&include_details=true	Get hash	malicious	Unknown	Browse	52.111.227.14
	TuQlz67byH.exe	Get hash	malicious	LummaC	Browse	52.111.227.14
	45Ywq5ad5H.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	52.111.227.14
	f1r6P3j3g7.exe	Get hash	malicious	LummaC, Vidar	Browse	52.111.227.14
	lCVFGKfczi.exe	Get hash	malicious	Vidar	Browse	52.111.227.14

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	262680
Entropy (8bit):	7.999303096777782
Encrypted:	true
SSDEEP:	6144:Mky2e9nraKYnnQJxgH9VTj2p6Q4JOUYTbT:MZpcnyerTm6Q4JOLTbT
MD5:	7A469CBB4C80EEE712B3BFD498C9BE1B
SHA1:	376D6E09508A1D7B873C4140AFDE266CF944F47C
SHA-256:	72FAF86635D6AADE78E201DBD2FC40374ECA1A6FB5737DE1070CC2995062911E
SHA-512:	5C9FC86CC5EEEED4D220C0B99B8DFB59C430E10F98956AFCED118847F9CEA2380C26AE0CBF53E37AC7F8C4F65DC0B4C48697A8ED6FEA6ADF0BB0CCAC0C970B07
Malicious:	false
Preview:	.....6m.Z.E.7...9../d.....T]..8.F.3.F...7...~@...o.(!.G........1...8.6.!.@,.....1(i<i2...8...0..m..M..........H.cNH.....n.f$..yt......=..%;L\N.J..cI.^\|..%^.'].B.d....k...a...n..}.3..dM$7t...g'..S@...V.>.PG..5GS..{3......G..N..\|.gADi\.P5......]h..$0l...P..~....r.tI...f<H.A...HB.b....J.....u.h....a5^...qv.....m..C...[;"7.1RW...,..~Bv`...K.i...m)U...:c...B...L....Ld]...e~Q./9..N..K...N...[.........Xg....v1....T..X.`S.\.l.uJ^cBs.\|....#...P.A.;[+g%.1.....+.;..b..[......52....l.^..d_n...Zu...}L...J>P.c...............y..u.:..Wu.U..:u=m..N!.......-1....k.]......-..B...m..%.X&.Fl..:.X..#...5...,....=.....<f.hfmS.."9.'.B.^.C...T.....\|.........U.2.h.~{.....k.D@^i.'b...]..4[:.Sv.XU.KO(..v..p.{ .4O.sE....O2......f.,.i"...'.0f......Ou..S.,..6d.".)}y...6Q...mo.#.0-.6.f.8.=.<....6.q.c`s%..B..~...p...+EA.v.-..n.2..1H-.!7...9la.rS.....D...>\|/....2.....[..ba.w....P.B...V...-/@...=..O....g..L...G.....'.j.'"....j.c.......U.m.#...ngLs;3.j....6.

C:\Users\Default\NTUSER.DAT.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	262680
Entropy (8bit):	7.999303096777782
Encrypted:	true
SSDEEP:	6144:Mky2e9nraKYnnQJxgH9VTj2p6Q4JOUYTbT:MZpcnyerTm6Q4JOLTbT
MD5:	7A469CBB4C80EEE712B3BFD498C9BE1B
SHA1:	376D6E09508A1D7B873C4140AFDE266CF944F47C
SHA-256:	72FAF86635D6AADE78E201DBD2FC40374ECA1A6FB5737DE1070CC2995062911E
SHA-512:	5C9FC86CC5EEEED4D220C0B99B8DFB59C430E10F98956AFCED118847F9CEA2380C26AE0CBF53E37AC7F8C4F65DC0B4C48697A8ED6FEA6ADF0BB0CCAC0C970B07
Malicious:	false
Preview:	.....6m.Z.E.7...9../d.....T]..8.F.3.F...7...~@...o.(!.G........1...8.6.!.@,.....1(i<i2...8...0..m..M..........H.cNH.....n.f$..yt......=..%;L\N.J..cI.^\|..%^.'].B.d....k...a...n..}.3..dM$7t...g'..S@...V.>.PG..5GS..{3......G..N..\|.gADi\.P5......]h..$0l...P..~....r.tI...f<H.A...HB.b....J.....u.h....a5^...qv.....m..C...[;"7.1RW...,..~Bv`...K.i...m)U...:c...B...L....Ld]...e~Q./9..N..K...N...[.........Xg....v1....T..X.`S.\.l.uJ^cBs.\|....#...P.A.;[+g%.1.....+.;..b..[......52....l.^..d_n...Zu...}L...J>P.c...............y..u.:..Wu.U..:u=m..N!.......-1....k.]......-..B...m..%.X&.Fl..:.X..#...5...,....=.....<f.hfmS.."9.'.B.^.C...T.....\|.........U.2.h.~{.....k.D@^i.'b...]..4[:.Sv.XU.KO(..v..p.{ .4O.sE....O2......f.,.i"...'.0f......Ou..S.,..6d.".)}y...6Q...mo.#.0-.6.f.8.=.<....6.q.c`s%..B..~...p...+EA.v.-..n.2..1H-.!7...9la.rS.....D...>\|/....2.....[..ba.w....P.B...V...-/@...=..O....g..L...G.....'.j.'"....j.c.......U.m.#...ngLs;3.j....6.

C:\Users\Default\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\Dylan\Desktop\Excel.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2949
Entropy (8bit):	7.939388921322736
Encrypted:	false
SSDEEP:	48:E119wGTJrYNhMtatkxhH/RnKJVofJowGDCj5MArCbinzMLL2O9EOuUU5umskc0NN:EP9wGTVG2atkxhBZZGCj5MfezMLLVI5p
MD5:	FEF594DCC0CFB19E03E2237CBAACD146
SHA1:	89BC62CD213C1A0480FA4C47D5C9D6AEB04C3AC7
SHA-256:	4BCF67373D5E9CBB9884305F11D300B2EAFA0BAC8CF23B9968C57930E274E695
SHA-512:	26B4850D949C9B443EAEB1F7C448DC3806EA0A931C0FA6512DA722B1A32C49816999A5D17AA3E627AB3257FB4CFFC8638563738813EFF685634B30D9615BFE2A
Malicious:	false
Preview:	..'.[.B....<f.#U/@K.!.x...o....JK....4a....02].....b....R..8~}..4.....0...A?.~.v....`".A..c.....F.....Q..............I......2%{..\|..K."x.....K.=F5.\qz.v-.b//...OD.>....w"..W......"....C.(:....@..u.i.....$fe.d/.;.g<G_m..VP}...]$F.i.f.a......Az..Pe....../.o..".2+..I.GP......,.:ldg%$SO.X._.].0H...h.O.P...;..iml...o.....j}.K:(.k..L.n.9...}._.S.of?;.G/F.{.%...#6.da.]..I.....S.m.......2..d(.......n.vMYe6@V.jL.pu}......[.tCX..~F...H&Z.D.LxVs.YCgp.<I.{.=\|..........j..QATp......Z.F,.#....z#..o.M'.J.W6m.X+g.3..\|.B6.h/.E.@tMe.[..:..}.....S........g)......S.......`0.4..+..mK.k?..%.]M.....]......Pz....r......Dh........-.a.#..Uj...w&.Z.H..t1..Bi...d..'..hpK...V...!7h.FI.(4l...6...."d74...#@.G.M.Gk..y3...../....M.....7qJ,...A......l./.....Hi.......[....=$..5.m..t.K....b[.Y..sD............cmg4../..........1..1.f.....1.j.>.FwO?...A.q.,,....H...._[..:...L...3..Y....;. 7jz...2.k..."B.LN...I..n....2.K.\|!..D.g\|/63.<.&uD@...s."qK.$....Dq..?.$...*

C:\Users\Dylan\Desktop\Excel.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2949
Entropy (8bit):	7.939388921322736
Encrypted:	false
SSDEEP:	48:E119wGTJrYNhMtatkxhH/RnKJVofJowGDCj5MArCbinzMLL2O9EOuUU5umskc0NN:EP9wGTVG2atkxhBZZGCj5MfezMLLVI5p
MD5:	FEF594DCC0CFB19E03E2237CBAACD146
SHA1:	89BC62CD213C1A0480FA4C47D5C9D6AEB04C3AC7
SHA-256:	4BCF67373D5E9CBB9884305F11D300B2EAFA0BAC8CF23B9968C57930E274E695
SHA-512:	26B4850D949C9B443EAEB1F7C448DC3806EA0A931C0FA6512DA722B1A32C49816999A5D17AA3E627AB3257FB4CFFC8638563738813EFF685634B30D9615BFE2A
Malicious:	false
Preview:	..'.[.B....<f.#U/@K.!.x...o....JK....4a....02].....b....R..8~}..4.....0...A?.~.v....`".A..c.....F.....Q..............I......2%{..\|..K."x.....K.=F5.\qz.v-.b//...OD.>....w"..W......"....C.(:....@..u.i.....$fe.d/.;.g<G_m..VP}...]$F.i.f.a......Az..Pe....../.o..".2+..I.GP......,.:ldg%$SO.X._.].0H...h.O.P...;..iml...o.....j}.K:(.k..L.n.9...}._.S.of?;.G/F.{.%...#6.da.]..I.....S.m.......2..d(.......n.vMYe6@V.jL.pu}......[.tCX..~F...H&Z.D.LxVs.YCgp.<I.{.=\|..........j..QATp......Z.F,.#....z#..o.M'.J.W6m.X+g.3..\|.B6.h/.E.@tMe.[..:..}.....S........g)......S.......`0.4..+..mK.k?..%.]M.....]......Pz....r......Dh........-.a.#..Uj...w&.Z.H..t1..Bi...d..'..hpK...V...!7h.FI.(4l...6...."d74...#@.G.M.Gk..y3...../....M.....7qJ,...A......l./.....Hi.......[....=$..5.m..t.K....b[.Y..sD............cmg4../..........1..1.f.....1.j.>.FwO?...A.q.,,....H...._[..:...L...3..Y....;. 7jz...2.k..."B.LN...I..n....2.K.\|!..D.g\|/63.<.&uD@...s."qK.$....Dq..?.$...*

C:\Users\Dylan\Desktop\PowerPoint.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2986
Entropy (8bit):	7.927485899988996
Encrypted:	false
SSDEEP:	48:QNpgewy1YLm4qGk1agt2cERnTuFn/1IkWurDf5bZ2/xMBr/P2uvuPr7wvaa:ipzdn4q3Mgt2Ln4/1lHhbZ5rhuPr2p
MD5:	0F59D243A250994347042AEA2239D175
SHA1:	0B3B810AE457D3BD4FA5B060300C5C31DF7C5A0A
SHA-256:	A16B30119EFF0ACCB110DEE2B5710408CB771788E3A0875F3EFCD6056821C249
SHA-512:	222A664F1A30F8482391538E0B10D5C52F83D3763B9A24E1F5A83EDAF7EDD06D8C36671B79F9601891DA155E2E806B97A31A84EE0B10A640712091F5F0C755C8
Malicious:	false
Preview:	....w..u37..!x.....G7k.._..@r..oZ.s.4W.W.O.e.jY.E....JR.:.../.h<.]1 H..@...k.4"K.-.O.eg.k....F...t.a.m.8.d..,B.A<..:.....Q].V.>..c?.Q...c......d..=".../X...[..^`S...&...,.DT....#..$-...;...C.o.vg.Y.s...!...'Q.:T.!3..K\|6..l)VP..#Y.K...e.:.?.yp.pa...-......N2.....b!Rm.v7.L....4+...F\.1....k....5(d.H...;............g.(p..w...;.j.....#.h....x.Q1....o..0'v..c.e.u...g`i.E.n..#:.j.........<sW...hqn.m.j..>....L..<......7@+..\.y....4{C.=u..u..KL......-HX.....@...!..1q....X.-.. ..{j!J\|.[j.$.8@.=.A.\...j.\|......oM..UN...7...f....Ey....<w Nx...Vs0(.......4>k.....{*n.......:"....j>...c..... ...D..e.Bo.........x.k..v.....".......=.p<....7].r..}..C...VQ.S..Q....F..P%W....<.....f#..F.......=..y...w~.b.........h..N.8.K.......T-..r=I..!@.........~.}.y...(...b`..&...sY...Q.o.\|2.p.\.7.... .&...2.,.c...P(M.r..9...\..1`......2L.j._....D."<"..........z.{.X..kF.{.c.....f.^(..T`.....E..<+.0...Gm0+..VQ..b..pR.w1.1+....k....S.....g^..+..$..Aut.X.!AC'7...#.2..6...f"..f/

C:\Users\Dylan\Desktop\PowerPoint.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2986
Entropy (8bit):	7.927485899988996
Encrypted:	false
SSDEEP:	48:QNpgewy1YLm4qGk1agt2cERnTuFn/1IkWurDf5bZ2/xMBr/P2uvuPr7wvaa:ipzdn4q3Mgt2Ln4/1lHhbZ5rhuPr2p
MD5:	0F59D243A250994347042AEA2239D175
SHA1:	0B3B810AE457D3BD4FA5B060300C5C31DF7C5A0A
SHA-256:	A16B30119EFF0ACCB110DEE2B5710408CB771788E3A0875F3EFCD6056821C249
SHA-512:	222A664F1A30F8482391538E0B10D5C52F83D3763B9A24E1F5A83EDAF7EDD06D8C36671B79F9601891DA155E2E806B97A31A84EE0B10A640712091F5F0C755C8
Malicious:	false
Preview:	....w..u37..!x.....G7k.._..@r..oZ.s.4W.W.O.e.jY.E....JR.:.../.h<.]1 H..@...k.4"K.-.O.eg.k....F...t.a.m.8.d..,B.A<..:.....Q].V.>..c?.Q...c......d..=".../X...[..^`S...&...,.DT....#..$-...;...C.o.vg.Y.s...!...'Q.:T.!3..K\|6..l)VP..#Y.K...e.:.?.yp.pa...-......N2.....b!Rm.v7.L....4+...F\.1....k....5(d.H...;............g.(p..w...;.j.....#.h....x.Q1....o..0'v..c.e.u...g`i.E.n..#:.j.........<sW...hqn.m.j..>....L..<......7@+..\.y....4{C.=u..u..KL......-HX.....@...!..1q....X.-.. ..{j!J\|.[j.$.8@.=.A.\...j.\|......oM..UN...7...f....Ey....<w Nx...Vs0(.......4>k.....{*n.......:"....j>...c..... ...D..e.Bo.........x.k..v.....".......=.p<....7].r..}..C...VQ.S..Q....F..P%W....<.....f#..F.......=..y...w~.b.........h..N.8.K.......T-..r=I..!@.........~.}.y...(...b`..&...sY...Q.o.\|2.p.\.7.... .&...2.,.c...P(M.r..9...\..1`......2L.j._....D."<"..........z.{.X..kF.{.c.....f.^(..T`.....E..<+.0...Gm0+..VQ..b..pR.w1.1+....k....S.....g^..+..$..Aut.X.!AC'7...#.2..6...f"..f/

C:\Users\Dylan\Desktop\Word.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2987
Entropy (8bit):	7.929294109690686
Encrypted:	false
SSDEEP:	48:Dh/1ggJxJnOagz+Zp393ugW/MHnXe7cn9shdjtEyf2/gabLcskKaPXq/G+S:Djfr7u+1+gWk3e7+90dKCEtJua/K
MD5:	9E88D569231275ED302A32EB3F2BD59D
SHA1:	F87F25D8E2D60CC8C0545E0B1E180A05815D9508
SHA-256:	72D3CBA7AA87DFE622B21E4A744C7B5B88E58E7ABDD9FCF91698AD70B895ED6F
SHA-512:	898D7F027C8722384DFC2284AE2835B3DBF6A516815EC156EDF50E397C0CFD37A13D3AD211902D069067052FAA4A7296DC6D7AAC280479BC4AF49ED167862262
Malicious:	false
Preview:	I..D.z.\|..#.=.qdfk .OZ..5.......aE.G0..1j..2.z.........%..@..,+..}.Z+.S.l...V....Rf.>..q....c7PM.(eU..)b...#...<G.N..L/_S.%..9..'C_.ITC...'.....~.7.a9.....w.4..B.O.PjZ..Vb{Q....p...d.W=..OOo..}..>..7.P....&z....}.}.+v'>Z..=%#z...+Q.....lGp.C...H9.e.@..M.hhk...+...!...Z&..HM..,..9L.&.....Y.....<U -f...J..h3...}..VSf@.;6.k].]...I.[ ...v;0..s...z9..e....T...1vC..>v....k)...........Y"..mf..v........?1..q.c....D;.....}nv..M^..;<.[...-.{.Xy...f.WB.%..l...A9......O.zZ..R`..h..y.q....8F24.......Eg...x.....W....M..?G....K2_`~.j..6..).T..V.......-{.4.G.....Tm.;..k.J.c&..R.....F..r....g........?%0 .$......&f..u.G^!;X.o..Y..>..\|f..*@.Z.......v.b.Okl..@1..$..e..jb.&[.8.O.\.l.t...l...`.....h..2..Q_.n....4wo.....3.............P.=.<.....O....`.W..c6.....{1.._..G..9oa...E: W...g,/g..y..fd.}..8a.......wT........{.{RM...^.Go....+i..Y .\|..&..DZ....i..p...........u...."IG..E..].{[C....R.....%j.)..5'o.V...H.........0..~...Y.?G..?3>.1Usz.xs...&6

C:\Users\Dylan\Desktop\Word.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2987
Entropy (8bit):	7.929294109690686
Encrypted:	false
SSDEEP:	48:Dh/1ggJxJnOagz+Zp393ugW/MHnXe7cn9shdjtEyf2/gabLcskKaPXq/G+S:Djfr7u+1+gWk3e7+90dKCEtJua/K
MD5:	9E88D569231275ED302A32EB3F2BD59D
SHA1:	F87F25D8E2D60CC8C0545E0B1E180A05815D9508
SHA-256:	72D3CBA7AA87DFE622B21E4A744C7B5B88E58E7ABDD9FCF91698AD70B895ED6F
SHA-512:	898D7F027C8722384DFC2284AE2835B3DBF6A516815EC156EDF50E397C0CFD37A13D3AD211902D069067052FAA4A7296DC6D7AAC280479BC4AF49ED167862262
Malicious:	false
Preview:	I..D.z.\|..#.=.qdfk .OZ..5.......aE.G0..1j..2.z.........%..@..,+..}.Z+.S.l...V....Rf.>..q....c7PM.(eU..)b...#...<G.N..L/_S.%..9..'C_.ITC...'.....~.7.a9.....w.4..B.O.PjZ..Vb{Q....p...d.W=..OOo..}..>..7.P....&z....}.}.+v'>Z..=%#z...+Q.....lGp.C...H9.e.@..M.hhk...+...!...Z&..HM..,..9L.&.....Y.....<U -f...J..h3...}..VSf@.;6.k].]...I.[ ...v;0..s...z9..e....T...1vC..>v....k)...........Y"..mf..v........?1..q.c....D;.....}nv..M^..;<.[...-.{.Xy...f.WB.%..l...A9......O.zZ..R`..h..y.q....8F24.......Eg...x.....W....M..?G....K2_`~.j..6..).T..V.......-{.4.G.....Tm.;..k.J.c&..R.....F..r....g........?%0 .$......&f..u.G^!;X.o..Y..>..\|f..*@.Z.......v.b.Okl..@1..$..e..jb.&[.8.O.\.l.t...l...`.....h..2..Q_.n....4wo.....3.............P.=.<.....O....`.W..c6.....{1.._..G..9oa...E: W...g,/g..y..fd.}..8a.......wT........{.{RM...^.Go....+i..Y .\|..&..DZ....i..p...........u...."IG..E..].{[C....R.....%j.)..5'o.V...H.........0..~...Y.?G..?3>.1Usz.xs...&6

C:\Users\Dylan\Desktop\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\Dylan\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.688378008036759
Encrypted:	false
SSDEEP:	12:kor3fEksMFng1dCpfHqDHLbrw0B7fhxq4d7dc6WnVPH3caqs4P/LcE2zx7LpoZYi:kEEkzFnwM9KDHLnx7fPhDTaqrP/raxfk
MD5:	A87C08B70BE198C3A48B9C7D44D059DC
SHA1:	000D98084A57230390B4463D9D540D264A15163A
SHA-256:	9F78BE99B4E89DFAB0D5D85C51C4C7C7D1491CE709A0DE6CDD9492E0A9518ECB
SHA-512:	45243DCD259BB7C32C914C7B8E51C5B6798DB28C580F07581D173C06DD39DBF010B869271BC4CFF0B7FFF997BA3508C08702F211F1A0ACE428AD1940BDFDD35A
Malicious:	false
Preview:	....0V6f.Q...6o+.p.....HCS....kh.+.);{..L....0.....\...u.I....s..D....?.....i......$.b....kO.@\.6.c.=!P....r.....d..B.8.....awh.A...Z.......&]...H.y.2..P.I....G. `Vh.H....2.0LO....Q.+."vm....PnN.S.s$.F.X..=.$......;Y.....l..$..&.U..*(..Mo.....Y....;s.c@N....a"....8...z...p...t..f:.hG\....8..`).."`.s....bj.<....\.oE..RC.e.EZ..R.....lU..G..GsjP2....4....n..S.}.F..o.o.r..zt.....G=.......L..m+......`N.....G.....k.w..S.....b..p...{..s......,....&-Y...a.?+5_.../..t...H...._u.8.....a.%.5....3.'...h.-d.r.t..(........;u.-.=./..e.......dN..W.~....K.1..T...MV.j....R}/..bE....l..u.i&..,..... ......V.......#a.2...K....@...7<..K.UVk...2.z..I..]...390.&H....\..].4u.u.. ..q2.%l..{2..yk.C.......................

C:\Users\Dylan\Favorites\Bing.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.688378008036759
Encrypted:	false
SSDEEP:	12:kor3fEksMFng1dCpfHqDHLbrw0B7fhxq4d7dc6WnVPH3caqs4P/LcE2zx7LpoZYi:kEEkzFnwM9KDHLnx7fPhDTaqrP/raxfk
MD5:	A87C08B70BE198C3A48B9C7D44D059DC
SHA1:	000D98084A57230390B4463D9D540D264A15163A
SHA-256:	9F78BE99B4E89DFAB0D5D85C51C4C7C7D1491CE709A0DE6CDD9492E0A9518ECB
SHA-512:	45243DCD259BB7C32C914C7B8E51C5B6798DB28C580F07581D173C06DD39DBF010B869271BC4CFF0B7FFF997BA3508C08702F211F1A0ACE428AD1940BDFDD35A
Malicious:	false
Preview:	....0V6f.Q...6o+.p.....HCS....kh.+.);{..L....0.....\...u.I....s..D....?.....i......$.b....kO.@\.6.c.=!P....r.....d..B.8.....awh.A...Z.......&]...H.y.2..P.I....G. `Vh.H....2.0LO....Q.+."vm....PnN.S.s$.F.X..=.$......;Y.....l..$..&.U..*(..Mo.....Y....;s.c@N....a"....8...z...p...t..f:.hG\....8..`).."`.s....bj.<....\.oE..RC.e.EZ..R.....lU..G..GsjP2....4....n..S.}.F..o.o.r..zt.....G=.......L..m+......`N.....G.....k.w..S.....b..p...{..s......,....&-Y...a.?+5_.../..t...H...._u.8.....a.%.5....3.'...h.-d.r.t..(........;u.-.=./..e.......dN..W.~....K.1..T...MV.j....R}/..bE....l..u.i&..,..... ......V.......#a.2...K....@...7<..K.UVk...2.z..I..]...390.&H....\..].4u.u.. ..q2.%l..{2..yk.C.......................

C:\Users\Dylan\Favorites\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\Dylan\Links\Desktop.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	7.786729814122188
Encrypted:	false
SSDEEP:	24:gY2YikiQ5tz2n9Wv128s+0rARN/9Lj/HDl6g94ViG/VZoG:gtY+M/HC4dTDsg2v/Vh
MD5:	96B2666583BC27ADC9D92770C5D4F4A8
SHA1:	C5AAE565206A125C51E752712EB04E8AEFE3D115
SHA-256:	9AF2A184734AB8CE5B3EFC7438E6FFC049617DC6EE029B475E2629E1D6761D48
SHA-512:	5206406091F120967CFDD73F45821CF5D22C6C926EC23DA9D8BB8A08B8A62B313289D991442237E05C3BCDC3C31AD72EEA7DEE847392DA0F6EFFAD1B3FF38149
Malicious:	false
Preview:	.`...FG.Q_.....K.......].......\Q.#..W..}I...k$.......7.#O.../Y8.M.1...C......&P3....u......g.c(7).g..V\....;..{..'..RF......j.p5QJ.8...\.>.K....Y ...eCe..u..5......4...$..(...@...u.%.......+..g.....7T.,..m.6/....C..ZT$`.T.r..7..@.K..`..FUop.p..f......t)...u..)....Q&!.r./.IR.6J..)...]....`....f3N:.^.;..{..Pz\|.j.(v:3A....8!..H.......>'...}.....0\|..c.J4.IB.z}.V....r.W...P..{.&...#f...e.......W.Qwn..>.:.........g3$EN..R......Jpg.`n.{....S.M..Gw%..c.Q..^.^...Lp..g..1.-E.'.jG..n.6..f..:....g9.q:.-..._\..v.vy....O.H...C$~.g..i..q.~.m..\|.n.%p>....i....vy.).\|...V.m.#.x<.w..Lt...$...../...`5.....ODJB...A.7.\/....[...C....oU....9.....S.kE........d.;......29.y..@.`Z..0...\.a.Z...YSm....,.b...OHrY)...F]................y.v..;eWg.l.N..H. ..<]d.,..X.rSB~...0..)..`..?.{..3...r............J.z../.......NM`g.[R.W./........?.?.YQ....i..,@...n<..c...2...?I2........z.k.v...}..Jj.........:....5.......I.L.....[..6.3....u..H..V......X...pV.\r..x......

C:\Users\Dylan\Links\Desktop.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1030
Entropy (8bit):	7.786729814122188
Encrypted:	false
SSDEEP:	24:gY2YikiQ5tz2n9Wv128s+0rARN/9Lj/HDl6g94ViG/VZoG:gtY+M/HC4dTDsg2v/Vh
MD5:	96B2666583BC27ADC9D92770C5D4F4A8
SHA1:	C5AAE565206A125C51E752712EB04E8AEFE3D115
SHA-256:	9AF2A184734AB8CE5B3EFC7438E6FFC049617DC6EE029B475E2629E1D6761D48
SHA-512:	5206406091F120967CFDD73F45821CF5D22C6C926EC23DA9D8BB8A08B8A62B313289D991442237E05C3BCDC3C31AD72EEA7DEE847392DA0F6EFFAD1B3FF38149
Malicious:	false
Preview:	.`...FG.Q_.....K.......].......\Q.#..W..}I...k$.......7.#O.../Y8.M.1...C......&P3....u......g.c(7).g..V\....;..{..'..RF......j.p5QJ.8...\.>.K....Y ...eCe..u..5......4...$..(...@...u.%.......+..g.....7T.,..m.6/....C..ZT$`.T.r..7..@.K..`..FUop.p..f......t)...u..)....Q&!.r./.IR.6J..)...]....`....f3N:.^.;..{..Pz\|.j.(v:3A....8!..H.......>'...}.....0\|..c.J4.IB.z}.V....r.W...P..{.&...#f...e.......W.Qwn..>.:.........g3$EN..R......Jpg.`n.{....S.M..Gw%..c.Q..^.^...Lp..g..1.-E.'.jG..n.6..f..:....g9.q:.-..._\..v.vy....O.H...C$~.g..i..q.~.m..\|.n.%p>....i....vy.).\|...V.m.#.x<.w..Lt...$...../...`5.....ODJB...A.7.\/....[...C....oU....9.....S.kE........d.;......29.y..@.`Z..0...\.a.Z...YSm....,.b...OHrY)...F]................y.v..;eWg.l.N..H. ..<]d.,..X.rSB~...0..)..`..?.{..3...r............J.z../.......NM`g.[R.W./........?.?.YQ....i..,@...n<..c...2...?I2........z.k.v...}..Jj.........:....5.......I.L.....[..6.3....u..H..V......X...pV.\r..x......

C:\Users\Dylan\Links\Downloads.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	7.865870634169468
Encrypted:	false
SSDEEP:	24:PKDmYOsVv94EVlyywfIEK7JQZpFyTbz7hBvzVqc83Tb2uQX5UBW3BdlckDAk5Rp9:PKDmkVvZwy4InJC2dXqc8DSuTidlckB9
MD5:	8A83AC8689C6A4192028F3D37852F71D
SHA1:	1180DDA41EC32602897182DE68494AF4CB6E10C1
SHA-256:	9D927A0392070968E49513EEBCD407B459A857E41525B191755372214A1D40EE
SHA-512:	6BBB3F5870BAAF48A1BCA000A5F40963B68D6769C66A2F3EFA5184854FCE654DD4F596F93883769C8FB75C126805BBE107B6EABD779E11A0602507AC1C177AB1
Malicious:	false
Preview:	...\_"o..>..0.?.c.@-.}...Sd...ZN. .....W...f.....;.I.T.(.&{.U..#...iH...j.}\....@....5iM.Iv.....}..\7..1(>1....O...g.Z....7..;...".(.9.....4...`+.w...>,..u.yh~..y[..].c..1.p.,.;g"...(<.Hf.Aq\}>.P....p8.}S.....in...\|..O..0.t...........@..a.f.......Z..dQ:..W!..!S@j..V.;h.\|#>!w.7...\|I...$........3[:v..Lx..D0.".HL..]..f{tL?AL.U...Kig[.&.h....~..r<i.......{[t...!.'..&....R#W..7;.....B.{t?..U...D.e..(...W.8.8.2..b.^-..Y....UE.H?o.X..8U.f..C...%X.Z$...m..o..?...vCI.ny...}TE-.xXc..F`......A.GC(x?....}..s..{..........8C...".A3.5.e.=T.n.Hk..E....x....-..[~\|k.-..7.......?.X.....j...(^.1c,...PV...eo+...l.RS.....H\|#V.fI1...Y.@i...z~.2..(..b#.......b.GU.2..4.2ps...#R.J.Z.\|...1..7M...!Q..(,.>....z.vQ@ ..E..$M...}!G..}fM...1...W...O.. u..j.H... bW...@...6.".....<b.Q_+.. .....P.Ms..t......./.._.!G..\|.uY.V......E.Lr..i.....!........*.....R.T.@jn.3..=._.4.../.....O..;.~...X...)..8..{5`.D.R].d.RnvE..vo.4.R..E...h..a...D,...Br.o,.u.j...E

C:\Users\Dylan\Links\Downloads.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	7.865870634169468
Encrypted:	false
SSDEEP:	24:PKDmYOsVv94EVlyywfIEK7JQZpFyTbz7hBvzVqc83Tb2uQX5UBW3BdlckDAk5Rp9:PKDmkVvZwy4InJC2dXqc8DSuTidlckB9
MD5:	8A83AC8689C6A4192028F3D37852F71D
SHA1:	1180DDA41EC32602897182DE68494AF4CB6E10C1
SHA-256:	9D927A0392070968E49513EEBCD407B459A857E41525B191755372214A1D40EE
SHA-512:	6BBB3F5870BAAF48A1BCA000A5F40963B68D6769C66A2F3EFA5184854FCE654DD4F596F93883769C8FB75C126805BBE107B6EABD779E11A0602507AC1C177AB1
Malicious:	false
Preview:	...\_"o..>..0.?.c.@-.}...Sd...ZN. .....W...f.....;.I.T.(.&{.U..#...iH...j.}\....@....5iM.Iv.....}..\7..1(>1....O...g.Z....7..;...".(.9.....4...`+.w...>,..u.yh~..y[..].c..1.p.,.;g"...(<.Hf.Aq\}>.P....p8.}S.....in...\|..O..0.t...........@..a.f.......Z..dQ:..W!..!S@j..V.;h.\|#>!w.7...\|I...$........3[:v..Lx..D0.".HL..]..f{tL?AL.U...Kig[.&.h....~..r<i.......{[t...!.'..&....R#W..7;.....B.{t?..U...D.e..(...W.8.8.2..b.^-..Y....UE.H?o.X..8U.f..C...%X.Z$...m..o..?...vCI.ny...}TE-.xXc..F`......A.GC(x?....}..s..{..........8C...".A3.5.e.=T.n.Hk..E....x....-..[~\|k.-..7.......?.X.....j...(^.1c,...PV...eo+...l.RS.....H\|#V.fI1...Y.@i...z~.2..(..b#.......b.GU.2..4.2ps...#R.J.Z.\|...1..7M...!Q..(,.>....z.vQ@ ..E..$M...}!G..}fM...1...W...O.. u..j.H... bW...@...6.".....<b.Q_+.. .....P.Ms..t......./.._.!G..\|.uY.V......E.Lr..i.....!........*.....R.T.@jn.3..=._.4.../.....O..;.~...X...)..8..{5`.D.R].d.RnvE..vo.4.R..E...h..a...D,...Br.o,.u.j...E

C:\Users\Dylan\Links\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\Dylan\NTUSER.DAT

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1835544
Entropy (8bit):	7.999906063200432
Encrypted:	true
SSDEEP:	49152:V7IPz6LNY9+gUdTKALJ9paN9Z7r6864nMpeaS2eGQno:V0PkWwNxLXuD64nMgLo
MD5:	2B471B6BC081D9D1C05CBDB77D38FC07
SHA1:	487C814E7EB5B920E273EE0AD9C4213163C5A554
SHA-256:	4744D72BA42128A47C06A8680D29E249EB7BC2997700B6FA686C39B570C76D03
SHA-512:	722A2FC34A38EFA852DDA0BD4CB71D61ACE36EF25B31398992E1531297A4E14523F88194703AD4E64B6E4AD29BEA6F55C86981948F2B80D7B22386581BA0FFFA
Malicious:	false
Preview:	......~.T.2....$vm.. V3../G..r.X#."\.arX)....I<....s....s...^[Q...Z...#.}#.-?3.;...?.V....4..cM.d3#....9..... .X%...J...h.X3c....k@.......y.......-`2 ..&.O.WP.>8..._.Ba.T...m4X3X>+.]............,....s:).....>.....6..YCK...(vzH...Y..j.uSk..w.n.@..t..QBb-erS..S.z..lK25].H..o.X...Is..'.....4R.sT.Zd.%.w../...<.qh..Bn.$.:c.Wb.S"V..o..f8q\|M..CRs9D....]Nrn...2..5.w.&7.IQg.....`.lR..y.g...>..PD.E.6..79<..kE....ou..{...(...k..=&.}.....H..=........~..5O.......)s:[...&.......5D;.b.}.SJ..Iou..y..<0.P.#.5..[_....\|....}a+D.$_.....:x<q.Z}...\|..W}...<O...e......H.a_I.mP..,.....X..9.d0.WFZ8ez...I.$.L5;.W...x......Y..f......$.....J..4&..xR.("\..D.8.'!..>+.lq^...W.bY4.....-..^B...../..w.....Z..9X...}h...B@..9.\|;D._..6U.t........21L#.....$.5j.CKT..i..{...>T.9'A6k..H.;&.q.Zl.v.......o.......[.....B.j.....C.mx...><..u<..K..%.Y...q2.M..z.>...B..7WVq}/.~w.$......`p..h...65Y.4..../.I.]..Yv.... \....nD~rm............w~}.>I ..........L#.$Y......RK...."..O.....i....k

C:\Users\Dylan\NTUSER.DAT.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1835544
Entropy (8bit):	7.999906063200432
Encrypted:	true
SSDEEP:	49152:V7IPz6LNY9+gUdTKALJ9paN9Z7r6864nMpeaS2eGQno:V0PkWwNxLXuD64nMgLo
MD5:	2B471B6BC081D9D1C05CBDB77D38FC07
SHA1:	487C814E7EB5B920E273EE0AD9C4213163C5A554
SHA-256:	4744D72BA42128A47C06A8680D29E249EB7BC2997700B6FA686C39B570C76D03
SHA-512:	722A2FC34A38EFA852DDA0BD4CB71D61ACE36EF25B31398992E1531297A4E14523F88194703AD4E64B6E4AD29BEA6F55C86981948F2B80D7B22386581BA0FFFA
Malicious:	false
Preview:	......~.T.2....$vm.. V3../G..r.X#."\.arX)....I<....s....s...^[Q...Z...#.}#.-?3.;...?.V....4..cM.d3#....9..... .X%...J...h.X3c....k@.......y.......-`2 ..&.O.WP.>8..._.Ba.T...m4X3X>+.]............,....s:).....>.....6..YCK...(vzH...Y..j.uSk..w.n.@..t..QBb-erS..S.z..lK25].H..o.X...Is..'.....4R.sT.Zd.%.w../...<.qh..Bn.$.:c.Wb.S"V..o..f8q\|M..CRs9D....]Nrn...2..5.w.&7.IQg.....`.lR..y.g...>..PD.E.6..79<..kE....ou..{...(...k..=&.}.....H..=........~..5O.......)s:[...&.......5D;.b.}.SJ..Iou..y..<0.P.#.5..[_....\|....}a+D.$_.....:x<q.Z}...\|..W}...<O...e......H.a_I.mP..,.....X..9.d0.WFZ8ez...I.$.L5;.W...x......Y..f......$.....J..4&..xR.("\..D.8.'!..>+.lq^...W.bY4.....-..^B...../..w.....Z..9X...}h...B@..9.\|;D._..6U.t........21L#.....$.5j.CKT..i..{...>T.9'A6k..H.;&.q.Zl.v.......o.......[.....B.j.....C.mx...><..u<..K..%.Y...q2.M..z.>...B..7WVq}/.~w.$......`p..h...65Y.4..../.I.]..Yv.... \....nD~rm............w~}.>I ..........L#.$Y......RK...."..O.....i....k

C:\Users\Dylan\Searches\Everywhere.search-ms

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.6950904271856775
Encrypted:	false
SSDEEP:	12:N/SRx1BxLZ7rpjnsy6amyHn5jyl8X3bKnaDLWoqP5TVmgJ3fJmAaTIzLxnS62K/:dejrZ5slyZAoqPeofQTIzFnqa
MD5:	BBAFE2B036A39CDA66E01244BD607405
SHA1:	489205E8717372B2810853B62E265957AB371778
SHA-256:	01EEB92EC2AA09ABFD4970102C8EB58488C37CD7DFACC8633204EE98BC7CC832
SHA-512:	C657E0D9C7EED2DE63CCCA69B77F27E6D562529B7125B3698734B31EDF0FEAB67ED2DAC22038CE6361D9B94A2F5149F0A913043A283FED8434FD1779268E4124
Malicious:	false
Preview:	DH......`.<6M$................f..k.#f.\|d.H...\|...Y!.nxX...`Si3....C4(....e...._.`6.D...5....\|8.b.GlJ.....qj.6u.M%m#.v^L..D.\|......d.S.c.a.R..s...........y.H.q.2..X1^..5hO.o....n.7BJS...~.ng"..o..Oa......o.t.i.....Z.DP].)?.O.p]..=..9...).e.._d.A.n..T..\.....O.Q\|...... G...N....N.U.4..... {..hq....e..h.R....D.l.:.2S........C.A.....>..<U...`..{.....d..[..j.P.QJs...l............../F;...fjT.s.DA.Q..h......].g.:.Sr.R..av.F+Ct.ek..Z.....:v..K.....W......g.t...........;....iN`..A.P9.0..1......o~.?.N#cu..6C......4s(..A..`7.z.%..G...K ..Z...k.l.d...% ..w=..K..y.....r..}B..w.kyks....n..][M..Z.y.....B..(A..}..h.3...I0.((...Q..wS<s.G{..bR.J...%)`..7.............}.C.7.)R.er.D..C5......8....b...B.2O..[(.J.r....!w...-......G.7I.......................

C:\Users\Dylan\Searches\Everywhere.search-ms.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.6950904271856775
Encrypted:	false
SSDEEP:	12:N/SRx1BxLZ7rpjnsy6amyHn5jyl8X3bKnaDLWoqP5TVmgJ3fJmAaTIzLxnS62K/:dejrZ5slyZAoqPeofQTIzFnqa
MD5:	BBAFE2B036A39CDA66E01244BD607405
SHA1:	489205E8717372B2810853B62E265957AB371778
SHA-256:	01EEB92EC2AA09ABFD4970102C8EB58488C37CD7DFACC8633204EE98BC7CC832
SHA-512:	C657E0D9C7EED2DE63CCCA69B77F27E6D562529B7125B3698734B31EDF0FEAB67ED2DAC22038CE6361D9B94A2F5149F0A913043A283FED8434FD1779268E4124
Malicious:	false
Preview:	DH......`.<6M$................f..k.#f.\|d.H...\|...Y!.nxX...`Si3....C4(....e...._.`6.D...5....\|8.b.GlJ.....qj.6u.M%m#.v^L..D.\|......d.S.c.a.R..s...........y.H.q.2..X1^..5hO.o....n.7BJS...~.ng"..o..Oa......o.t.i.....Z.DP].)?.O.p]..=..9...).e.._d.A.n..T..\.....O.Q\|...... G...N....N.U.4..... {..hq....e..h.R....D.l.:.2S........C.A.....>..<U...`..{.....d..[..j.P.QJs...l............../F;...fjT.s.DA.Q..h......].g.:.Sr.R..av.F+Ct.ek..Z.....:v..K.....W......g.t...........;....iN`..A.P9.0..1......o~.?.N#cu..6C......4s(..A..`7.z.%..G...K ..Z...k.l.d...% ..w=..K..y.....r..}B..w.kyks....n..][M..Z.y.....B..(A..}..h.3...I0.((...Q..wS<s.G{..bR.J...%)`..7.............}.C.7.)R.er.D..C5......8....b...B.2O..[(.J.r....!w...-......G.7I.......................

C:\Users\Dylan\Searches\Indexed Locations.search-ms

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.691552911742934
Encrypted:	false
SSDEEP:	12:aXecIjGzGxdHVz9jjtIdKh8ZdwiMLN3z/AUH79QobD0peO1sQWZ9lxZ/:AIGzGrHLtvRn30C7K4DqefZ9lH
MD5:	93433A6C7D17C5170AAD9C8247F7BD6A
SHA1:	7C78A6CF945A91E32024425648A6A4711395A75D
SHA-256:	5E1BECFCE00FCCB0390CE11FEC852F38F9887AF9967DF5540568532AFA053264
SHA-512:	13B4CA2D5883762893F857FFE855D10E31DD315007A54258B902D3C623FFB2C5EE9951C2497DEC67E049A605B9C050011048E1A04A5C7BCDF11D4A3B06D6C94D
Malicious:	false
Preview:	......p.....Ck.\|Z.vS..B...........@.<..V..XS...f..9.....x..L....K8......I....w......G.Q.l/!.M...........tA.}..n...k.z.....2.._..3+z.....}..`..b.{..jl<..6......U..,p.7.8r.hAq....wK.....{.(.4.......1.....N.kqt...x.....i. ...T.d.\|./....l...sd#.{.6..L.{...)....L.q.#..;.)..=!....>..g....3.j..D..`.#..O.n.Xt..!=H.....o.W;.n..D...[.E..A.JQ...j..0...%l..:.^.A.1..q...^i.1g.6..N...)..(~7.%v.F.7A..Z.I.].B..D.Q....C...a.p..h.n&.u....0..V..3Fu...o.s..dy..l{V.......+.\.vb.....2..F..`#..p..QS.....<g..Ql..\yg[....3.(D.....d].+.$....I_...H\|.vJ...m2..A....=...........{..?...I..&u.........U\|z.4...N..F&;.]....(7.\|.U..3...p#...I.o...?k,.4T6.>.Q#..V.s.....e..........Z......O\..6.0u...>II.a1&.&vN>..)IWg...."\|V.~u.. ...y.......................

C:\Users\Dylan\Searches\Indexed Locations.search-ms.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.691552911742934
Encrypted:	false
SSDEEP:	12:aXecIjGzGxdHVz9jjtIdKh8ZdwiMLN3z/AUH79QobD0peO1sQWZ9lxZ/:AIGzGrHLtvRn30C7K4DqefZ9lH
MD5:	93433A6C7D17C5170AAD9C8247F7BD6A
SHA1:	7C78A6CF945A91E32024425648A6A4711395A75D
SHA-256:	5E1BECFCE00FCCB0390CE11FEC852F38F9887AF9967DF5540568532AFA053264
SHA-512:	13B4CA2D5883762893F857FFE855D10E31DD315007A54258B902D3C623FFB2C5EE9951C2497DEC67E049A605B9C050011048E1A04A5C7BCDF11D4A3B06D6C94D
Malicious:	false
Preview:	......p.....Ck.\|Z.vS..B...........@.<..V..XS...f..9.....x..L....K8......I....w......G.Q.l/!.M...........tA.}..n...k.z.....2.._..3+z.....}..`..b.{..jl<..6......U..,p.7.8r.hAq....wK.....{.(.4.......1.....N.kqt...x.....i. ...T.d.\|./....l...sd#.{.6..L.{...)....L.q.#..;.)..=!....>..g....3.j..D..`.#..O.n.Xt..!=H.....o.W;.n..D...[.E..A.JQ...j..0...%l..:.^.A.1..q...^i.1g.6..N...)..(~7.%v.F.7A..Z.I.].B..D.Q....C...a.p..h.n&.u....0..V..3Fu...o.s..dy..l{V.......+.\.vb.....2..F..`#..p..QS.....<g..Ql..\yg[....3.(D.....d].+.$....I_...H\|.vJ...m2..A....=...........{..?...I..&u.........U\|z.4...N..F&;.]....(7.\|.U..3...p#...I.o...?k,.4T6.>.Q#..V.s.....e..........Z......O\..6.0u...>II.a1&.&vN>..)IWg...."\|V.~u.. ...y.......................

C:\Users\Dylan\Searches\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\Dylan\Searches\winrt--{S-1-5-21-3425316567-2969588382-3778222414-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.8428296187204785
Encrypted:	false
SSDEEP:	24:FK3qa4FwJ88/lEyc+Z0PHEywWf+tkQXKZryhnaxJqdVODNeAJGMO2dPKaroK:HwJpl1X2PHEXykkQXKmThn7kP5EK
MD5:	928882E5D2C7DECEE324F4DE3263B12E
SHA1:	8CFAD74D03E1B7B30AD11E707F6E6C10E622DE69
SHA-256:	A009044E6569AB3858D33BA153CA61F1DB68AE957F4F07D51735518CF8696829
SHA-512:	D2907156A3B4B6DF328FF2D878FDA040320FE1975284E77175CB4D53B15B607C62B6FE64B21CA8C1F7FA17F3B59CB5CDD1CE5767760CA8F53A299938DA13ACBA
Malicious:	false
Preview:	{..'u...j...._..v......c.^o>.$.}...av...I.$..q.b..qE.V....d"...F...W#k.....jW.A=.rCu.$..3...ORXq....'.o....j.=....(\.......v.........n ..................;.%.w...oG.k..'G...e5..:w1a..6g.\|7n..)....."G.mam./T..[...i.i/.D/H...R.....M.^r....d..>..Z..G.EQj....f/H9b....O...7..j...1G..N.~.w.t.7iM...?....Xk...C...B..j.....k.@i...R.#.A....:...>.x..c.....+b.^T..//.e...e\C.Yd....:.H^.F5R.a..q.7.Z.9.O..O..oQ.xK7j...-s.<x.(/.CL......>.m4.....Y.......'.+sm..eUIN....=.LP.4......\x....}....!S./.;.z>.i....b.4.....,$..D...G.._...cNV.G./L.....eI..x.Hai...P...JnJ.Oa..Kj.#......E....5...zg.6....q..u;...:.k.:y.x..j..E.....>.J.0..a...i..<.pO..1..P.....!L...1[3...B.(.cG.....F......\|q.k......Y..:.9.3...frA.{...5....{....w....:.......L.Y...b....zz>..z......*..,g6xI.....J..k.,.W......?8....&"?.(...l[.[..H...hK+.................!...=z..$.5.....F\.......t..G..4...O...U@..+.=.v...NX.r.^#.`u...{ .HA...^..N.9.G.>H..nO..W.Gr...o=.\|...&.U.B.J.Zc.=o.kD3.5...}[..

C:\Users\Dylan\Searches\winrt--{S-1-5-21-3425316567-2969588382-3778222414-1002}-.searchconnector-ms.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.8428296187204785
Encrypted:	false
SSDEEP:	24:FK3qa4FwJ88/lEyc+Z0PHEywWf+tkQXKZryhnaxJqdVODNeAJGMO2dPKaroK:HwJpl1X2PHEXykkQXKmThn7kP5EK
MD5:	928882E5D2C7DECEE324F4DE3263B12E
SHA1:	8CFAD74D03E1B7B30AD11E707F6E6C10E622DE69
SHA-256:	A009044E6569AB3858D33BA153CA61F1DB68AE957F4F07D51735518CF8696829
SHA-512:	D2907156A3B4B6DF328FF2D878FDA040320FE1975284E77175CB4D53B15B607C62B6FE64B21CA8C1F7FA17F3B59CB5CDD1CE5767760CA8F53A299938DA13ACBA
Malicious:	false
Preview:	{..'u...j...._..v......c.^o>.$.}...av...I.$..q.b..qE.V....d"...F...W#k.....jW.A=.rCu.$..3...ORXq....'.o....j.=....(\.......v.........n ..................;.%.w...oG.k..'G...e5..:w1a..6g.\|7n..)....."G.mam./T..[...i.i/.D/H...R.....M.^r....d..>..Z..G.EQj....f/H9b....O...7..j...1G..N.~.w.t.7iM...?....Xk...C...B..j.....k.@i...R.#.A....:...>.x..c.....+b.^T..//.e...e\C.Yd....:.H^.F5R.a..q.7.Z.9.O..O..oQ.xK7j...-s.<x.(/.CL......>.m4.....Y.......'.+sm..eUIN....=.LP.4......\x....}....!S./.;.z>.i....b.4.....,$..D...G.._...cNV.G./L.....eI..x.Hai...P...JnJ.Oa..Kj.#......E....5...zg.6....q..u;...:.k.:y.x..j..E.....>.J.0..a...i..<.pO..1..P.....!L...1[3...B.(.cG.....F......\|q.k......Y..:.9.3...frA.{...5....{....w....:.......L.Y...b....zz>..z......*..,g6xI.....J..k.,.W......?8....&"?.(...l[.[..H...hK+.................!...=z..$.5.....F\.......t..G..4...O...U@..+.=.v...NX.r.^#.`u...{ .HA...^..N.9.G.>H..nO..W.Gr...o=.\|...&.U.B.J.Zc.=o.kD3.5...}[..

C:\Users\Dylan\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\.curlrc

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	544
Entropy (8bit):	7.582731220075323
Encrypted:	false
SSDEEP:	12:KEpkS0d9ywfpbz71Z1geS8uol4HRhJdTHIYS/:LkS6Aeha8Dl4HRJHIYC
MD5:	51396649DDC8671B3D0648D768D3BB37
SHA1:	74E32BEDEFFCC77220DA973358FD8BCA1ECDE516
SHA-256:	60C2FDB40580190A9F21150EB109DC21A67CBF596E9A3BD569D52DC25BDFA317
SHA-512:	58C7BB1B2D6D5FCEE80E7405BE9B890A5B21BEEBA49715C0FEFBC537E49647954CEC539ED3CFE653F93823598B11A80BF38C178748EACDA7FDFE372254F7D36A
Malicious:	false
Preview:	...mS...}.'.?.+k.=...0.g. b.l.......;.-.%....h.R......BP.../P.L.f........p.p......,..c}.@.%.5(..93..M.6/."....gP...Y.......Q..Zi2..qL.....F.I..xkP..t.._>".70pj...y+0...%.....[.j..t..RbW...K..(.=..o.;..>L..j....@....L.CE...l...\z....h......I......2.E....\|..h4.._..].).]3t4......<.OK.T_n.......m...Xr.Jh.Y.W.I..[.0..X}~...,...{.5I\|.A...:....W.............*.N.(<.Sl.DM.).....7.eF..b[......U}.++.`...C........l....0]#.eB... ...JwYoQ..Y.....1..V.=..] ....,..31S...%.z-L.R#L....m.c....B.Yu....k~hxN.......................

C:\Users\user\.curlrc.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	544
Entropy (8bit):	7.582731220075323
Encrypted:	false
SSDEEP:	12:KEpkS0d9ywfpbz71Z1geS8uol4HRhJdTHIYS/:LkS6Aeha8Dl4HRJHIYC
MD5:	51396649DDC8671B3D0648D768D3BB37
SHA1:	74E32BEDEFFCC77220DA973358FD8BCA1ECDE516
SHA-256:	60C2FDB40580190A9F21150EB109DC21A67CBF596E9A3BD569D52DC25BDFA317
SHA-512:	58C7BB1B2D6D5FCEE80E7405BE9B890A5B21BEEBA49715C0FEFBC537E49647954CEC539ED3CFE653F93823598B11A80BF38C178748EACDA7FDFE372254F7D36A
Malicious:	false
Preview:	...mS...}.'.?.+k.=...0.g. b.l.......;.-.%....h.R......BP.../P.L.f........p.p......,..c}.@.%.5(..93..M.6/."....gP...Y.......Q..Zi2..qL.....F.I..xkP..t.._>".70pj...y+0...%.....[.j..t..RbW...K..(.=..o.;..>L..j....@....L.CE...l...\z....h......I......2.E....\|..h4.._..].).]3t4......<.OK.T_n.......m...Xr.Jh.Y.W.I..[.0..X}~...,...{.5I\|.A...:....W.............*.N.(<.Sl.DM.).....7.eF..b[......U}.++.`...C........l....0]#.eB... ...JwYoQ..Y.....1..V.=..] ....,..31S...%.z-L.R#L....m.c....B.Yu....k~hxN.......................

C:\Users\user\Desktop\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863014898753197
Encrypted:	false
SSDEEP:	48:ntHEWLjaUMMBfDVZMLuxyreChnCgfXfzDAT:1EW/mBCxyaChnCgfvzkT
MD5:	F36C7BD0194E1CFFF136D6C39A64466D
SHA1:	7B085569B25A587371CE7E4AF8819658FBCC03EA
SHA-256:	141FED0086639C18719B2004401598C2F94D01DC4A99D370FE5932972827B9AF
SHA-512:	5CA62236EF5922AC2A0B701DB8F4F46D82C07D3CD5CAF939511DB0D5CEA7700D1846D9C018EFBA8CDD1A9D63DA11D5BFE9868E1E3984B9B8155B1B67797CB803
Malicious:	false
Preview:	/!.4~..Z.....s5.,...\...V.s.o,.i.>?W..m)......m.....X.N.=..9..H..q...v..J;.}.L..X.D.gu.8....0p....F.a_.gZ.z..Q..\|.......<..0gx.:.V..5.i<95..D..w.z......~..."...GTA(......I..........]H.a...A.4'.O.p.w.?.t..../.z.^>U.32........<v..h.G.......Q6.%...M.T...C.99...!.S`K.'m3.i9R.....rjh.-.Z..$VKN..TT(......"d{te..p.(j..8.@....Db.&.V.R.})J..6..M..2..3..\(N.c...%.....Z~.....7q.........K6.'z\..&{.3..Q...x.m:....YKdp470..,.S..~K"..AT.nB....i.....>I_<....qYd.(.'.j.M~.cB`....?=..X1i...%-L......}.T.:.0P.wj...1..V3.(..Oc-......m'..7.[9....m.....8R.G.o.A.N..uJ.iy...uS..;...l..L..........Q........+F..Y..w?.k...4.W.C..~.M....8.....P.m.....~...Z...uC..'.....!..63D.3....v......z.{..A.B..S...>.X....S9.....r9...k....%.s.?J.T.1.Y..ej...8....hB..%...68...5.!......vD.E.F.Q.yz.a.......T..D ]....L........O....Cz%.!....rd...=......zU.U.c.cS.....N....YY~..s.Cc...Q.'.A,...\|;..D...d\..H..H...[.6f2lt.^......z....F.I..r ..9...}..4..i.Z....._....&.....D...j..#......-K_.

C:\Users\user\Desktop\BPMLNOBVSB.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863014898753197
Encrypted:	false
SSDEEP:	48:ntHEWLjaUMMBfDVZMLuxyreChnCgfXfzDAT:1EW/mBCxyaChnCgfvzkT
MD5:	F36C7BD0194E1CFFF136D6C39A64466D
SHA1:	7B085569B25A587371CE7E4AF8819658FBCC03EA
SHA-256:	141FED0086639C18719B2004401598C2F94D01DC4A99D370FE5932972827B9AF
SHA-512:	5CA62236EF5922AC2A0B701DB8F4F46D82C07D3CD5CAF939511DB0D5CEA7700D1846D9C018EFBA8CDD1A9D63DA11D5BFE9868E1E3984B9B8155B1B67797CB803
Malicious:	false
Preview:	/!.4~..Z.....s5.,...\...V.s.o,.i.>?W..m)......m.....X.N.=..9..H..q...v..J;.}.L..X.D.gu.8....0p....F.a_.gZ.z..Q..\|.......<..0gx.:.V..5.i<95..D..w.z......~..."...GTA(......I..........]H.a...A.4'.O.p.w.?.t..../.z.^>U.32........<v..h.G.......Q6.%...M.T...C.99...!.S`K.'m3.i9R.....rjh.-.Z..$VKN..TT(......"d{te..p.(j..8.@....Db.&.V.R.})J..6..M..2..3..\(N.c...%.....Z~.....7q.........K6.'z\..&{.3..Q...x.m:....YKdp470..,.S..~K"..AT.nB....i.....>I_<....qYd.(.'.j.M~.cB`....?=..X1i...%-L......}.T.:.0P.wj...1..V3.(..Oc-......m'..7.[9....m.....8R.G.o.A.N..uJ.iy...uS..;...l..L..........Q........+F..Y..w?.k...4.W.C..~.M....8.....P.m.....~...Z...uC..'.....!..63D.3....v......z.{..A.B..S...>.X....S9.....r9...k....%.s.?J.T.1.Y..ej...8....hB..%...68...5.!......vD.E.F.Q.yz.a.......T..D ]....L........O....Cz%.!....rd...=......zU.U.c.cS.....N....YY~..s.Cc...Q.'.A,...\|;..D...d\..H..H...[.6f2lt.^......z....F.I..r ..9...}..4..i.Z....._....&.....D...j..#......-K_.

C:\Users\user\Desktop\BPMLNOBVSB.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863158459574769
Encrypted:	false
SSDEEP:	48:fxHINv+jHizt8THdgmQ6jtFvUTE+klZKdga:fNaeizt8THmE7UTEPZ8
MD5:	9CC3344E814EC2EA817EA61E355358D4
SHA1:	2098C7E6FB32751A616EAFD7D0023518BA4254AE
SHA-256:	CD3B9F7A1AFA5E019A303C4EC8AB9F5EDE0F7281B2206F9AC69D70493AA2F07F
SHA-512:	BC25418AA1835BAA3FDBE5113CB0E96C8C0C948A455CA9A32901D927E3F9A795FF02143FE4CD52E66093E3A3121BFCAA54D4F48629E411DEB14043DB5D595A0A
Malicious:	false
Preview:	.tm%..h.\.............R...f..I..?...V....f.C1g.....0...3...O........~R.,;.zi.n.?..?isF".E.-D..W0..^....V..\|.^I.3S..u.......Z.......l..A.3..?..6W;p..bm4......o..&....9.m2..M...Z]..o..IQ..........Ql'........4...7Y..:6....... .i.YIn....L.c3..R..!.P[.ADj_.f.?......."Dg...O...H.}..\\..i8.....\|`....E.\|/>6...$...Y..T.)..0.d.....O...g....)V..N.4........or.GH.v.....7....h6.....TZ......5d5.3\|..,.;.i...S..[...[...o.jH...C.2.xS....pGha.X..)6!.j.Kq.FE....!....K}M]......A .@`.;.C......`....!.. .~)a.Z.<...S.3......"..;..T...c...B..."8.T....d.Em.S.&C!....v.l..}E....._..a......P...N>..`..`v.Lg..c..X\|.......=..1..]...(..e..mfU'.x.-o..(.4.......V"R.i/U.L...1\....9.8...[..<\|..Y...r.C..,1..M..._.A..2..G./LcP....^.....V..a.w.JS.....K....#.#......]..l....r..+=.X....ewa.....h.X....<....6D1I.4.tW.;...ZF..0...S.....i..:..[b"....N2{.0..?y`u..Z..9:.......D.z........ts.&xH...7....7....Mj..p...L../.9.j...i..$1./.m......EC."..V..b..)GhQi..+.\...V.;.-

C:\Users\user\Desktop\BPMLNOBVSB.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863158459574769
Encrypted:	false
SSDEEP:	48:fxHINv+jHizt8THdgmQ6jtFvUTE+klZKdga:fNaeizt8THmE7UTEPZ8
MD5:	9CC3344E814EC2EA817EA61E355358D4
SHA1:	2098C7E6FB32751A616EAFD7D0023518BA4254AE
SHA-256:	CD3B9F7A1AFA5E019A303C4EC8AB9F5EDE0F7281B2206F9AC69D70493AA2F07F
SHA-512:	BC25418AA1835BAA3FDBE5113CB0E96C8C0C948A455CA9A32901D927E3F9A795FF02143FE4CD52E66093E3A3121BFCAA54D4F48629E411DEB14043DB5D595A0A
Malicious:	false
Preview:	.tm%..h.\.............R...f..I..?...V....f.C1g.....0...3...O........~R.,;.zi.n.?..?isF".E.-D..W0..^....V..\|.^I.3S..u.......Z.......l..A.3..?..6W;p..bm4......o..&....9.m2..M...Z]..o..IQ..........Ql'........4...7Y..:6....... .i.YIn....L.c3..R..!.P[.ADj_.f.?......."Dg...O...H.}..\\..i8.....\|`....E.\|/>6...$...Y..T.)..0.d.....O...g....)V..N.4........or.GH.v.....7....h6.....TZ......5d5.3\|..,.;.i...S..[...[...o.jH...C.2.xS....pGha.X..)6!.j.Kq.FE....!....K}M]......A .@`.;.C......`....!.. .~)a.Z.<...S.3......"..;..T...c...B..."8.T....d.Em.S.&C!....v.l..}E....._..a......P...N>..`..`v.Lg..c..X\|.......=..1..]...(..e..mfU'.x.-o..(.4.......V"R.i/U.L...1\....9.8...[..<\|..Y...r.C..,1..M..._.A..2..G./LcP....^.....V..a.w.JS.....K....#.#......]..l....r..+=.X....ewa.....h.X....<....6D1I.4.tW.;...ZF..0...S.....i..:..[b"....N2{.0..?y`u..Z..9:.......D.z........ts.&xH...7....7....Mj..p...L../.9.j...i..$1./.m......EC."..V..b..)GhQi..+.\...V.;.-

C:\Users\user\Desktop\BPMLNOBVSB\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.866637560096621
Encrypted:	false
SSDEEP:	24:S2gPbn7QghLhGPz14I2ptuT7CaQDwqWESxsDX2KP17BlEzsz3:S2af4Ph4IEsTucqWAtN7PCG
MD5:	1DC85043508E769408AF58AB7D377C03
SHA1:	5E64B727FBE39F3780FF7EB52751A50D477D779D
SHA-256:	A83BED3D994703E63A487991C6F0BF83F795F444F2AC7CDB092D93C0424853B9
SHA-512:	24BDA5B2D089C1F88B31D24A548ED18E1DA5555E1C384EDB8AB4D9C42E3686A8E6704D09DA53E40202AF9A5B8C74A0694D11F3AE5B750040F7C4E61669E86795
Malicious:	false
Preview:	._...{.F:.[...w.e).d.FG9.WU..D.d..x..g+.?O..2..1.E..,@..?...,0.R<9..&...b...NG..0..JM.... .OO..3_gl5E....4;.../..j...x. g.M.&~...G..... O.`...<k........._X..z...."...x...>.......(.F_........S.K.....}}B..0....I..s2....!...p..bJ..`a..#.T....W. ._S .X...7P.......?..y]C.w......i...f............+........4....=H.."4]q%&$i.W...R.Qz..+...UI.....MDgk...3....9~.....}`kg.@.FZ.G,.u.v7?.......4.....@.'....9..$.bb..V..R.....^....0......=...-....C..<.p..3Y.~.w..n....^.x..k..\|z. .(z....kC..$........d.u.......5..@.B.<..U3.......YN....H>..F2p........]....<ei..K.A....;..Fi..H.g.7...-_..g?.%.g...../...n..[X...Ml-W;QO.A^5Lak9........N..`..8..0K..20.=s.&...l.....)k.F...^..p..oR.L.!.w......k.M}..AE.X.,U.E>A.,=8.a..(....W#...yC..4....E..._.s...m.Z`.Q.p..:.\.ilN.,j...T.R..... .L.R5X.!.......U.:a.$.YlEJ...p....).s6...o...L.s.p..>..........h..(b.....j.9.8......!...xY.T.T&...]QPe% .........ZwNN...o...._..1......g>....^....%.. ....".[....4..9..F.!0WT.=..r.

C:\Users\user\Desktop\BPMLNOBVSB\BPMLNOBVSB.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.866637560096621
Encrypted:	false
SSDEEP:	24:S2gPbn7QghLhGPz14I2ptuT7CaQDwqWESxsDX2KP17BlEzsz3:S2af4Ph4IEsTucqWAtN7PCG
MD5:	1DC85043508E769408AF58AB7D377C03
SHA1:	5E64B727FBE39F3780FF7EB52751A50D477D779D
SHA-256:	A83BED3D994703E63A487991C6F0BF83F795F444F2AC7CDB092D93C0424853B9
SHA-512:	24BDA5B2D089C1F88B31D24A548ED18E1DA5555E1C384EDB8AB4D9C42E3686A8E6704D09DA53E40202AF9A5B8C74A0694D11F3AE5B750040F7C4E61669E86795
Malicious:	false
Preview:	._...{.F:.[...w.e).d.FG9.WU..D.d..x..g+.?O..2..1.E..,@..?...,0.R<9..&...b...NG..0..JM.... .OO..3_gl5E....4;.../..j...x. g.M.&~...G..... O.`...<k........._X..z...."...x...>.......(.F_........S.K.....}}B..0....I..s2....!...p..bJ..`a..#.T....W. ._S .X...7P.......?..y]C.w......i...f............+........4....=H.."4]q%&$i.W...R.Qz..+...UI.....MDgk...3....9~.....}`kg.@.FZ.G,.u.v7?.......4.....@.'....9..$.bb..V..R.....^....0......=...-....C..<.p..3Y.~.w..n....^.x..k..\|z. .(z....kC..$........d.u.......5..@.B.<..U3.......YN....H>..F2p........]....<ei..K.A....;..Fi..H.g.7...-_..g?.%.g...../...n..[X...Ml-W;QO.A^5Lak9........N..`..8..0K..20.=s.&...l.....)k.F...^..p..oR.L.!.w......k.M}..AE.X.,U.E>A.,=8.a..(....W#...yC..4....E..._.s...m.Z`.Q.p..:.\.ilN.,j...T.R..... .L.R5X.!.......U.:a.$.YlEJ...p....).s6...o...L.s.p..>..........h..(b.....j.9.8......!...xY.T.T&...]QPe% .........ZwNN...o...._..1......g>....^....%.. ....".[....4..9..F.!0WT.=..r.

C:\Users\user\Desktop\BPMLNOBVSB\FENIVHOIKN.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.879435776739512
Encrypted:	false
SSDEEP:	24:i0jZu8QDyW0tn+J9Sc+QMELXtrymsE0knIo5OQTnG8GWiDRAGMTLZj1aRlpDdM1C:ZjZLl8J97+QdRHOutbiVWZj078GgW
MD5:	C41F9A50FFCEBE0E2CAE7FF82ACA9BAA
SHA1:	988C8AE3D57B8B61D56CA7E7756744C1A3BE48AE
SHA-256:	D09938D7F8D9449610F5D966F77FB85D5C55A5388569FBF9E3B762B7EB4FEDC2
SHA-512:	1E8A13A6961D39AFA54893BF4ADD94FE22C7F4F86BF0325663F1DB16395376315E36946229B72F1EDF8893A44019A465742D0B63468EAC0D464D988965BEB6C7
Malicious:	false
Preview:	.....a.IO.Y~.5e....j.Nd.....x..R..v{....F..,.....uy...=........slaM......,.d..g./.I'+~......^.Ok.G ...^-..Q..t......@Hc...H`....."1..n.) ...-.....b~I.-.\|...X.%...]\|...q...;.........V.e.u...W.J...>.C.x....)5...l.!.e1..M..s..@<.3+#.......E.\|..2...A.K1.lz.7..9.&w.q..1.~......o........O.B..r...}0...0....&....[.zf..I~....{\|WY.:i.....G..r....Y.=+H..n.CX.....N.Mq 5.T-w.g...UQ..2.....@l.G..p..._AH...l..F...Oa.0...d....fN.n..<t..G...0k...6.+....X..\|.e.@>..wYD..@...nX....].s..5#`...D.R.._.n...yAq.yH.....]...)..%.......A.]..Mn}.0.}.h....).N...N;./..v.4=.i.r............E`...#0.z..[.....c.....'.:\.D..@#...>.Gy]BjC...F@..Ia>.i...;.U5j.:.R6Q....6a.-.V........u7].03..9E.</A.j.l}...........9..i...}.Q...9..........$[u.rqS`".."....8;F..X......;X'....\|.o..>I^....DW.'.;.m}.j........~.4\....._....^o.....Yr;.y."....Y+.......q..?v.v...\|.i.u.T.@..[.q...De.,.K..W."J7S.g.o{.u..Nh.AY.F].J..o.&.>`g.....A..$;...7.....Z;..^.t.p.t.Xg..r.&`..{...UC$../....=..YEL

C:\Users\user\Desktop\BPMLNOBVSB\FENIVHOIKN.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.879435776739512
Encrypted:	false
SSDEEP:	24:i0jZu8QDyW0tn+J9Sc+QMELXtrymsE0knIo5OQTnG8GWiDRAGMTLZj1aRlpDdM1C:ZjZLl8J97+QdRHOutbiVWZj078GgW
MD5:	C41F9A50FFCEBE0E2CAE7FF82ACA9BAA
SHA1:	988C8AE3D57B8B61D56CA7E7756744C1A3BE48AE
SHA-256:	D09938D7F8D9449610F5D966F77FB85D5C55A5388569FBF9E3B762B7EB4FEDC2
SHA-512:	1E8A13A6961D39AFA54893BF4ADD94FE22C7F4F86BF0325663F1DB16395376315E36946229B72F1EDF8893A44019A465742D0B63468EAC0D464D988965BEB6C7
Malicious:	false
Preview:	.....a.IO.Y~.5e....j.Nd.....x..R..v{....F..,.....uy...=........slaM......,.d..g./.I'+~......^.Ok.G ...^-..Q..t......@Hc...H`....."1..n.) ...-.....b~I.-.\|...X.%...]\|...q...;.........V.e.u...W.J...>.C.x....)5...l.!.e1..M..s..@<.3+#.......E.\|..2...A.K1.lz.7..9.&w.q..1.~......o........O.B..r...}0...0....&....[.zf..I~....{\|WY.:i.....G..r....Y.=+H..n.CX.....N.Mq 5.T-w.g...UQ..2.....@l.G..p..._AH...l..F...Oa.0...d....fN.n..<t..G...0k...6.+....X..\|.e.@>..wYD..@...nX....].s..5#`...D.R.._.n...yAq.yH.....]...)..%.......A.]..Mn}.0.}.h....).N...N;./..v.4=.i.r............E`...#0.z..[.....c.....'.:\.D..@#...>.Gy]BjC...F@..Ia>.i...;.U5j.:.R6Q....6a.-.V........u7].03..9E.</A.j.l}...........9..i...}.Q...9..........$[u.rqS`".."....8;F..X......;X'....\|.o..>I^....DW.'.;.m}.j........~.4\....._....^o.....Yr;.y."....Y+.......q..?v.v...\|.i.u.T.@..[.q...De.,.K..W."J7S.g.o{.u..Nh.AY.F].J..o.&.>`g.....A..$;...7.....Z;..^.t.p.t.Xg..r.&`..{...UC$../....=..YEL

C:\Users\user\Desktop\BPMLNOBVSB\SFPUSAFIOL.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.87498640330764
Encrypted:	false
SSDEEP:	48:jAGQoZ5F9DtYAVIrEyOWHELjouOhqZbS1cC:jXJ7WwKEy3kYuZbSr
MD5:	AA7CE08EDF4060FC684C75C1295070CF
SHA1:	9EB5668A97FD6DA4459C987D096AB5435375924B
SHA-256:	C43A5886DF389AD666480E1F0169453514869E5194739A37030CA595CFEF5375
SHA-512:	F96D94836D29DF3F2CAF81ADC9FC32F6ED71D35FD2FD62406C9C5365E1DCBEDF9B27CBB99FE390FB71C0566992C1013923E492275C8940BD7E4FFC5F1DD96D52
Malicious:	false
Preview:	-? &D..c..DV....2). J.i...}...,.X3..v...$K9.c...`..c........Q.$M.r.pr.C.Kt.....H.id./....xg3..YL.-.>...@.i@.....C..........,.qbj......o.e......e..Z..Z-...z.%.._E.k...X..cPY[#.....;..\|.....}!\|.....ft.o...Q..L4..Qz..[Q....N...'.j....H..._$......5...B...1f.P..B..{.3.?[.[.eV.....?Y...Y....D)..A..b....g.v.L3..J..O...W..\|..~t)=..>w............Z.Ft.n..p.......AcX.<..!.Q6.J.a.JC..<Cw<sH...........1.E.+.......Vs.<....&6.a...p.D...e.!f......q'..Z.Jjb4..(..a.:..........C.&..y.&p...l.=..8..5......^TL....<h......%2PXPd.#p"..^K....../)\..>...~..g"..h..~..r0x....d.o`...M. Hu.@.I@....F...v...$.d".Jdk.....O`.P.'@........7...7...#n.....]<.ui.d:.V..-...p.!v;.\:`].k.H...1...C}..r.;.V..(8...@Q!._.m;.."....oK...?...j..L..\.....b2M@.1..8\|.....pW[.....09=M.2.].......2....7......").v.x...3.%w..]....3.2.b/mtw..M_.(2.t.X...k-..G.,1..2........b....$V.._.u...b*..K!..2.[...7.F..w...X...~...tB?....=W./}}....2.Tc.G.......b..)Y...s..%9.m../<...l..v...\|..

C:\Users\user\Desktop\BPMLNOBVSB\SFPUSAFIOL.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.87498640330764
Encrypted:	false
SSDEEP:	48:jAGQoZ5F9DtYAVIrEyOWHELjouOhqZbS1cC:jXJ7WwKEy3kYuZbSr
MD5:	AA7CE08EDF4060FC684C75C1295070CF
SHA1:	9EB5668A97FD6DA4459C987D096AB5435375924B
SHA-256:	C43A5886DF389AD666480E1F0169453514869E5194739A37030CA595CFEF5375
SHA-512:	F96D94836D29DF3F2CAF81ADC9FC32F6ED71D35FD2FD62406C9C5365E1DCBEDF9B27CBB99FE390FB71C0566992C1013923E492275C8940BD7E4FFC5F1DD96D52
Malicious:	false
Preview:	-? &D..c..DV....2). J.i...}...,.X3..v...$K9.c...`..c........Q.$M.r.pr.C.Kt.....H.id./....xg3..YL.-.>...@.i@.....C..........,.qbj......o.e......e..Z..Z-...z.%.._E.k...X..cPY[#.....;..\|.....}!\|.....ft.o...Q..L4..Qz..[Q....N...'.j....H..._$......5...B...1f.P..B..{.3.?[.[.eV.....?Y...Y....D)..A..b....g.v.L3..J..O...W..\|..~t)=..>w............Z.Ft.n..p.......AcX.<..!.Q6.J.a.JC..<Cw<sH...........1.E.+.......Vs.<....&6.a...p.D...e.!f......q'..Z.Jjb4..(..a.:..........C.&..y.&p...l.=..8..5......^TL....<h......%2PXPd.#p"..^K....../)\..>...~..g"..h..~..r0x....d.o`...M. Hu.@.I@....F...v...$.d".Jdk.....O`.P.'@........7...7...#n.....]<.ui.d:.V..-...p.!v;.\:`].k.H...1...C}..r.;.V..(8...@Q!._.m;.."....oK...?...j..L..\.....b2M@.1..8\|.....pW[.....09=M.2.].......2....7......").v.x...3.%w..]....3.2.b/mtw..M_.(2.t.X...k-..G.,1..2........b....$V.._.u...b*..K!..2.[...7.F..w...X...~...tB?....=W./}}....2.Tc.G.......b..)Y...s..%9.m../<...l..v...\|..

C:\Users\user\Desktop\BPMLNOBVSB\UOOJJOZIRH.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.855679954023908
Encrypted:	false
SSDEEP:	48:py1r48BO5+07DaSlAjCz6nB6Vf/048wclzd0mvEeA5K:pGXB67+SlAM62X8wckOZwK
MD5:	CF7AA784D3571C4393C80A7209399964
SHA1:	73B28F12742DD181E8C281B33799E92044135B65
SHA-256:	4D17144DED95AB2FB083A8448496BFCEC53156D6F63DDEA34F14F337284D3EF3
SHA-512:	BA2DCDC6E7C254290D27C29FCDB0C2412EAA5F4486B1EDF5556F9066311BC8EFA028DFB952A747989E6862A44DE8CE19C2690390ADCFAC5A40CC047513E6700C
Malicious:	false
Preview:	...d{g..w......Kn)....s4jN2.....$.@?./..u....$e.P.4p._.......!...?1..o..(w. ..a...4+.>h.%..l.2...w.Q.....rK#]...#._U...L....r}...j....n.e....~..>/.^t.....tE...e.../.....p......4.T.BM]....mj"....F9e.BW......~........{7.YaD..ua...._.l.y]..q}.X.7..lO.6..p.F.l..A1..f....u..w=.......'M.m.........c..H..O.<.......6.ah.UY......m...7..c..Y..gw7..l.R.~.*m.W.5....C&.Z...F..!..,.B....5......e....y..."<.....(YeMY....d...' {..S..F.?.=...<...Y......mC).._....`.fQC?..K..O.w/Y....a.p.:.#.0.K..z...R>.,FN.(...J..U.....`..Y'......Ek&...vF..].=.......;6.........e.s..........'....?.$Y.......C..sY.sU...?......o..f.7`+..).....E.Zcv....".t.IB...@1..R..I.r..4[..@..\E..5{K?I.7.A...........G$..vx ...N...lq..".c.C..y...IP.....S...P4t.4.=R...D..~SV...T.s...Sq.;....5%.......F.5..N......g..K.&S .-U.F.H.w....$....l.e.j..q......K..Zf....-...F............p.5>UC.kq.......O;v....$..V.KQ..,x.r0........^.....%....v.<}.....Q....S.f..p..-.o..6.`..:.....r..~.

C:\Users\user\Desktop\BPMLNOBVSB\UOOJJOZIRH.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.855679954023908
Encrypted:	false
SSDEEP:	48:py1r48BO5+07DaSlAjCz6nB6Vf/048wclzd0mvEeA5K:pGXB67+SlAM62X8wckOZwK
MD5:	CF7AA784D3571C4393C80A7209399964
SHA1:	73B28F12742DD181E8C281B33799E92044135B65
SHA-256:	4D17144DED95AB2FB083A8448496BFCEC53156D6F63DDEA34F14F337284D3EF3
SHA-512:	BA2DCDC6E7C254290D27C29FCDB0C2412EAA5F4486B1EDF5556F9066311BC8EFA028DFB952A747989E6862A44DE8CE19C2690390ADCFAC5A40CC047513E6700C
Malicious:	false
Preview:	...d{g..w......Kn)....s4jN2.....$.@?./..u....$e.P.4p._.......!...?1..o..(w. ..a...4+.>h.%..l.2...w.Q.....rK#]...#._U...L....r}...j....n.e....~..>/.^t.....tE...e.../.....p......4.T.BM]....mj"....F9e.BW......~........{7.YaD..ua...._.l.y]..q}.X.7..lO.6..p.F.l..A1..f....u..w=.......'M.m.........c..H..O.<.......6.ah.UY......m...7..c..Y..gw7..l.R.~.*m.W.5....C&.Z...F..!..,.B....5......e....y..."<.....(YeMY....d...' {..S..F.?.=...<...Y......mC).._....`.fQC?..K..O.w/Y....a.p.:.#.0.K..z...R>.,FN.(...J..U.....`..Y'......Ek&...vF..].=.......;6.........e.s..........'....?.$Y.......C..sY.sU...?......o..f.7`+..).....E.Zcv....".t.IB...@1..R..I.r..4[..@..\E..5{K?I.7.A...........G$..vx ...N...lq..".c.C..y...IP.....S...P4t.4.=R...D..~SV...T.s...Sq.;....5%.......F.5..N......g..K.&S .-U.F.H.w....$....l.e.j..q......K..Zf....-...F............p.5>UC.kq.......O;v....$..V.KQ..,x.r0........^.....%....v.<}.....Q....S.f..p..-.o..6.`..:.....r..~.

C:\Users\user\Desktop\BPMLNOBVSB\VAMYDFPUND.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	MIPSEB Ucode
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.879543163796821
Encrypted:	false
SSDEEP:	48:e48YRSg127DY6koT7m5qQ6HqYlfR30uUgttAv8zDBa:e4vRk7DTQeZZUgtyEBa
MD5:	0CDF931F02F966BD8C051339A7A7A8C6
SHA1:	9E57094F70AD5A23E5558293CBC37387AC821ECA
SHA-256:	9E44D79BE489DA9B196B843FD2B7821096416F01AD1C4E477C1A1C2949DE9462
SHA-512:	08FCA26781697216D22B68B9F76778D6366259F0FEEF6FE9F8436A47F689E8B9B99CA52A7DC2142706EA7ECBE5700616646205A146822D590F1D0E73588DA8C4
Malicious:	false
Preview:	....:...(.b).N......z...Avd:}...;....>{._..).lU.X..jb....\|%x1..!gi]+..x..A..t.H../;C..=S.P....i..e'M...".T....#..0.M..y..J.~...;..._G...Cc.nhs!.....CF../g..J:tJ.....5wL%%..=...{Ecxo...r..q=.A...A..h... ........U..y.B..:..[...))Z.dX.../G..x....0I...n..c....>N.k...s:.EG.".....I..B.9....$....q49.lo..U.\(s...k....../.`WzX.....J..^E..w..4I........W.........W.z.z..v,.........}..!....3..)..eT..f...#.x..ta..L..60...Od.cv..r......N$8....!...yz.0.....w.$..Sd...k.7`...c.6.l.2..hS_...!..Y.mM.R.J..N.b..M..f.7.3..7.2...y.tE.......4RO?.8..J.hP.=.yF.eEU3......]....3@.~...\|3On.m...#.d..(M.y.`..0..cT...1.~!.......T9........?......\.b......e.c.&.Gva1..D............SA..3.XH.&..#Bnw...1.."s....U1{\.4lk.......k......G....9......KZ.......+......[......8.D?#....#G.n]=9E.6W..PW...b.l..Q>..... .f..T#..V.....Z...O..m..%. ...#..~.z./A...@.....t0%.LK<...;..s%P_";w....5.+<..^...B.$...&....ze.[.H....8Y....0p..R.v....).J.s.z..6.TDW-,,.M~J....E....z.....SV.8.z../

C:\Users\user\Desktop\BPMLNOBVSB\VAMYDFPUND.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	MIPSEB Ucode
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.879543163796821
Encrypted:	false
SSDEEP:	48:e48YRSg127DY6koT7m5qQ6HqYlfR30uUgttAv8zDBa:e4vRk7DTQeZZUgtyEBa
MD5:	0CDF931F02F966BD8C051339A7A7A8C6
SHA1:	9E57094F70AD5A23E5558293CBC37387AC821ECA
SHA-256:	9E44D79BE489DA9B196B843FD2B7821096416F01AD1C4E477C1A1C2949DE9462
SHA-512:	08FCA26781697216D22B68B9F76778D6366259F0FEEF6FE9F8436A47F689E8B9B99CA52A7DC2142706EA7ECBE5700616646205A146822D590F1D0E73588DA8C4
Malicious:	false
Preview:	....:...(.b).N......z...Avd:}...;....>{._..).lU.X..jb....\|%x1..!gi]+..x..A..t.H../;C..=S.P....i..e'M...".T....#..0.M..y..J.~...;..._G...Cc.nhs!.....CF../g..J:tJ.....5wL%%..=...{Ecxo...r..q=.A...A..h... ........U..y.B..:..[...))Z.dX.../G..x....0I...n..c....>N.k...s:.EG.".....I..B.9....$....q49.lo..U.\(s...k....../.`WzX.....J..^E..w..4I........W.........W.z.z..v,.........}..!....3..)..eT..f...#.x..ta..L..60...Od.cv..r......N$8....!...yz.0.....w.$..Sd...k.7`...c.6.l.2..hS_...!..Y.mM.R.J..N.b..M..f.7.3..7.2...y.tE.......4RO?.8..J.hP.=.yF.eEU3......]....3@.~...\|3On.m...#.d..(M.y.`..0..cT...1.~!.......T9........?......\.b......e.c.&.Gva1..D............SA..3.XH.&..#Bnw...1.."s....U1{\.4lk.......k......G....9......KZ.......+......[......8.D?#....#G.n]=9E.6W..PW...b.l..Q>..... .f..T#..V.....Z...O..m..%. ...#..~.z./A...@.....t0%.LK<...;..s%P_";w....5.+<..^...B.$...&....ze.[.H....8Y....0p..R.v....).J.s.z..6.TDW-,,.M~J....E....z.....SV.8.z../

C:\Users\user\Desktop\BPMLNOBVSB\WKXEWIOTXI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.86836336584866
Encrypted:	false
SSDEEP:	48:BKlGQEuhEF7Fe16ChrYY6BGyjlhvBLw3/z8/:BKFpEF0oCdYdQyjbW3a
MD5:	31B2217C4DFC021839DC73B34CAF19BA
SHA1:	BB19B70B4C8FDB0E5AA26CB78C0BD13E87345782
SHA-256:	35715EE9995F9340DE141C685433C37BB868DAF7383CC2108F9F674F54A21FC3
SHA-512:	F0BE128DD9E86B22C5F5C47A72E0F1BE6BE29DC97BD6EAC42FF2790A3EEBD74AC1B979916A8AF9093B2129DAC0BDBD0048BCAC3BDDAAF1A3950C70FCC9506382
Malicious:	false
Preview:	;....=.@..............c.B.T...o..........!...7......@5.........S[.<..Cn.Un"{...;.VG#............R.=SX..\.d.A..k.%..~.......v...Y..m......s./_..D[Gw.4%...2....]...~&....s(d.Y......8....."......V ).\...i.]..#....t..T.]...+..N......._.Q.....h.zU.z.(...j5.3..t..t. ..1....7.lk...t....r.w..-.Z-...q-..w..!......'.u......f..V.1.....D.{5B.t..q...!n........,>I"a...{.....!.......;>.?.....x.\.eVs].....?...C...\|.....N.2U.K..l...b.4n.\.,..m?~.....f..m{.....+I.}._a:.?.qx.m...._<hl..%..Ah.)......M..-....D.#.....:.9.......}...n}L....B.MC...^.{.9.-s....Rm..i.-f....e....:..1.'...2.@!....r.j.I..O.0......A.4.g.T..lA.6....r....P.?`..M8..#4..".v.7.\|.f_I..YkP.....@v....P{m.km..Y:..U.W.e..$d.x...sc.?k.l)CX6.Y...S.Ehl.-(RV....?9.........m'.0c\| ....D....j,=...x!.e....wCIB.lto.XY.k.e.m.BN.".d.K.&F.M>.x..._.........x\..Q.P.u.L.....@3g{.].6..H...#.08.Y.]J..x.z.'yc]........zL...Jnw......,...=.@0.vJ..s^.L...a{....R...........MJ....-...7r<.......<P...@i.o.HL

C:\Users\user\Desktop\BPMLNOBVSB\WKXEWIOTXI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.86836336584866
Encrypted:	false
SSDEEP:	48:BKlGQEuhEF7Fe16ChrYY6BGyjlhvBLw3/z8/:BKFpEF0oCdYdQyjbW3a
MD5:	31B2217C4DFC021839DC73B34CAF19BA
SHA1:	BB19B70B4C8FDB0E5AA26CB78C0BD13E87345782
SHA-256:	35715EE9995F9340DE141C685433C37BB868DAF7383CC2108F9F674F54A21FC3
SHA-512:	F0BE128DD9E86B22C5F5C47A72E0F1BE6BE29DC97BD6EAC42FF2790A3EEBD74AC1B979916A8AF9093B2129DAC0BDBD0048BCAC3BDDAAF1A3950C70FCC9506382
Malicious:	false
Preview:	;....=.@..............c.B.T...o..........!...7......@5.........S[.<..Cn.Un"{...;.VG#............R.=SX..\.d.A..k.%..~.......v...Y..m......s./_..D[Gw.4%...2....]...~&....s(d.Y......8....."......V ).\...i.]..#....t..T.]...+..N......._.Q.....h.zU.z.(...j5.3..t..t. ..1....7.lk...t....r.w..-.Z-...q-..w..!......'.u......f..V.1.....D.{5B.t..q...!n........,>I"a...{.....!.......;>.?.....x.\.eVs].....?...C...\|.....N.2U.K..l...b.4n.\.,..m?~.....f..m{.....+I.}._a:.?.qx.m...._<hl..%..Ah.)......M..-....D.#.....:.9.......}...n}L....B.MC...^.{.9.-s....Rm..i.-f....e....:..1.'...2.@!....r.j.I..O.0......A.4.g.T..lA.6....r....P.?`..M8..#4..".v.7.\|.f_I..YkP.....@v....P{m.km..Y:..U.W.e..$d.x...sc.?k.l)CX6.Y...S.Ehl.-(RV....?9.........m'.0c\| ....D....j,=...x!.e....wCIB.lto.XY.k.e.m.BN.".d.K.&F.M>.x..._.........x\..Q.P.u.L.....@3g{.].6..H...#.08.Y.]J..x.z.'yc]........zL...Jnw......,...=.@0.vJ..s^.L...a{....R...........MJ....-...7r<.......<P...@i.o.HL

C:\Users\user\Desktop\BPMLNOBVSB\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Desktop\CURQNKVOIX.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868772284814815
Encrypted:	false
SSDEEP:	24:6rV9qbRwqgThEDsz72J5QWra7Rw3hfrQfvQDNKHNKqN86knu9E6LQ4LyPfbYgXiz:6rzlPWsR8frQH4NIy6kuimQ4WPfEgXiz
MD5:	B375A155CEB47A86C1425AEB7B9ECDC4
SHA1:	8DA1050A954EBFF652B729FFA23528D9A085B47B
SHA-256:	E8CFEA10E5C24E54FB74684A7C298CB93FB6A27A31F769B6E5CCB3CC49FCED02
SHA-512:	FA21243FAA706AF3E6709181F49CDD19B37864A05D5B42CF7C219AD31DBCB92CEAEBD622015E4EF7EB171D90923DA577B762E631D5CBB73982EC137376C35B51
Malicious:	false
Preview:	.iSqP...9W.bQ@.(4.<...B..7x.l.../..PJ..8......$<.-...J..`.!@p.Q..E..l.5n...r. 2..a[..........&.0.....4.v.5....%..T>hD.IyV.a.[W.W.?..5q...._xGj.C.../ .$.,d.tY)..M....'...$.M}...t....y=..Z(S.....'..[.q4].p..C.8.r....!"N..{).....(-J3s....`...t..B2.Q..?a...<L.....b.!......%WO]h.L@...:....+H:q.$U..4]....s...3o......U.h...J.lQ`.pk...x.z...C.. .0.....y...Ro.S...%C....P.n.V.d"..>.[=...a.*....x.z....v"......u.m:....P.VO..2j......c...Y.?...n...[\|~.JC2..f...3.\..M..wn$S.N...3[.L&j.y,..9k.D.H..F..M.g.L.6u..-3s..X~..o...(.`".G...._d...HX.B/.!.=..{q .rE"..G..]..Gu\:9.l....a<......S..LF=._..../.m(....0...l..y..^._.H..KM..{.t.tW?..\...,..G........\T,...Z%M`......2a..Y.b...q..d .?...H/.......\j../.y...E...b.._g)..P..H.v]#y..:MA.......P,..H.=...%cNd.t..f.....H..8KMG-^2..?.2.....N..vj...V.]..e.#n.V....I....'}y&.bC..Lz...._..8...=?j.+.wG.p~.M.&...-v+r<...u.$.)4...<.J..u..C...U.f+.Z.(...@...=....8~....>X....w.....a..^..._7\|Q...&. ..t...{Gq..=..&.f..Y.@....L"..[w-

C:\Users\user\Desktop\CURQNKVOIX.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868772284814815
Encrypted:	false
SSDEEP:	24:6rV9qbRwqgThEDsz72J5QWra7Rw3hfrQfvQDNKHNKqN86knu9E6LQ4LyPfbYgXiz:6rzlPWsR8frQH4NIy6kuimQ4WPfEgXiz
MD5:	B375A155CEB47A86C1425AEB7B9ECDC4
SHA1:	8DA1050A954EBFF652B729FFA23528D9A085B47B
SHA-256:	E8CFEA10E5C24E54FB74684A7C298CB93FB6A27A31F769B6E5CCB3CC49FCED02
SHA-512:	FA21243FAA706AF3E6709181F49CDD19B37864A05D5B42CF7C219AD31DBCB92CEAEBD622015E4EF7EB171D90923DA577B762E631D5CBB73982EC137376C35B51
Malicious:	false
Preview:	.iSqP...9W.bQ@.(4.<...B..7x.l.../..PJ..8......$<.-...J..`.!@p.Q..E..l.5n...r. 2..a[..........&.0.....4.v.5....%..T>hD.IyV.a.[W.W.?..5q...._xGj.C.../ .$.,d.tY)..M....'...$.M}...t....y=..Z(S.....'..[.q4].p..C.8.r....!"N..{).....(-J3s....`...t..B2.Q..?a...<L.....b.!......%WO]h.L@...:....+H:q.$U..4]....s...3o......U.h...J.lQ`.pk...x.z...C.. .0.....y...Ro.S...%C....P.n.V.d"..>.[=...a.*....x.z....v"......u.m:....P.VO..2j......c...Y.?...n...[\|~.JC2..f...3.\..M..wn$S.N...3[.L&j.y,..9k.D.H..F..M.g.L.6u..-3s..X~..o...(.`".G...._d...HX.B/.!.=..{q .rE"..G..]..Gu\:9.l....a<......S..LF=._..../.m(....0...l..y..^._.H..KM..{.t.tW?..\...,..G........\T,...Z%M`......2a..Y.b...q..d .?...H/.......\j../.y...E...b.._g)..P..H.v]#y..:MA.......P,..H.=...%cNd.t..f.....H..8KMG-^2..?.2.....N..vj...V.]..e.#n.V....I....'}y&.bC..Lz...._..8...=?j.+.wG.p~.M.&...-v+r<...u.$.)4...<.J..u..C...U.f+.Z.(...@...=....8~....>X....w.....a..^..._7\|Q...&. ..t...{Gq..=..&.f..Y.@....L"..[w-

C:\Users\user\Desktop\Excel.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2949
Entropy (8bit):	7.936546415555967
Encrypted:	false
SSDEEP:	48:hTwx1qjhejljwMQqUPQ9/D09BRvcbI5eON4w8PVYnhEK/Nxtn:h0a5MQXe/D09vvgI58w8Kht/NXn
MD5:	97778F1E692579635F300E6B79CD468A
SHA1:	0409B28A0404875C28B90E3144DAC5E67E1C8261
SHA-256:	CCBE5805921784675CFEFFCB9A259D75FAFD7D98E078DF80F1A984EC835F8244
SHA-512:	ABC1D406D7FF60B5B8D22D3ACA5B6653FBD500697AB4EC1E8D7B84DFCD7B9864CC1A5CA3A57323697E8E2BC26C83DFADDC1737914EA8F841C87FECE2550462FC
Malicious:	false
Preview:	U..6[..q).0.}.X..{.}UN.....s%hP<.2L^'..#.#+...../.G..5.S..Q..L..Sr..Z..~..\|..g.3.#8Z..-~Z..M.-.u...`..z...7.%....O...x.cI-.n..;fRe...._......._..f.\|..d..}...Fk.I...........fF.{.r.n)Kj..V....K..2M../oE,.E...$.4....!@T......j....j.k.Z..=.:$M.....H..`.mb=.z.@.+6.5G..VMJ.p.R.n.............A.N.rR".q7k.._R.Y=....}a9_U)'.?.G.sa.8..<.0^^......f.!<...G>s.T. f-.e..3.G...7.....Bnk.<G. ....s....H.W......K.).M...~o.....-uB$X\|.hk...........n.]....n.....<.....d..U.H_....O.Y......d...<A......R._.!.=...c..Q.t.....j..cA.s..<.uzW..-.kB.0..}e.....E.].Q$..0;...-...\..LuQ...r.b..T0e..j..EyhCE..[...1Q.%8.\..DX..O..y. ."..Y.X..x.....((oo@.5Z.k......{IXx6.~:._eP\\W6....f.. V`.wR8....Fj<.....+r.#g-:.CO../.G..a.......J{..c.a&:.....f#}=_...~".U.../..5.f4.......0z..\i...i\|..7o.}.\|.U.%,......r..V.r%....c}. .8S....GP..uxkF..^..JN..\A..i...\|.rk.I5..i,..].....kK.L1\|r).@Z........0....4..m.....Y%11..5.e..{.d.1XeM.....]..@.X..].....$.7...Z...'..2.v....J..D....2DQ..aG

C:\Users\user\Desktop\Excel.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2949
Entropy (8bit):	7.936546415555967
Encrypted:	false
SSDEEP:	48:hTwx1qjhejljwMQqUPQ9/D09BRvcbI5eON4w8PVYnhEK/Nxtn:h0a5MQXe/D09vvgI58w8Kht/NXn
MD5:	97778F1E692579635F300E6B79CD468A
SHA1:	0409B28A0404875C28B90E3144DAC5E67E1C8261
SHA-256:	CCBE5805921784675CFEFFCB9A259D75FAFD7D98E078DF80F1A984EC835F8244
SHA-512:	ABC1D406D7FF60B5B8D22D3ACA5B6653FBD500697AB4EC1E8D7B84DFCD7B9864CC1A5CA3A57323697E8E2BC26C83DFADDC1737914EA8F841C87FECE2550462FC
Malicious:	false
Preview:	U..6[..q).0.}.X..{.}UN.....s%hP<.2L^'..#.#+...../.G..5.S..Q..L..Sr..Z..~..\|..g.3.#8Z..-~Z..M.-.u...`..z...7.%....O...x.cI-.n..;fRe...._......._..f.\|..d..}...Fk.I...........fF.{.r.n)Kj..V....K..2M../oE,.E...$.4....!@T......j....j.k.Z..=.:$M.....H..`.mb=.z.@.+6.5G..VMJ.p.R.n.............A.N.rR".q7k.._R.Y=....}a9_U)'.?.G.sa.8..<.0^^......f.!<...G>s.T. f-.e..3.G...7.....Bnk.<G. ....s....H.W......K.).M...~o.....-uB$X\|.hk...........n.]....n.....<.....d..U.H_....O.Y......d...<A......R._.!.=...c..Q.t.....j..cA.s..<.uzW..-.kB.0..}e.....E.].Q$..0;...-...\..LuQ...r.b..T0e..j..EyhCE..[...1Q.%8.\..DX..O..y. ."..Y.X..x.....((oo@.5Z.k......{IXx6.~:._eP\\W6....f.. V`.wR8....Fj<.....+r.#g-:.CO../.G..a.......J{..c.a&:.....f#}=_...~".U.../..5.f4.......0z..\i...i\|..7o.}.\|.U.%,......r..V.r%....c}. .8S....GP..uxkF..^..JN..\A..i...\|.rk.I5..i,..].....kK.L1\|r).@Z........0....4..m.....Y%11..5.e..{.d.1XeM.....]..@.X..].....$.7...Z...'..2.v....J..D....2DQ..aG

C:\Users\user\Desktop\FENIVHOIKN.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.860237237077045
Encrypted:	false
SSDEEP:	48:nAoA/fy8VHL/2pHtBhQswwwmCDe/4HIpW:AoA/fyQHrA/hKi8M4opW
MD5:	E618521E40D43AF0FE47DF36632547BD
SHA1:	937D62687D80B80395A7B1EF0942C0DAACB00AC1
SHA-256:	82ADF4A96C44EE7A8ECFD7A5B7B8B744FE7CA02CC527503D647DCABBC69EC7D5
SHA-512:	B098EEAE5569CD6CBF8CB5DD151714E184274040AD18D72F65C1BE9C67C84ECF00F410716B7837C6EFD538304011FE7B7F3689C1793AEA4B3335287125FB81DD
Malicious:	false
Preview:	...4.tVZ\....T...&.X...F..v...=&pg...F6.h.^U.....5.....)&U(.G.u...,M.P.....e.6.\|crY);c..U.{.9Q../.4.m.5.#..s....G.&.Q...Yb.8...9]..y)..I7v4....;....\..E.[....d..-..Y.W.2...H....$1.r.,8.:X...t /0).;d...6.......;^........Q#6v.m.. .........7e#.........B.65..r.0X.DW.{.D......Bu...].A...1 .J.p....l.{....$8v<...4.L..M.2.=...!!.......O...hkK..`+C(,,-...2r...I.b......]...Z.7..lYL....a.J...V<....B.z..s..H1....\a........>G.....j.....t.A....."P~.#.H.. .....&.CK.u.@Q..D..[~.. o.pG.rL..5...`._.U~A........I.. .V<.._p....v..).....C........u...m ......~2.!....w.......y..I...Dg]W&..".t..Y.~.I.MW.9.+7.T....W"...k..+.@.u.....q^.R6.....O.JP....DH.....J..1.~e.(..l~B....(ps8^...Tr.'+J..7A.MG.:.g..........>G.........p..u@...q.......$PJ.^.!o.>@.Rg.{.glG...pn.0!./aEo..")U9`J....!<=.1.rF..qY..H)b...P...`9...5{Qib.".7}Dv..9K/..Y.......Q.6......8e..%..]....D......B...S..V.M.=....i...IO...2%..f.....`NS.'.....?P....'..c.9s.`p..@......+q..t"`l.y..u.v.\|.....Y.U.H..

C:\Users\user\Desktop\FENIVHOIKN.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.860237237077045
Encrypted:	false
SSDEEP:	48:nAoA/fy8VHL/2pHtBhQswwwmCDe/4HIpW:AoA/fyQHrA/hKi8M4opW
MD5:	E618521E40D43AF0FE47DF36632547BD
SHA1:	937D62687D80B80395A7B1EF0942C0DAACB00AC1
SHA-256:	82ADF4A96C44EE7A8ECFD7A5B7B8B744FE7CA02CC527503D647DCABBC69EC7D5
SHA-512:	B098EEAE5569CD6CBF8CB5DD151714E184274040AD18D72F65C1BE9C67C84ECF00F410716B7837C6EFD538304011FE7B7F3689C1793AEA4B3335287125FB81DD
Malicious:	false
Preview:	...4.tVZ\....T...&.X...F..v...=&pg...F6.h.^U.....5.....)&U(.G.u...,M.P.....e.6.\|crY);c..U.{.9Q../.4.m.5.#..s....G.&.Q...Yb.8...9]..y)..I7v4....;....\..E.[....d..-..Y.W.2...H....$1.r.,8.:X...t /0).;d...6.......;^........Q#6v.m.. .........7e#.........B.65..r.0X.DW.{.D......Bu...].A...1 .J.p....l.{....$8v<...4.L..M.2.=...!!.......O...hkK..`+C(,,-...2r...I.b......]...Z.7..lYL....a.J...V<....B.z..s..H1....\a........>G.....j.....t.A....."P~.#.H.. .....&.CK.u.@Q..D..[~.. o.pG.rL..5...`._.U~A........I.. .V<.._p....v..).....C........u...m ......~2.!....w.......y..I...Dg]W&..".t..Y.~.I.MW.9.+7.T....W"...k..+.@.u.....q^.R6.....O.JP....DH.....J..1.~e.(..l~B....(ps8^...Tr.'+J..7A.MG.:.g..........>G.........p..u@...q.......$PJ.^.!o.>@.Rg.{.glG...pn.0!./aEo..")U9`J....!<=.1.rF..qY..H)b...P...`9...5{Qib.".7}Dv..9K/..Y.......Q.6......8e..%..]....D......B...S..V.M.=....i...IO...2%..f.....`NS.'.....?P....'..c.9s.`p..@......+q..t"`l.y..u.v.\|.....Y.U.H..

C:\Users\user\Desktop\FENIVHOIKN.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.875589422375371
Encrypted:	false
SSDEEP:	48:wQFd2VYuimjwINN5njet2vXyPkYg1xVNhEd17T:LcYuiQXN5jR6PkYIx23
MD5:	DF8161AC0A09F7051F4EEA7E52BEB5FF
SHA1:	F4694C34C5DB9DF714E5EBD7BE407834FF4384AF
SHA-256:	5335F4F059C44CF0E07875AD395A2DFEE149B8C81264FEA037288DF87B96BD19
SHA-512:	9171A168E63426A4E166BA44365E8A838D07B3DBF9179FD58031D799093D231A04CD30D914289A896D144FF6D7CE08D9ADDAF51D123CE504F4D48095AB9B901C
Malicious:	false
Preview:	\|d....k.JR.>A...w.I."M.....=+....".3BV.....P .m...I.....>.C...!..W....d..V.g..U..]2.]..T;oJ......../.{T."G)..1vi.K....d.....rj.D.&K.i+.p....@......B..QQ....H.5......hn..A..>\|....`..}......]......!7...)&..>..L.O.3..n(JDn....#\|...Q........u...n.{[.[.#`w..V..:a..q...L.]..R>.vvm...1.d..n#...(,...nN.P..a6.h..m..bz.._...!+.V..S.{..)...u$..<(8...D...8Z.a.u../..P.M.`..3QP...-?WR[....Z.'!7..m..W$.j..v&M.(..fiQ.Q...j..{"Jle.V.......3./h..?.......fn.V.^(."..rcZ..]....3../.UT.$TE3..........%..{/.G.....Cn.2.j.=..1.jS...+U..:<.F.:.....aa]..!H4.b%....2.1n......b...C....4..2r&'...d.2..._.[.L.B;..c1...].v..N!p.e.j..@.8. .$a...c+O.X..Q.....=...\X#..{.<.1..9....2.U.v........u..^..a..L'.C...+N.A.~..Y.g..Q......^......p.....z.Q%...y.X!.$Q....d$..\|9..r$B..<(........P.{5..Mz..qI.....s...CZS.8.........&1..i.A..P('..u.+..w..B.....A.!<Um.....e.;..b6s1UG1..h.+a....S...O9.Gh..q........*B.?#....H..a.j..f.P.{....0.!...,..\|.^s..s.}...V..z.^.e.5.L.

C:\Users\user\Desktop\FENIVHOIKN.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.875589422375371
Encrypted:	false
SSDEEP:	48:wQFd2VYuimjwINN5njet2vXyPkYg1xVNhEd17T:LcYuiQXN5jR6PkYIx23
MD5:	DF8161AC0A09F7051F4EEA7E52BEB5FF
SHA1:	F4694C34C5DB9DF714E5EBD7BE407834FF4384AF
SHA-256:	5335F4F059C44CF0E07875AD395A2DFEE149B8C81264FEA037288DF87B96BD19
SHA-512:	9171A168E63426A4E166BA44365E8A838D07B3DBF9179FD58031D799093D231A04CD30D914289A896D144FF6D7CE08D9ADDAF51D123CE504F4D48095AB9B901C
Malicious:	false
Preview:	\|d....k.JR.>A...w.I."M.....=+....".3BV.....P .m...I.....>.C...!..W....d..V.g..U..]2.]..T;oJ......../.{T."G)..1vi.K....d.....rj.D.&K.i+.p....@......B..QQ....H.5......hn..A..>\|....`..}......]......!7...)&..>..L.O.3..n(JDn....#\|...Q........u...n.{[.[.#`w..V..:a..q...L.]..R>.vvm...1.d..n#...(,...nN.P..a6.h..m..bz.._...!+.V..S.{..)...u$..<(8...D...8Z.a.u../..P.M.`..3QP...-?WR[....Z.'!7..m..W$.j..v&M.(..fiQ.Q...j..{"Jle.V.......3./h..?.......fn.V.^(."..rcZ..]....3../.UT.$TE3..........%..{/.G.....Cn.2.j.=..1.jS...+U..:<.F.:.....aa]..!H4.b%....2.1n......b...C....4..2r&'...d.2..._.[.L.B;..c1...].v..N!p.e.j..@.8. .$a...c+O.X..Q.....=...\X#..{.<.1..9....2.U.v........u..^..a..L'.C...+N.A.~..Y.g..Q......^......p.....z.Q%...y.X!.$Q....d$..\|9..r$B..<(........P.{5..Mz..qI.....s...CZS.8.........&1..i.A..P('..u.+..w..B.....A.!<Um.....e.;..b6s1UG1..h.+a....S...O9.Gh..q........*B.?#....H..a.j..f.P.{....0.!...,..\|.^s..s.}...V..z.^.e.5.L.

C:\Users\user\Desktop\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8643288564350255
Encrypted:	false
SSDEEP:	24:2OBlrkAs//Tr8fdHdc99m7GCPePGxsgmxanVLVrAc3oPcLsPZRWp1/bcJ0ye:2OVsni+erP4G2gmx0JYkAPWE0ye
MD5:	76A106E5DF0DEE6C5C66D63A885E8308
SHA1:	51D349D36AF6C6DA4275A5B19F797D0CEADFAE99
SHA-256:	CE6CFF07936899F5A6B0AB29E46492CBC2A84DB75598BE8830B57EC3000BE207
SHA-512:	B35C90C64A244190668625852C538A76798E0A85381F682281C5845D71A5E5C71D5CE2BEB77A1677897ABA08FA45E99CFA1221573581EDDB0CA5E73D398760FE
Malicious:	false
Preview:	..n..x.{Q.OH.i.t.D"wH\|..}].....d...@.;Mc......>........DZ.h.Pg....WqO]"..^...G.^...0(.5.....".l.;.......?d[.u.Y..........D...)Y06!......6].5q...[..#L..-..."P.sb......^.r..H'R...:....v.B._6......{k%...L&@4j<.\...8.SH.,}...&......]...G..=..^..)u.....`c!.I.W.E..C....p........Tin.~...t.).....e[O....?(ah.$.s?.........:x.,.....A.I.....o..Fp.!ID.F.,..$..L\n0.'.......b!........]6...a...n..R5..Y....R..l.i...x.}..#w+../....>e..0....m...c...../.........L...G'..X.@... 0../.M.....>..cZ...'.K...~.).!..&,.zJ!.b.J..[.bIy..EM..%a....^."...2]'..........^...s.`.M...d.Z{........a..2h...R.....'{uKO.........Q....m5R.s5bC.P....@n.C....a]x.mV.$.Iv......N.F....;.EU...V.4,.w..X)..^...a....\|..2.H.r.Q..H..t..9K}.F(v...b...a...>X..]....3..<+......W.(.H.C...];........x..'2M\|<.......?...Sa..}j.?n...Za.&..%b.."\|....m......o.w...._..$O...{.G..X+.TzO.X.e..o.B..p..!q...Z.../i.....4...:z.....1.V^.e.......=.%....n.E...+\|...MZ+Yy...%..i.XG....N...]`$....a.?..)lB..x......B...p\|

C:\Users\user\Desktop\LSBIHQFDVT.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8643288564350255
Encrypted:	false
SSDEEP:	24:2OBlrkAs//Tr8fdHdc99m7GCPePGxsgmxanVLVrAc3oPcLsPZRWp1/bcJ0ye:2OVsni+erP4G2gmx0JYkAPWE0ye
MD5:	76A106E5DF0DEE6C5C66D63A885E8308
SHA1:	51D349D36AF6C6DA4275A5B19F797D0CEADFAE99
SHA-256:	CE6CFF07936899F5A6B0AB29E46492CBC2A84DB75598BE8830B57EC3000BE207
SHA-512:	B35C90C64A244190668625852C538A76798E0A85381F682281C5845D71A5E5C71D5CE2BEB77A1677897ABA08FA45E99CFA1221573581EDDB0CA5E73D398760FE
Malicious:	false
Preview:	..n..x.{Q.OH.i.t.D"wH\|..}].....d...@.;Mc......>........DZ.h.Pg....WqO]"..^...G.^...0(.5.....".l.;.......?d[.u.Y..........D...)Y06!......6].5q...[..#L..-..."P.sb......^.r..H'R...:....v.B._6......{k%...L&@4j<.\...8.SH.,}...&......]...G..=..^..)u.....`c!.I.W.E..C....p........Tin.~...t.).....e[O....?(ah.$.s?.........:x.,.....A.I.....o..Fp.!ID.F.,..$..L\n0.'.......b!........]6...a...n..R5..Y....R..l.i...x.}..#w+../....>e..0....m...c...../.........L...G'..X.@... 0../.M.....>..cZ...'.K...~.).!..&,.zJ!.b.J..[.bIy..EM..%a....^."...2]'..........^...s.`.M...d.Z{........a..2h...R.....'{uKO.........Q....m5R.s5bC.P....@n.C....a]x.mV.$.Iv......N.F....;.EU...V.4,.w..X)..^...a....\|..2.H.r.Q..H..t..9K}.F(v...b...a...>X..]....3..<+......W.(.H.C...];........x..'2M\|<.......?...Sa..}j.?n...Za.&..%b.."\|....m......o.w...._..$O...{.G..X+.TzO.X.e..o.B..p..!q...Z.../i.....4...:z.....1.V^.e.......=.%....n.E...+\|...MZ+Yy...%..i.XG....N...]`$....a.?..)lB..x......B...p\|

C:\Users\user\Desktop\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8497979406911425
Encrypted:	false
SSDEEP:	48:b5di4F5pAITJyWagf7mr0ehztdsu5TCWr7xCzQZdI:jfhTUWaPr0Wou5+27xCuI
MD5:	33430014C5DB517235D1003887BA45E1
SHA1:	A11858C0346A6B52032E7536C6AA50D00922E459
SHA-256:	1A081B1BD2154FF1F1374209E96833D9E65B9F0FCC3735D6C78939DE5856388E
SHA-512:	1D8A78542C834EA6E3EA132917D1938000CF4A53E00ECF32F473C76766946D8F7781DA56029A34C8A071B85E79EEE7D4F835C9E5000CE34419466995FE653577
Malicious:	true
Preview:	....3?........0B.>...C>..$1.y=U83.......3&.CF..\|.3JS......=/...2.+g.E......;.n.v............od.)....XE=...Nj........Sm..{{.....X..\|h.-/..eP.s`(L.fy..8.....n.....C.OJ~C......I....5~.cA.@%."WL.G.96m!P.g.)p.."...j.jXm.P...7...:..}.j.V[.t.]j..cn.x.!.....M.r.i..........R.u.i.&>Nr..D......~.cd......].C...I.s.P.).._.}./N...$vUh.%..+.G....eI!..4........r.....A.?.e..6.<$...Xv...6...1\|[7.+8.^.O_C.......T.....}..\....7t......2.r2aEu.A.R.0.`..G.fu..:...0.@;>.......F@\.M._`...G.ly.r..C+W]k.Z.`..?@..A....{-5...o.6..W.6......dN....2..Z{..N..i.j.B4&..M...>.==.1.I...py.....D..B..}-..X:.@...~.......0.=JW{E\|..l.....{+.L.].)F..1...v.kh.w1.&.k.4.L.Fmo6.v`{...6t...ZC..c....3.7......6k8.....j9N.....]/...?....w.~.X.....wR..ATe...}....K..Xe...92.....\3eS.Ns.` .}4.i....].....Vr...ZO!w4.2qYX&T'..zV.Pm.....}.....$Z.....*...L..6.OZ@-.7.l..:...Y.E.r.~]d2.x....0..~.`H..1".... X... .'.&....Y.......=.j...Q.L..#.h.pl...Pj..%.....r].d....&.......\|.nN.;.Z.c$...0

C:\Users\user\Desktop\NIKHQAIQAU.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8497979406911425
Encrypted:	false
SSDEEP:	48:b5di4F5pAITJyWagf7mr0ehztdsu5TCWr7xCzQZdI:jfhTUWaPr0Wou5+27xCuI
MD5:	33430014C5DB517235D1003887BA45E1
SHA1:	A11858C0346A6B52032E7536C6AA50D00922E459
SHA-256:	1A081B1BD2154FF1F1374209E96833D9E65B9F0FCC3735D6C78939DE5856388E
SHA-512:	1D8A78542C834EA6E3EA132917D1938000CF4A53E00ECF32F473C76766946D8F7781DA56029A34C8A071B85E79EEE7D4F835C9E5000CE34419466995FE653577
Malicious:	false
Preview:	....3?........0B.>...C>..$1.y=U83.......3&.CF..\|.3JS......=/...2.+g.E......;.n.v............od.)....XE=...Nj........Sm..{{.....X..\|h.-/..eP.s`(L.fy..8.....n.....C.OJ~C......I....5~.cA.@%."WL.G.96m!P.g.)p.."...j.jXm.P...7...:..}.j.V[.t.]j..cn.x.!.....M.r.i..........R.u.i.&>Nr..D......~.cd......].C...I.s.P.).._.}./N...$vUh.%..+.G....eI!..4........r.....A.?.e..6.<$...Xv...6...1\|[7.+8.^.O_C.......T.....}..\....7t......2.r2aEu.A.R.0.`..G.fu..:...0.@;>.......F@\.M._`...G.ly.r..C+W]k.Z.`..?@..A....{-5...o.6..W.6......dN....2..Z{..N..i.j.B4&..M...>.==.1.I...py.....D..B..}-..X:.@...~.......0.=JW{E\|..l.....{+.L.].)F..1...v.kh.w1.&.k.4.L.Fmo6.v`{...6t...ZC..c....3.7......6k8.....j9N.....]/...?....w.~.X.....wR..ATe...}....K..Xe...92.....\3eS.Ns.` .}4.i....].....Vr...ZO!w4.2qYX&T'..zV.Pm.....}.....$Z.....*...L..6.OZ@-.7.l..:...Y.E.r.~]d2.x....0..~.`H..1".... X... .'.&....Y.......=.j...Q.L..#.h.pl...Pj..%.....r].d....&.......\|.nN.;.Z.c$...0

C:\Users\user\Desktop\NIKHQAIQAU\BPMLNOBVSB.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.861226053683968
Encrypted:	false
SSDEEP:	24:Y/BhZ+cPJsstyyWaKhz5ma0m2OeFXK1qy7tw9io+6Zi4LVqUbdKibEa:Y/ZDJs2yLhtm9AeUF7twOULnkva
MD5:	4CB35BD5D5E213EF8B83E4898F084842
SHA1:	28A8478ADCA9266D3CA8A645ABE2BE6B5EB42D1E
SHA-256:	00010DAB6ADB2C253218423689A48CCFC16B77C19737B0BA5209FD87E029A303
SHA-512:	3EEB57E701B193CD6DA5883D9359F03A5C0C77D48111771017521D67091137EAFB3ECEF209EC1EC9E1B4A9D4F415A32929D0BE441318B644BB185AB7BC497683
Malicious:	false
Preview:	... ...%.C,.}eo.!gy,j{Q=:...J.X....h.[B-.X....d..(&+v=.M...q..hQ..:v.~..F....C....mWw...<k.v..z.\|;.8.Av.......U.h-Qv.Z..........c.EI..`.28..-.....E...1mp...S..HV...{...k6i.......Ed.D:1u....C..s.sQy...I...!C.<...p...n.A..8.j....9....v.(....^J{.;.b.a.7.......PB..p......L..5..e.y3..;B..\|[..2M.H...C.....Ty..$....@..&.....6.{n.B..F...."...L...^......!.......r.)Z.....N...R..5E..+N....x..VgJ...K..}d.@..^..3..$....N....,..t.f.m.aw..?~.G.7H.)<o.....Z[a..e..v....+,.o7...i.......m.D.c.O)Q...q~.V...w...,.?IG.Y.ec.4.D...9Bq'...N...8...,f...,s......{.1z....z9..jl.I..(:... .pL..<..h.dJ...1..@..F..>.~jJ.. C..ux..W....z.D..g....N.$......HI.n....be......>..x..z.[!6.....i?..Nd...........4............~...<...>&...:...,[,_.pW6$.F..`@q...(._.$$^+.V.......G.. ~.......UC...z.g4~..V.d....I...Iq_..w..\....y.......,.,..G.E.<H\D.0\|.@aE..G.h.B.....y_...[...w..?.M......,...C<.y....^....6. .q..7..O.r>..aQ9.."....}....u-.v....g~..t.~.....6......D...{

C:\Users\user\Desktop\NIKHQAIQAU\BPMLNOBVSB.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.861226053683968
Encrypted:	false
SSDEEP:	24:Y/BhZ+cPJsstyyWaKhz5ma0m2OeFXK1qy7tw9io+6Zi4LVqUbdKibEa:Y/ZDJs2yLhtm9AeUF7twOULnkva
MD5:	4CB35BD5D5E213EF8B83E4898F084842
SHA1:	28A8478ADCA9266D3CA8A645ABE2BE6B5EB42D1E
SHA-256:	00010DAB6ADB2C253218423689A48CCFC16B77C19737B0BA5209FD87E029A303
SHA-512:	3EEB57E701B193CD6DA5883D9359F03A5C0C77D48111771017521D67091137EAFB3ECEF209EC1EC9E1B4A9D4F415A32929D0BE441318B644BB185AB7BC497683
Malicious:	false
Preview:	... ...%.C,.}eo.!gy,j{Q=:...J.X....h.[B-.X....d..(&+v=.M...q..hQ..:v.~..F....C....mWw...<k.v..z.\|;.8.Av.......U.h-Qv.Z..........c.EI..`.28..-.....E...1mp...S..HV...{...k6i.......Ed.D:1u....C..s.sQy...I...!C.<...p...n.A..8.j....9....v.(....^J{.;.b.a.7.......PB..p......L..5..e.y3..;B..\|[..2M.H...C.....Ty..$....@..&.....6.{n.B..F...."...L...^......!.......r.)Z.....N...R..5E..+N....x..VgJ...K..}d.@..^..3..$....N....,..t.f.m.aw..?~.G.7H.)<o.....Z[a..e..v....+,.o7...i.......m.D.c.O)Q...q~.V...w...,.?IG.Y.ec.4.D...9Bq'...N...8...,f...,s......{.1z....z9..jl.I..(:... .pL..<..h.dJ...1..@..F..>.~jJ.. C..ux..W....z.D..g....N.$......HI.n....be......>..x..z.[!6.....i?..Nd...........4............~...<...>&...:...,[,_.pW6$.F..`@q...(._.$$^+.V.......G.. ~.......UC...z.g4~..V.d....I...Iq_..w..\....y.......,.,..G.E.<H\D.0\|.@aE..G.h.B.....y_...[...w..?.M......,...C<.y....^....6. .q..7..O.r>..aQ9.."....}....u-.v....g~..t.~.....6......D...{

C:\Users\user\Desktop\NIKHQAIQAU\CURQNKVOIX.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.881110084219826
Encrypted:	false
SSDEEP:	48:rO1QJtd1AKA7Pk3Un3jUj3G3Sdmg4vpsr08ZU:rO1AtTxAI3LGiLLe
MD5:	F47F57755403EEE9C09ECA8D59699696
SHA1:	665B39E74A6478124277C66E9B17514A4755C08C
SHA-256:	902257334E4048A912FC307783E339307253A3A3BDB19B60CE4F42C5D2E74DBC
SHA-512:	83D84250BFC1B4F40CDF1D4736624DFD231B71B0C5B350FA7C5A65D801BB223E6AE04F19CF43C5CF07904073340F364F8154549DFADEC138A460721EB005C497
Malicious:	false
Preview:	..#........Y....`z.\|e..W..=....1..jB6...)DS..N..MPjCVRY..!...H.....^..hme5...B......s.....TG..4...%....q...1C.s.0h....Y.V.mC.2.....VW...Y...-..6?$<".c..c.1.%.j.w.cmi...........!~...j..BH./....%"...e......:......v.xn....d..fS.....n..W\|...-..,..m........R.L.kj...Qc...h..z.z.!.......5t.... G....A...Cpf.....b..M.2l..d...6}......^..\|.....jz;)...8...l.-..2....t...W...U.-..L.}.H.v$J.Z...Bk)%*.S..{le.\|..zFh_....(nR...K.F......9..l..D.......c.I..)9..............!l...K.8>81...^.%_...=..T.l....i.)!Z.. s.i..H..{'u:.O..k.....]...8......&.;v...a.q......v{N ....=..&...R...$Kf.....P.....B...7..M.\..}>,C7^.@.....\.......c.3....^..."..z......P.......1!.Hkis.+vh.!.J#.t.."Dn.d]..y....5......,..oU">~..g..M...S...P...>.SZ.&6..Uc.r...H.....7.d..$.A.S....G.u#..J/J..5Wf.}..o...A..r......j..GM^Sv.....v-..'.8.ZI(;.f.x...8.......2'.3.....6...=.U.1.....I.....'.1^.o.Y.Xe.r......_`q;...^..x:...3_...P._..OT.k..nN.Q.............=..+. G..$Q.l.s..5)...o/..s.M..b..

C:\Users\user\Desktop\NIKHQAIQAU\CURQNKVOIX.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.881110084219826
Encrypted:	false
SSDEEP:	48:rO1QJtd1AKA7Pk3Un3jUj3G3Sdmg4vpsr08ZU:rO1AtTxAI3LGiLLe
MD5:	F47F57755403EEE9C09ECA8D59699696
SHA1:	665B39E74A6478124277C66E9B17514A4755C08C
SHA-256:	902257334E4048A912FC307783E339307253A3A3BDB19B60CE4F42C5D2E74DBC
SHA-512:	83D84250BFC1B4F40CDF1D4736624DFD231B71B0C5B350FA7C5A65D801BB223E6AE04F19CF43C5CF07904073340F364F8154549DFADEC138A460721EB005C497
Malicious:	false
Preview:	..#........Y....`z.\|e..W..=....1..jB6...)DS..N..MPjCVRY..!...H.....^..hme5...B......s.....TG..4...%....q...1C.s.0h....Y.V.mC.2.....VW...Y...-..6?$<".c..c.1.%.j.w.cmi...........!~...j..BH./....%"...e......:......v.xn....d..fS.....n..W\|...-..,..m........R.L.kj...Qc...h..z.z.!.......5t.... G....A...Cpf.....b..M.2l..d...6}......^..\|.....jz;)...8...l.-..2....t...W...U.-..L.}.H.v$J.Z...Bk)%*.S..{le.\|..zFh_....(nR...K.F......9..l..D.......c.I..)9..............!l...K.8>81...^.%_...=..T.l....i.)!Z.. s.i..H..{'u:.O..k.....]...8......&.;v...a.q......v{N ....=..&...R...$Kf.....P.....B...7..M.\..}>,C7^.@.....\.......c.3....^..."..z......P.......1!.Hkis.+vh.!.J#.t.."Dn.d]..y....5......,..oU">~..g..M...S...P...>.SZ.&6..Uc.r...H.....7.d..$.A.S....G.u#..J/J..5Wf.}..o...A..r......j..GM^Sv.....v-..'.8.ZI(;.f.x...8.......2'.3.....6...=.U.1.....I.....'.1^.o.Y.Xe.r......_`q;...^..x:...3_...P._..OT.k..nN.Q.............=..+. G..$Q.l.s..5)...o/..s.M..b..

C:\Users\user\Desktop\NIKHQAIQAU\FENIVHOIKN.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.853536695772488
Encrypted:	false
SSDEEP:	24:YJ4msn4ex5EbXHpNwwTbvp5iu2j/feygNaphTZ7sNROJNbl7TaEa7l:YjRTbriu2j/aUhKNYnh5a7l
MD5:	C7FFACB7980230E5009BBFD1395F327D
SHA1:	132B6DD548C8039913F710F3D43B141F8D46013A
SHA-256:	CF442B8C269CE895706C0C14BC72692B860BF04FA1ABB62F493FE73FDE0C2243
SHA-512:	AABCC14E69110F2EBBB2D34729344037193884FF35DC424592B417CB71AB5B22ECACF65C25B8FAFF561140B5D9F95B85CABDD0E565A2EC77D9845CDE08B86A29
Malicious:	false
Preview:	..<...L.gt.C...rk......ZOZ.J..M2..T.[..X.d....D.C.>[.&....=2....!NG`p.,.8....&[k1...L.....m..i..]Y......0&.......g..\|)...gpz.......+... .K..X.v...a.....) .".+l.3......)..-.....P...@(iT4.<.<.+.]K..w.-N.r..D..I.'..p^.2........n.c.g..[{#.7....pW....i...../u.B]....({e.....\....2..\...:.._B..bC..t.=.f\..4..........X.0E.....B........@.44FU.9n../`4.[......1...i....0.T...h..Tp...}..7.......;}.?...n.x:."..c..g7...@.v=`....?.].......;.I.z2.)a{fVA..Ry..0..z./D....%.7vY......E.E.%..s.<E.1zT\|....n.x...T.@u'r.p..j....k.0...u.o..A..B.[...%....:W...ju=Z.......@..GX....kQ._!2Ciz.?..n..>....R.af...<h..}..M.....D.u:.[......c9.R..\|.m..y.\|..v.<.q..=. ...P>sN......yoS..LH..N..D.$.O;~I+..St...A. S..G..{.?...5.Rr..IC.\.ay\|m.A#B4..K'.l./.....(.P}......3D=@.*.<M..F.+U.~.b.#S.....N!T........R...L...z..[..Y.M.n<..!...(........!t..>be84(..w}.y7..f..N.^o..K.>.@?^..:Q.C.4..k....r.. L..D..(..k..-']...V..0....4.LvZRe.L.$i4^..R.......<.OT.....hO~.......3.}d5-.u.V[.u.)

C:\Users\user\Desktop\NIKHQAIQAU\FENIVHOIKN.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.853536695772488
Encrypted:	false
SSDEEP:	24:YJ4msn4ex5EbXHpNwwTbvp5iu2j/feygNaphTZ7sNROJNbl7TaEa7l:YjRTbriu2j/aUhKNYnh5a7l
MD5:	C7FFACB7980230E5009BBFD1395F327D
SHA1:	132B6DD548C8039913F710F3D43B141F8D46013A
SHA-256:	CF442B8C269CE895706C0C14BC72692B860BF04FA1ABB62F493FE73FDE0C2243
SHA-512:	AABCC14E69110F2EBBB2D34729344037193884FF35DC424592B417CB71AB5B22ECACF65C25B8FAFF561140B5D9F95B85CABDD0E565A2EC77D9845CDE08B86A29
Malicious:	false
Preview:	..<...L.gt.C...rk......ZOZ.J..M2..T.[..X.d....D.C.>[.&....=2....!NG`p.,.8....&[k1...L.....m..i..]Y......0&.......g..\|)...gpz.......+... .K..X.v...a.....) .".+l.3......)..-.....P...@(iT4.<.<.+.]K..w.-N.r..D..I.'..p^.2........n.c.g..[{#.7....pW....i...../u.B]....({e.....\....2..\...:.._B..bC..t.=.f\..4..........X.0E.....B........@.44FU.9n../`4.[......1...i....0.T...h..Tp...}..7.......;}.?...n.x:."..c..g7...@.v=`....?.].......;.I.z2.)a{fVA..Ry..0..z./D....%.7vY......E.E.%..s.<E.1zT\|....n.x...T.@u'r.p..j....k.0...u.o..A..B.[...%....:W...ju=Z.......@..GX....kQ._!2Ciz.?..n..>....R.af...<h..}..M.....D.u:.[......c9.R..\|.m..y.\|..v.<.q..=. ...P>sN......yoS..LH..N..D.$.O;~I+..St...A. S..G..{.?...5.Rr..IC.\.ay\|m.A#B4..K'.l./.....(.P}......3D=@.*.<M..F.+U.~.b.#S.....N!T........R...L...z..[..Y.M.n<..!...(........!t..>be84(..w}.y7..f..N.^o..K.>.@?^..:Q.C.4..k....r.. L..D..(..k..-']...V..0....4.LvZRe.L.$i4^..R.......<.OT.....hO~.......3.}d5-.u.V[.u.)

C:\Users\user\Desktop\NIKHQAIQAU\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.853536805181066
Encrypted:	false
SSDEEP:	24:O7rCDcy7odCgKUMFLHzktH3sM3TQTTQJRYHNqIh8zn0RJdJwof1:YKECFnVI1v0T3xh8QRDJHN
MD5:	4412A323FBED0DE59F7532F5D8EC13D7
SHA1:	BD715C8BBF46908698D47343C29AA91C78588862
SHA-256:	9559A20FAF4EE5D403615E2EBCCBEAC543135B78BFA8011F75A9C80BD947FD41
SHA-512:	D31AF9235E5A21C3D366E57833AD401D593AEA6E97DA8BB8938C13EF0CA8632D63819AD7E0E8E5CF1E7BA529F662321C564558AD544231EAB4207DBA86D4201F
Malicious:	false
Preview:	....L...n~.;7....m...6..........t.2F...G...,...k..Cgo.ni..T.......PC...$A..\3....[a..^.;..!m_..im..m.o..`..g.)A.W..3W.Z...R...nm.#.j....S..hgi0...EC.#&.A.T..I.k.qx2.!...K~..V...vi.b...Y........G..>p...'.'x.,i...:...R.W...\#c.).h..M..'.c.....xk..i.=.......v.(..Q........Qvpj/..l....f.2.E&.#(S.#...U...r..\.\|.4.+.SX.E.bU...O.#.zG.J.3....^.]..A.\.G.I3.o.....t..M..%n(.]..C6..\_.U>6.{......y.X.^.S.M.6....X......P.W..&\|.....a.....NIJ\|.R...xi.z..-z..G>.{........y..Ie..;oUu...eD.......%.c.f...;/S'?5.I]7.n...VaR<G.d.O.\|tg\|......S!.1u.4r]?.f......L.&.C=@(..w.s.)...]....G.&..Lo.........u..!.).Y...bn.}.._}{T=.....a.2..[Dns.S .dg].J...a.A!a7..R..` ....L........ ........&...di..T.~b....<b.fn.[N..XGu..I!{1..Ex.<./..%q.E.......P.Bl.&.6.o+L;P..p.d....A._-.,.KY..P.<x.../t.D#cI.t.Uc'.H5.J.'.w...q..^..I..J9P.W../C..e?R.b1.....}...V..-..j...dR.$1'...(...\|.'U`6..\...'.....#l..<..jg.l'.{e.w/.L..]B8-..A..+.K..D`....$.....9.n.%.........../pd...L!.~...>.3XX*.&hz...oZ..

C:\Users\user\Desktop\NIKHQAIQAU\NIKHQAIQAU.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.853536805181066
Encrypted:	false
SSDEEP:	24:O7rCDcy7odCgKUMFLHzktH3sM3TQTTQJRYHNqIh8zn0RJdJwof1:YKECFnVI1v0T3xh8QRDJHN
MD5:	4412A323FBED0DE59F7532F5D8EC13D7
SHA1:	BD715C8BBF46908698D47343C29AA91C78588862
SHA-256:	9559A20FAF4EE5D403615E2EBCCBEAC543135B78BFA8011F75A9C80BD947FD41
SHA-512:	D31AF9235E5A21C3D366E57833AD401D593AEA6E97DA8BB8938C13EF0CA8632D63819AD7E0E8E5CF1E7BA529F662321C564558AD544231EAB4207DBA86D4201F
Malicious:	false
Preview:	....L...n~.;7....m...6..........t.2F...G...,...k..Cgo.ni..T.......PC...$A..\3....[a..^.;..!m_..im..m.o..`..g.)A.W..3W.Z...R...nm.#.j....S..hgi0...EC.#&.A.T..I.k.qx2.!...K~..V...vi.b...Y........G..>p...'.'x.,i...:...R.W...\#c.).h..M..'.c.....xk..i.=.......v.(..Q........Qvpj/..l....f.2.E&.#(S.#...U...r..\.\|.4.+.SX.E.bU...O.#.zG.J.3....^.]..A.\.G.I3.o.....t..M..%n(.]..C6..\_.U>6.{......y.X.^.S.M.6....X......P.W..&\|.....a.....NIJ\|.R...xi.z..-z..G>.{........y..Ie..;oUu...eD.......%.c.f...;/S'?5.I]7.n...VaR<G.d.O.\|tg\|......S!.1u.4r]?.f......L.&.C=@(..w.s.)...]....G.&..Lo.........u..!.).Y...bn.}.._}{T=.....a.2..[Dns.S .dg].J...a.A!a7..R..` ....L........ ........&...di..T.~b....<b.fn.[N..XGu..I!{1..Ex.<./..%q.E.......P.Bl.&.6.o+L;P..p.d....A._-.,.KY..P.<x.../t.D#cI.t.Uc'.H5.J.'.w...q..^..I..J9P.W../C..e?R.b1.....}...V..-..j...dR.$1'...(...\|.'U`6..\...'.....#l..<..jg.l'.{e.w/.L..]B8-..A..+.K..D`....$.....9.n.%.........../pd...L!.~...>.3XX*.&hz...oZ..

C:\Users\user\Desktop\NIKHQAIQAU\RAYHIWGKDI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8554377773538056
Encrypted:	false
SSDEEP:	24:JxXHZBXm5SQUdVuwBCeu1uFKWt/QO4EFViHpyQFru1Sqh5ZLkVo+Tpf7/QO2N5qA:fy5udEyhuwKo4EFE8QFG9oVo4XMcM
MD5:	5417F00F3D134A60F4E089607AF871B8
SHA1:	93A12CCBE62923D17829495A3E687EECAF781D34
SHA-256:	F4D229C8925CC0BF8FDEDADEC2CAEA0EE77D9C7147BB57F8986F88E01750D34E
SHA-512:	029586E5F7BCFADA7E2CEF26A75CDB16D58CECA41C949D1322A999BD13C94491D4ADB413D87A682CF6615FFA2D2686331BE5083C2F1015DC22B3F9DB4F4A33EC
Malicious:	false
Preview:	....^....9....>2.R\.Mh`...a.dg.zK-.p.x,Ae......J.-.5.q....".6..)A..c..<\y...W..{.<$.`...vq..g.D....j..D,.BS........2.#.....d.t.r\...a.t._.kQ^...$.Q.$}.c.^`...\|y..3..B....z~.........6<.ZD.......rg.m....$I.......O......." L..F1..9.Qa....2.o.G#....J.4q@e.C..G..c..cv'.5.. ..........A.q..8.!.rgW].N.^"i.......)c...FMz... .... .A.V;......P....p..9.<w,.\.i...a).....wZK.?a...a.NF_...Bd.b....w...ZN..>..%.i.. 1$f..k.....Y.~b.g.]@.W7/.:.W..1;..lL0'T].............!o..2J.(^....`g.(.{X8....."i.....BY.a..lC...I,Y..v....n..z...t.u8U.\....#..i.p.w..1z.X>......1.....Yn...L..?.2).{.Y:..56..........u.t].t.1N....V.nk...X.GPjHs.U..<....X...kL.y.<'..j.3,2WZE.W..rXZ4.R...GrU...j2...i....P1m.]X.x..8.N....N..?\.dF..p.......H.".....+p.h.......yC)XZ.nh......y.W..!P....I..E5s+R..&uB..P.L'.vHz....%.xLx.ar5....;...\|.1..7..+..g..q.....aFL....D...9..O1......p.b..#....`7.....]N.w,;.-.,8Ko....*.<..9..l............j....'v&..s.......... ..w...BS@.4.y..c..e.P..0g.\.....V\&.n...).

C:\Users\user\Desktop\NIKHQAIQAU\RAYHIWGKDI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8554377773538056
Encrypted:	false
SSDEEP:	24:JxXHZBXm5SQUdVuwBCeu1uFKWt/QO4EFViHpyQFru1Sqh5ZLkVo+Tpf7/QO2N5qA:fy5udEyhuwKo4EFE8QFG9oVo4XMcM
MD5:	5417F00F3D134A60F4E089607AF871B8
SHA1:	93A12CCBE62923D17829495A3E687EECAF781D34
SHA-256:	F4D229C8925CC0BF8FDEDADEC2CAEA0EE77D9C7147BB57F8986F88E01750D34E
SHA-512:	029586E5F7BCFADA7E2CEF26A75CDB16D58CECA41C949D1322A999BD13C94491D4ADB413D87A682CF6615FFA2D2686331BE5083C2F1015DC22B3F9DB4F4A33EC
Malicious:	false
Preview:	....^....9....>2.R\.Mh`...a.dg.zK-.p.x,Ae......J.-.5.q....".6..)A..c..<\y...W..{.<$.`...vq..g.D....j..D,.BS........2.#.....d.t.r\...a.t._.kQ^...$.Q.$}.c.^`...\|y..3..B....z~.........6<.ZD.......rg.m....$I.......O......." L..F1..9.Qa....2.o.G#....J.4q@e.C..G..c..cv'.5.. ..........A.q..8.!.rgW].N.^"i.......)c...FMz... .... .A.V;......P....p..9.<w,.\.i...a).....wZK.?a...a.NF_...Bd.b....w...ZN..>..%.i.. 1$f..k.....Y.~b.g.]@.W7/.:.W..1;..lL0'T].............!o..2J.(^....`g.(.{X8....."i.....BY.a..lC...I,Y..v....n..z...t.u8U.\....#..i.p.w..1z.X>......1.....Yn...L..?.2).{.Y:..56..........u.t].t.1N....V.nk...X.GPjHs.U..<....X...kL.y.<'..j.3,2WZE.W..rXZ4.R...GrU...j2...i....P1m.]X.x..8.N....N..?\.dF..p.......H.".....+p.h.......yC)XZ.nh......y.W..!P....I..E5s+R..&uB..P.L'.vHz....%.xLx.ar5....;...\|.1..7..+..g..q.....aFL....D...9..O1......p.b..#....`7.....]N.w,;.-.,8Ko....*.<..9..l............j....'v&..s.......... ..w...BS@.4.y..c..e.P..0g.\.....V\&.n...).

C:\Users\user\Desktop\NIKHQAIQAU\WKXEWIOTXI.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.884583435770101
Encrypted:	false
SSDEEP:	48:2lHjGSRDAl7rubBigANqXEPW++K1PVkDxaV3BaixR:GDvKl7abBBAQXEPWfK1GDxLe
MD5:	3FF20F124BB7ADC53C7C1B46626424B6
SHA1:	B165A4240D39DBBACDC7091847DCB9A08DFECCD2
SHA-256:	26B6FE09A1C52448CF3AF61106C50237161E0FD70FE2362AE7D7CA9EB9520324
SHA-512:	29C9734DAA1CD9AD70FC7D2B5245649DFF8E3E729344E3F891315A602982CB90467E65018F882D3DF20D3D9155981DAD2A243D9033917091A77017900598B872
Malicious:	false
Preview:	0U.O....s.ia\.,...~,@.1t.Fx.4..c..n2.Sh?.u%.iz`t..y..wV}..D...^.}.8...!.A.s.....R=...b..3..W.KE..u.3.....y.%...[#tvQ...R.4.^$qCW.....R..}..SG.......;.pY.T.Iy.c......?..2.....Q.n.".....&e.....l.^r.R.s........(../@hm....Q m ..DV.K.`..i.1...f.D.W.un.-.?...4.......+.Y.z4...q......Qn.Z.@._..r9'G0/XB2G.. .R.....a.D...$<.+..3..Z_...H...@b..+...P......I....].....q...~.9)...B...uf.9l...~..m.1.....P.q.E..9......wjF....!...tfg..L..U.N.C....gR...<.0`..m{9.Bp........H...q.,.....dP.....~.D.-..\.K...W.x....q..^($.v+mJ.@..s..9..+[..ub..u.,..G.p.k.L...8L.g...c... .nrY.+...x.....9.L..I...%..J...z..l2A...Q$.^.......V..`.v..D....KuZ..).0..(q7(..j.7.]...... ..>./Oo8..e..6.X`Z.....8Yy.....#,;.:7...5....G\|..vU..(.f.;g.....,.....).i...A.g.O..N..,..7...f..+........j.>.8H.....6.......F.G....<.......H(c 1=.....v...$....2O.........O4.<.I.mi[......6......c.me.h.K.....a...]c.."z.u.!.6.eu.s[P.\..m....s.n.9..].Y...."nmXy....c#U.A.\9....E.....Z`.+jk..P\.$d

C:\Users\user\Desktop\NIKHQAIQAU\WKXEWIOTXI.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.884583435770101
Encrypted:	false
SSDEEP:	48:2lHjGSRDAl7rubBigANqXEPW++K1PVkDxaV3BaixR:GDvKl7abBBAQXEPWfK1GDxLe
MD5:	3FF20F124BB7ADC53C7C1B46626424B6
SHA1:	B165A4240D39DBBACDC7091847DCB9A08DFECCD2
SHA-256:	26B6FE09A1C52448CF3AF61106C50237161E0FD70FE2362AE7D7CA9EB9520324
SHA-512:	29C9734DAA1CD9AD70FC7D2B5245649DFF8E3E729344E3F891315A602982CB90467E65018F882D3DF20D3D9155981DAD2A243D9033917091A77017900598B872
Malicious:	false
Preview:	0U.O....s.ia\.,...~,@.1t.Fx.4..c..n2.Sh?.u%.iz`t..y..wV}..D...^.}.8...!.A.s.....R=...b..3..W.KE..u.3.....y.%...[#tvQ...R.4.^$qCW.....R..}..SG.......;.pY.T.Iy.c......?..2.....Q.n.".....&e.....l.^r.R.s........(../@hm....Q m ..DV.K.`..i.1...f.D.W.un.-.?...4.......+.Y.z4...q......Qn.Z.@._..r9'G0/XB2G.. .R.....a.D...$<.+..3..Z_...H...@b..+...P......I....].....q...~.9)...B...uf.9l...~..m.1.....P.q.E..9......wjF....!...tfg..L..U.N.C....gR...<.0`..m{9.Bp........H...q.,.....dP.....~.D.-..\.K...W.x....q..^($.v+mJ.@..s..9..+[..ub..u.,..G.p.k.L...8L.g...c... .nrY.+...x.....9.L..I...%..J...z..l2A...Q$.^.......V..`.v..D....KuZ..).0..(q7(..j.7.]...... ..>./Oo8..e..6.X`Z.....8Yy.....#,;.:7...5....G\|..vU..(.f.;g.....,.....).i...A.g.O..N..,..7...f..+........j.>.8H.....6.......F.G....<.......H(c 1=.....v...$....2O.........O4.<.I.mi[......6......c.me.h.K.....a...]c.."z.u.!.6.eu.s[P.\..m....s.n.9..].Y...."nmXy....c#U.A.\9....E.....Z`.+jk..P\.$d

C:\Users\user\Desktop\NIKHQAIQAU\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Desktop\PowerPoint.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2986
Entropy (8bit):	7.927408798004687
Encrypted:	false
SSDEEP:	48:zvq1+B8m84EWCmV0GZVwMZVPE+sCbsxaSmOXg9+LTKBqaF5DVm9hm9iafwLmn:bq1+B58bMiGZVBZ9E+sCUaFG2qMDVm9s
MD5:	E6AA190FE06AB69F7200E376BA662354
SHA1:	1DEB3F8432D5E3B32ED887A381964B1A46EDE56F
SHA-256:	810A020EF6D05E41E3625BFDA2C4FF15405FDA7CD907F56D6CA64C40C64BEE27
SHA-512:	6F3C5DE7C65085FB393EF44DC43A23D18C0935DB74348F33D354BA0B9106248C35DB5E36AD09B44BC2CC905D4709F6836F30831B87D8CDBA2894125BB6CD04BC
Malicious:	false
Preview:	:. xhB!.N.6uO...Z.r$.C..xA.....&.".f....D......G..M..,..j..Di-e%......0..)ur..o.9.M..!.....).Y.rY\-.X.[.E.d...x........H..;.%..O.%....u...D..N(V...6...-..Xsd..^...........m.L\ht)...H{........k....K.]/.+.........u.T;........o..Y...b....y....[...z....s.m@..}...fq.:...6C.WzF,6.j..T.b.9.@.h.}..p^.aO..O.5z.O...C.x.....-.R..+....h...x.6.&..x.^h...k.$...!.w..../.......B{J..nJo.H..N.6..%Y=.8V.[;.o4{........{..T5.R... .{l[........Z.?.......O.5~.Z.m1.^'......ll.6P..Z.$l.1.2.W.#...Qv...D]...Q!i@...a..t.Sc^.@..&<.....\|\|R.x..wW.......$...l..s........t..a.)/...t...l+/['.Z=s..R.y...{....z0.H...An.....V.KJS..V..x..F..7...7...tkt.V...d....Vf.r[.x......E.......Y....w...q.K.'.^.*Z8%#.e.1.q.j.Hb.S..Nw<H...L.Q.f.'.b..jx~..@..f.N..8..F....M..;....j....6.[,.Y^}Y..m.V.!.r$.;..S.hO..u.8........U.tmA....# >.@...:5...Z.....o..K..ps.7.\3...G1%.r...8.m..W .v.m..[.....LP~.......W^by.v.3\8XX..+"c:...8..EyS.3...."..#e76.q.G..k..{.1?.....9q..c.........w9.........y&.3..

C:\Users\user\Desktop\PowerPoint.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2986
Entropy (8bit):	7.927408798004687
Encrypted:	false
SSDEEP:	48:zvq1+B8m84EWCmV0GZVwMZVPE+sCbsxaSmOXg9+LTKBqaF5DVm9hm9iafwLmn:bq1+B58bMiGZVBZ9E+sCUaFG2qMDVm9s
MD5:	E6AA190FE06AB69F7200E376BA662354
SHA1:	1DEB3F8432D5E3B32ED887A381964B1A46EDE56F
SHA-256:	810A020EF6D05E41E3625BFDA2C4FF15405FDA7CD907F56D6CA64C40C64BEE27
SHA-512:	6F3C5DE7C65085FB393EF44DC43A23D18C0935DB74348F33D354BA0B9106248C35DB5E36AD09B44BC2CC905D4709F6836F30831B87D8CDBA2894125BB6CD04BC
Malicious:	false
Preview:	:. xhB!.N.6uO...Z.r$.C..xA.....&.".f....D......G..M..,..j..Di-e%......0..)ur..o.9.M..!.....).Y.rY\-.X.[.E.d...x........H..;.%..O.%....u...D..N(V...6...-..Xsd..^...........m.L\ht)...H{........k....K.]/.+.........u.T;........o..Y...b....y....[...z....s.m@..}...fq.:...6C.WzF,6.j..T.b.9.@.h.}..p^.aO..O.5z.O...C.x.....-.R..+....h...x.6.&..x.^h...k.$...!.w..../.......B{J..nJo.H..N.6..%Y=.8V.[;.o4{........{..T5.R... .{l[........Z.?.......O.5~.Z.m1.^'......ll.6P..Z.$l.1.2.W.#...Qv...D]...Q!i@...a..t.Sc^.@..&<.....\|\|R.x..wW.......$...l..s........t..a.)/...t...l+/['.Z=s..R.y...{....z0.H...An.....V.KJS..V..x..F..7...7...tkt.V...d....Vf.r[.x......E.......Y....w...q.K.'.^.*Z8%#.e.1.q.j.Hb.S..Nw<H...L.Q.f.'.b..jx~..@..f.N..8..F....M..;....j....6.[,.Y^}Y..m.V.!.r$.;..S.hO..u.8........U.tmA....# >.@...:5...Z.....o..K..ps.7.\3...G1%.r...8.m..W .v.m..[.....LP~.......W^by.v.3\8XX..+"c:...8..EyS.3...."..#e76.q.G..k..{.1?.....9q..c.........w9.........y&.3..

C:\Users\user\Desktop\QNCYCDFIJJ.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863835911927528
Encrypted:	false
SSDEEP:	24:rb73l3OubPa9KReLPkaSgCRYJYGMJIDEbcSpaWrj4DeDPf7s/Z:dOura9K1aSgCRYeGIIIre4O
MD5:	93B2ED761443F181407007EF6C63196B
SHA1:	BAF8D7191F3400F23D4DC88A7A462CDFCB9B38E5
SHA-256:	EC3D64DB8D696B86BFA19B184C478B7258B6BFD6CEEC97E8E6552769D10F477D
SHA-512:	736FDA810179093A5FAC643C9719A5FB6047668DDB8CD883D4569669FCA8028E028890ED3C7DF56D924E0ADD3E74BEE9F99DDAB9DF483BE4754CE01D71BA5BF3
Malicious:	true
Preview:	.y....?l.8.=?.+...E.a..?.I......}...Z..0...P.L..q....).6..sz...R....du.(j.WO3op.}.>...n.jo.c..YT...o..!.@Z4,...YK...Q.X%..,.....[I......r.Cw.f....\|..>..@ A....]..=........o_...:'z.I..W.?...(+....c[..h.f."....\|.\|..s>...F.J.....l.3...vL........y.<...eZP....X...V...x.[b.t.L.............)...j..z....r...K.../......Q3#t...&.mM.c....0..ne...7:/.\|.e.t.....d..i.kn..d....\|K`....0.`....`.S...\|........TQ$dW.S.].-(."..;....F.Z.I.1[G.W.....2.....f.k.Q...M`.n>.d07..~9.. ......m\$@.W.V..9..U.d...K^...V..``.d........40M$......t.9..Y...qF},.+..B.c$...#...r...u.e.O..iD..y.d..HGs..]..g...uC..S..\|F.Gr@...8.z`\|.#...JVr.C.h.....%.AH..^....F..aE...A.s...i._E........7...l`....e.....C.P.]'8......?U.>1..)U..\|V....L)OK..J..Z..[.Z......V.._.)E..1.S..0".._k.......O]...QE.\..?'..B.B...Bp/.8d.....l......#..$j0.g....].......N...0...GL...L.n.is.~n....K/Z...r.h._..G.\..........;..gC!.P]....8Y...**.2OmvT.....W.S.}.v%.;..D....+....JZ...}......c.V......i1

C:\Users\user\Desktop\QNCYCDFIJJ.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863835911927528
Encrypted:	false
SSDEEP:	24:rb73l3OubPa9KReLPkaSgCRYJYGMJIDEbcSpaWrj4DeDPf7s/Z:dOura9K1aSgCRYeGIIIre4O
MD5:	93B2ED761443F181407007EF6C63196B
SHA1:	BAF8D7191F3400F23D4DC88A7A462CDFCB9B38E5
SHA-256:	EC3D64DB8D696B86BFA19B184C478B7258B6BFD6CEEC97E8E6552769D10F477D
SHA-512:	736FDA810179093A5FAC643C9719A5FB6047668DDB8CD883D4569669FCA8028E028890ED3C7DF56D924E0ADD3E74BEE9F99DDAB9DF483BE4754CE01D71BA5BF3
Malicious:	false
Preview:	.y....?l.8.=?.+...E.a..?.I......}...Z..0...P.L..q....).6..sz...R....du.(j.WO3op.}.>...n.jo.c..YT...o..!.@Z4,...YK...Q.X%..,.....[I......r.Cw.f....\|..>..@ A....]..=........o_...:'z.I..W.?...(+....c[..h.f."....\|.\|..s>...F.J.....l.3...vL........y.<...eZP....X...V...x.[b.t.L.............)...j..z....r...K.../......Q3#t...&.mM.c....0..ne...7:/.\|.e.t.....d..i.kn..d....\|K`....0.`....`.S...\|........TQ$dW.S.].-(."..;....F.Z.I.1[G.W.....2.....f.k.Q...M`.n>.d07..~9.. ......m\$@.W.V..9..U.d...K^...V..``.d........40M$......t.9..Y...qF},.+..B.c$...#...r...u.e.O..iD..y.d..HGs..]..g...uC..S..\|F.Gr@...8.z`\|.#...JVr.C.h.....%.AH..^....F..aE...A.s...i._E........7...l`....e.....C.P.]'8......?U.>1..)U..\|V....L)OK..J..Z..[.Z......V.._.)E..1.S..0".._k.......O]...QE.\..?'..B.B...Bp/.8d.....l......#..$j0.g....].......N...0...GL...L.n.is.~n....K/Z...r.h._..G.\..........;..gC!.P]....8Y...**.2OmvT.....W.S.}.v%.;..D....+....JZ...}......c.V......i1

C:\Users\user\Desktop\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8756462228239785
Encrypted:	false
SSDEEP:	24:GpUd3+p/Q90ylVV0BV4n23f+5h4tS4t1tbHRFfLXkFN/6XLauveqycXCJuClo4wG:g3NkVAPQGS+1Xxro/+LGNMU1tjife
MD5:	8664DAAF5FDD18706881D6806297648C
SHA1:	7904AC18880F98110EC8A7AF3DBBD1FF32F25E49
SHA-256:	FD634E287B76CB49B2E47872A680B7DC68BF79E21C7B60D27F0B36338A9A4772
SHA-512:	B6E6947BBFAFAA9B0927C0538897A1677A252ED6AFFA8C361AAAFCA809970A2211E05B033CB203EB8D9605C315FD05AC3959B4D9FA256F23FCA9ADEEB9ED75DA
Malicious:	false
Preview:	..._..\.}.U.S`....j.bo..1].D......?..=%..m@.l.x.^..D_...[......VXW.C.i..8.,.....p....g.Y.'Q3.Hk..bZ.x.a..kCw.O.......2B.A.X_.<.....}.cRI......Oy7...v...T.t...Q..............\|..I....9....0rw......n.......7.......V3...2q.g..j.w.lA..@....9.1.G8.{x..uC%T....NBN..<..>/.hj......TP..-OZ...E..!O..)/.rk.yD5.1.W4$.....MJM.....k..Z..l/.Y\...~..p.-...~......A1p.........&?.E..C...... .=1........1....Cb.K..O...."D.......6..^.>.q.....@.....v...;.....\|V...H.N.D...>..MhOx.}.6.y....sY&.........../i8:...DOiY.I....YZK.%%...t....!.y.h.SNQ...v$.....x...CV.G..m.....^.V...,...b&....O0..2............z..O.1..-H'P.^V`..=.-..t......\|.sM.... ..N.&f.m[.;..Y7......R..&n.3m$.i..s.d..r.v.....,...~.7y.u!.{a.mv.[...O..%.].?.:2.....!.Wll..#..W.H=.rX.....k.dF.....\|.MV4V>e...k`......6%..c..G.,RL..T.7..-(..M..$.J.RuB..*:....;..NV.tvj;K.a<.G..F....f...md.H.`.a...DB.p\..p...5..M..Z.P...........m..fl..I\.DAH.x.+.:ta...W.4^T....`.]7xT.....L.......bW...........`..HpG...m...y

C:\Users\user\Desktop\RAYHIWGKDI.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8756462228239785
Encrypted:	false
SSDEEP:	24:GpUd3+p/Q90ylVV0BV4n23f+5h4tS4t1tbHRFfLXkFN/6XLauveqycXCJuClo4wG:g3NkVAPQGS+1Xxro/+LGNMU1tjife
MD5:	8664DAAF5FDD18706881D6806297648C
SHA1:	7904AC18880F98110EC8A7AF3DBBD1FF32F25E49
SHA-256:	FD634E287B76CB49B2E47872A680B7DC68BF79E21C7B60D27F0B36338A9A4772
SHA-512:	B6E6947BBFAFAA9B0927C0538897A1677A252ED6AFFA8C361AAAFCA809970A2211E05B033CB203EB8D9605C315FD05AC3959B4D9FA256F23FCA9ADEEB9ED75DA
Malicious:	false
Preview:	..._..\.}.U.S`....j.bo..1].D......?..=%..m@.l.x.^..D_...[......VXW.C.i..8.,.....p....g.Y.'Q3.Hk..bZ.x.a..kCw.O.......2B.A.X_.<.....}.cRI......Oy7...v...T.t...Q..............\|..I....9....0rw......n.......7.......V3...2q.g..j.w.lA..@....9.1.G8.{x..uC%T....NBN..<..>/.hj......TP..-OZ...E..!O..)/.rk.yD5.1.W4$.....MJM.....k..Z..l/.Y\...~..p.-...~......A1p.........&?.E..C...... .=1........1....Cb.K..O...."D.......6..^.>.q.....@.....v...;.....\|V...H.N.D...>..MhOx.}.6.y....sY&.........../i8:...DOiY.I....YZK.%%...t....!.y.h.SNQ...v$.....x...CV.G..m.....^.V...,...b&....O0..2............z..O.1..-H'P.^V`..=.-..t......\|.sM.... ..N.&f.m[.;..Y7......R..&n.3m$.i..s.d..r.v.....,...~.7y.u!.{a.mv.[...O..%.].?.:2.....!.Wll..#..W.H=.rX.....k.dF.....\|.MV4V>e...k`......6%..c..G.,RL..T.7..-(..M..$.J.RuB..*:....;..NV.tvj;K.a<.G..F....f...md.H.`.a...DB.p\..p...5..M..Z.P...........m..fl..I\.DAH.x.+.:ta...W.4^T....`.]7xT.....L.......bW...........`..HpG...m...y

C:\Users\user\Desktop\RAYHIWGKDI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.849159826896502
Encrypted:	false
SSDEEP:	24:cYlw0PUDVWaT4ERH0u085j1EfvoiAHNgkmkOr/beRB+StNGETw+wy7KKHBE728x:LJP2WD5yEfvoiAtWrCVnWNmWHx
MD5:	3A819BFC331DC492EB8F560DF240E7A1
SHA1:	E484DA19031C64A195E9E5F7479920FAE20CCF70
SHA-256:	F014337D6A9AC46C61F5B5C52B2856B84EC43FDB94459797629AE814B52EC70B
SHA-512:	1D68DA2B87095CF84F5792ACF884502634805010E5C980CBA9BD216017DD765029A2D3D034F2AE4E1A01C07DCB474F376D78C12471DEA5496760D3FFEBFC4683
Malicious:	false
Preview:	....08=Av.y..v.d..q!....>...=.8...O..."^...J./.[..z6...5.Z1b{....d..(...M...E..'3.r..}.8..w...C.82b.`..r...t.H...t.....mh.i....>,r.k.,...q..?n".zW.._...'?....G..;.W~7..$.c.....P.s.<...,...W.::Hj....%9/..0`.p....8J...(../@.5.7{..t.M.X.X1.d(;.......L.C....;........;.@.^.@.8Pf.P.p...iq..#.3..F.....7.....2........ENQ.k.T.Z.e.'d.;......i...!.wC....=l...........2.C.Zh....WX..N0jM.az.i.1.^..:.H..q.$."=.J.m.M....=..X...'O.M.}9rJ=..O...n.=J.3.L.E..;..._D.+.i.2.......t.R./N..u4o...w...v..t....$....V.y..n...D.'.X....ws.9....5.e.e.o..<x....vq.j..t......>.'.<U.)%....~.JB.sXoq=...<\.%n\(H$Cj.X../.l[..i.H....}q\......!(.4..or.nC...L....g...^.....m.x.W.."(.,1..*.....y..&..hQ.@....u}.{i"_-.t.I.......15..I.R.f;...t5.".r....k.A)U.~..0n?.....,.....IW...:. ..p..S?=..U...N.3.).Q..K....m.i.D..K.........D..U..8...5...Z...).&{u..b..r>...!.(.....SP..C.8.\..nHF.O=.....%Y....6i..^".......E..u.._E.?.3;.s.K.....\| wIX..&...o..;I+5C.n.F...........W.....+`.B#.w.e.bvE2...0

C:\Users\user\Desktop\RAYHIWGKDI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.849159826896502
Encrypted:	false
SSDEEP:	24:cYlw0PUDVWaT4ERH0u085j1EfvoiAHNgkmkOr/beRB+StNGETw+wy7KKHBE728x:LJP2WD5yEfvoiAtWrCVnWNmWHx
MD5:	3A819BFC331DC492EB8F560DF240E7A1
SHA1:	E484DA19031C64A195E9E5F7479920FAE20CCF70
SHA-256:	F014337D6A9AC46C61F5B5C52B2856B84EC43FDB94459797629AE814B52EC70B
SHA-512:	1D68DA2B87095CF84F5792ACF884502634805010E5C980CBA9BD216017DD765029A2D3D034F2AE4E1A01C07DCB474F376D78C12471DEA5496760D3FFEBFC4683
Malicious:	false
Preview:	....08=Av.y..v.d..q!....>...=.8...O..."^...J./.[..z6...5.Z1b{....d..(...M...E..'3.r..}.8..w...C.82b.`..r...t.H...t.....mh.i....>,r.k.,...q..?n".zW.._...'?....G..;.W~7..$.c.....P.s.<...,...W.::Hj....%9/..0`.p....8J...(../@.5.7{..t.M.X.X1.d(;.......L.C....;........;.@.^.@.8Pf.P.p...iq..#.3..F.....7.....2........ENQ.k.T.Z.e.'d.;......i...!.wC....=l...........2.C.Zh....WX..N0jM.az.i.1.^..:.H..q.$."=.J.m.M....=..X...'O.M.}9rJ=..O...n.=J.3.L.E..;..._D.+.i.2.......t.R./N..u4o...w...v..t....$....V.y..n...D.'.X....ws.9....5.e.e.o..<x....vq.j..t......>.'.<U.)%....~.JB.sXoq=...<\.%n\(H$Cj.X../.l[..i.H....}q\......!(.4..or.nC...L....g...^.....m.x.W.."(.,1..*.....y..&..hQ.@....u}.{i"_-.t.I.......15..I.R.f;...t5.".r....k.A)U.~..0n?.....,.....IW...:. ..p..S?=..U...N.3.).Q..K....m.i.D..K.........D..U..8...5...Z...).&{u..b..r>...!.(.....SP..C.8.\..nHF.O=.....%Y....6i..^".......E..u.._E.?.3;.s.K.....\| wIX..&...o..;I+5C.n.F...........W.....+`.B#.w.e.bvE2...0

C:\Users\user\Desktop\RAYHIWGKDI\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.87635489933499
Encrypted:	false
SSDEEP:	48:SYXpRNQF0+YIQIUyVUucYAMwXSWbgfaejBAZwDJno:H5aZTCuUuzA5gpbq
MD5:	FE25D2022C3C2EA10FA1B8DB61F227F4
SHA1:	C5E5DDCFAC89C249250FC174B819C06C5BF1D766
SHA-256:	CEBD6020A90A082584CA42A23D6642A776452D2548B087089B288BECA63F90C4
SHA-512:	8B23FF44E199E480F69D79B5C2B3ADDAD28DB7FCDC7BD7F00540F6A783D127E4825AAFBFBA5F335B77B727A5BBF8C5B51851FD65239FF104D8976E0E055D27A5
Malicious:	false
Preview:	.l..6.../...6SKk_...._H...9.o.D..TR;5...>..l...t>......k.....h.o..uG.P..@..i.@.L.Zd.z/..8{.!.a..j.~oJ<.....$...^...]y.B..`..o..h.N.....x.5....^.=..n0.>...f%.p..R.O...H.f.O.h#..Q:.dsuQ?....(j.axT."H=.. s..)k....V\|.io..1.Ia.$.^.J..&.C.mIWj,c.U..A..r..#..$.............J...!..G...J..k3E.9....768RW.w.Y^3XQ0..S.V..f.7[.%.I{.;.&..W...d...u.fRa..N....$!.)o....o..hWTf..n...D......&..,.~..\..GA.7]8....5....=\|.Q....M..V....a.X.j..<......A..............=4Yyf.W.1a....9Pn.f.......^..gk....^!....#.-.A.<a.hs..q..C.OA$h...F...r..Sh......t..."..f.7L./..s>.eE..t#".t.....0!.-{...F...DT...@l......@.U@...E.O.1N.j.X..cq...)......KN../NKf.x...]u.........xKW5-......E.Z.N....O.e..b].?.....4.......4...u.9......3..........\|.%.aM.....0..^..x.[..j.u1=.]...)^..;..0<l.S...P..?...!.\=...........O}+>9..y..U...17w(U.....@6...+QMO.,....:.....k]T..v..i.N.\.%..jpx[..S.A.._.J.Z...1s.'n..1......%.0.lo!..;.x...?.e..LcM.g....}.......J..=`..7...bK.A...F..8.V...F.D.2....y

C:\Users\user\Desktop\RAYHIWGKDI\LSBIHQFDVT.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.87635489933499
Encrypted:	false
SSDEEP:	48:SYXpRNQF0+YIQIUyVUucYAMwXSWbgfaejBAZwDJno:H5aZTCuUuzA5gpbq
MD5:	FE25D2022C3C2EA10FA1B8DB61F227F4
SHA1:	C5E5DDCFAC89C249250FC174B819C06C5BF1D766
SHA-256:	CEBD6020A90A082584CA42A23D6642A776452D2548B087089B288BECA63F90C4
SHA-512:	8B23FF44E199E480F69D79B5C2B3ADDAD28DB7FCDC7BD7F00540F6A783D127E4825AAFBFBA5F335B77B727A5BBF8C5B51851FD65239FF104D8976E0E055D27A5
Malicious:	false
Preview:	.l..6.../...6SKk_...._H...9.o.D..TR;5...>..l...t>......k.....h.o..uG.P..@..i.@.L.Zd.z/..8{.!.a..j.~oJ<.....$...^...]y.B..`..o..h.N.....x.5....^.=..n0.>...f%.p..R.O...H.f.O.h#..Q:.dsuQ?....(j.axT."H=.. s..)k....V\|.io..1.Ia.$.^.J..&.C.mIWj,c.U..A..r..#..$.............J...!..G...J..k3E.9....768RW.w.Y^3XQ0..S.V..f.7[.%.I{.;.&..W...d...u.fRa..N....$!.)o....o..hWTf..n...D......&..,.~..\..GA.7]8....5....=\|.Q....M..V....a.X.j..<......A..............=4Yyf.W.1a....9Pn.f.......^..gk....^!....#.-.A.<a.hs..q..C.OA$h...F...r..Sh......t..."..f.7L./..s>.eE..t#".t.....0!.-{...F...DT...@l......@.U@...E.O.1N.j.X..cq...)......KN../NKf.x...]u.........xKW5-......E.Z.N....O.e..b].?.....4.......4...u.9......3..........\|.%.aM.....0..^..x.[..j.u1=.]...)^..;..0<l.S...P..?...!.\=...........O}+>9..y..U...17w(U.....@6...+QMO.,....:.....k]T..v..i.N.\.%..jpx[..S.A.._.J.Z...1s.'n..1......%.0.lo!..;.x...?.e..LcM.g....}.......J..=`..7...bK.A...F..8.V...F.D.2....y

C:\Users\user\Desktop\RAYHIWGKDI\QNCYCDFIJJ.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.848520886809452
Encrypted:	false
SSDEEP:	24:JmccoK0N035egyLANqiaGjvULYVMQRxOwKbTkAYCRgcxfa25rQg/Gx5mQBo:M0CRykDaGjvRWpPZFKs5T/61C
MD5:	262BCFAC43E6BDB6CA8BAF425B0489C4
SHA1:	D12135C78EF749ADAB78AFA70A6172B75F9213C5
SHA-256:	299919435C9BDAC9C0BA5C4193BDE1AEE6BB85612B3D007347DBF675E58DF0B7
SHA-512:	C0FE8CFB1D88EA50FA7D8C53C9EC1DA3CF7A8655B8A6AB238338D5362C6A925F210A04D0C6BEAD2096654795B17A0CF230E6C55C037329B450C2141480445DEA
Malicious:	false
Preview:	..eQl...+q1.+...G..%...X!............#l.c$)s.mq.......iKS.<..C`e...d..../..../x.U..M.....\|..]..-..,!.....x".....C..3g....j.'...f.......PI.. /\|.1<u...d.-.4.[..=a....2..=`...V#.C..?5.7}..Z...D....>c...T..j.u{W..~..t.`.tz...9...@. ...y.b......p.c.=.....T3..&..q.u..v..b?....<.b.:......\..P..,X6...J[T..NXJ8...%E..Z....-....{.+.B. ....>.(.z.3...1..j..+<W7...e4^7Vk_J..=..........D.........#.(....dx....".>.3.x=cl./...l..}.AT.....^5.y...P[..i..\fF...4Mq.#....(..Cp.aam..r..h...........@.T..>..u.L.#+.Z...u........xx..}..~.'M(`...xnA./....>.........o.....g.w..?i...@T...n}d..Y..!v2..W..4.l...D.......2..ie>".<...b..;.2.D....:'.Z.f.P.}...M.....vi.)/..t..PA@...C>......]...w.E.....E}+..I...}.d@l.ID8......dM...c...M....sZ......\|.277.rW...j...X#.......\|..._.X6.,a(../#T`.(rp$.5.=.Y...e.i.M.X..&..g.hGb5#o..+.b...X+....K.....R..k.-.RhP....!.[...9Y.9.E..SE..-..E2.\X.....~...S....`%..h.6.N.yuB..6G'....N..Z..=lqn.a..}[........q'..F.-%.e-.yg..Aj.h.....DX .mP...

C:\Users\user\Desktop\RAYHIWGKDI\QNCYCDFIJJ.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.848520886809452
Encrypted:	false
SSDEEP:	24:JmccoK0N035egyLANqiaGjvULYVMQRxOwKbTkAYCRgcxfa25rQg/Gx5mQBo:M0CRykDaGjvRWpPZFKs5T/61C
MD5:	262BCFAC43E6BDB6CA8BAF425B0489C4
SHA1:	D12135C78EF749ADAB78AFA70A6172B75F9213C5
SHA-256:	299919435C9BDAC9C0BA5C4193BDE1AEE6BB85612B3D007347DBF675E58DF0B7
SHA-512:	C0FE8CFB1D88EA50FA7D8C53C9EC1DA3CF7A8655B8A6AB238338D5362C6A925F210A04D0C6BEAD2096654795B17A0CF230E6C55C037329B450C2141480445DEA
Malicious:	false
Preview:	..eQl...+q1.+...G..%...X!............#l.c$)s.mq.......iKS.<..C`e...d..../..../x.U..M.....\|..]..-..,!.....x".....C..3g....j.'...f.......PI.. /\|.1<u...d.-.4.[..=a....2..=`...V#.C..?5.7}..Z...D....>c...T..j.u{W..~..t.`.tz...9...@. ...y.b......p.c.=.....T3..&..q.u..v..b?....<.b.:......\..P..,X6...J[T..NXJ8...%E..Z....-....{.+.B. ....>.(.z.3...1..j..+<W7...e4^7Vk_J..=..........D.........#.(....dx....".>.3.x=cl./...l..}.AT.....^5.y...P[..i..\fF...4Mq.#....(..Cp.aam..r..h...........@.T..>..u.L.#+.Z...u........xx..}..~.'M(`...xnA./....>.........o.....g.w..?i...@T...n}d..Y..!v2..W..4.l...D.......2..ie>".<...b..;.2.D....:'.Z.f.P.}...M.....vi.)/..t..PA@...C>......]...w.E.....E}+..I...}.d@l.ID8......dM...c...M....sZ......\|.277.rW...j...X#.......\|..._.X6.,a(../#T`.(rp$.5.=.Y...e.i.M.X..&..g.hGb5#o..+.b...X+....K.....R..k.-.RhP....!.[...9Y.9.E..SE..-..E2.\X.....~...S....`%..h.6.N.yuB..6G'....N..Z..=lqn.a..}[........q'..F.-%.e-.yg..Aj.h.....DX .mP...

C:\Users\user\Desktop\RAYHIWGKDI\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.858983064373134
Encrypted:	false
SSDEEP:	24:Lz8bOmJ+bQnw/XfLpzo/tqeziZ2Pdr1srJNT+PPdJnc1i791d3SgQbbJ9otEd6ky:LzInwvzpsVe42Nan3p1BQbd9kkmpUE
MD5:	2A44E1D9349639A5023EF6BA827E5EBF
SHA1:	3EAE8E19289B8DC463FA832A2AF03C7568197BB5
SHA-256:	75F5AD64CF17D21A3329DADD95DFB8C3CF3D7DB0353D45594B797CE29AB62608
SHA-512:	B84B1ABD03D8270C1FC34C734A119FA3DFC3037F37B0F91535EAE7F2FFA86642585D745C20F2F10A28BB108B072C4AC103863A66BD56286E2EB00C87D8E1BCC7
Malicious:	false
Preview:	....M.!.u..A...KC..O=..~.M9._f4.......>....=...h.......F,.".{.X..^1...l.1f.]hy...Lb..e...._/...k...0.A...9..).(.LYw.v..[.....3.>!.Y.U ........SB..d..H........k.....K.th.....#....:x.iu.~..q..O.+.nJ..KV..F.{:.w....D.l$.....0vG...y..0C.i.9.7....^...6+.W9Cs..$..].tK.v..>W..#.E..6i.}}...2DE..D......j..(\|.%._..<lz....aG.F.t=...........o...ur<......_G.coZ.&....9u.\u.+O?.S.....%.:g..t.......^"....k...`....+...x.R.)....~...9b8.D..n$N....!.....m<b...R.....c(..n./...Y...t....(.N.^..)..]....._)).?...Dr....p7x..i..B....5..G!"~...UW;.F..g....O!....R..s]J..W..._...:&.. !..l..dY...Q.c.H.cy...f.t.....k.6...?.:.fv..[u....H.............\|..,..5.#.......8..U@.c.j....&..43 .=.7.!.........R....v..;.j.....;z*..t...A........z..r..7...c.,....r._..u.:..c.%.G.cHP......u..a...w...a.............8.P...Q..........M..x..!$...8fi(.J...:.7..W~...V..X...x7m.~.U..a6......].K.Nl.'.aO.~..[.....n\.M.t...x...l./.))Bz.B....\|...7K3..UJ.....?K.n....8.-.W..Nq...H....b.y...R.^.A.

C:\Users\user\Desktop\RAYHIWGKDI\RAYHIWGKDI.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.858983064373134
Encrypted:	false
SSDEEP:	24:Lz8bOmJ+bQnw/XfLpzo/tqeziZ2Pdr1srJNT+PPdJnc1i791d3SgQbbJ9otEd6ky:LzInwvzpsVe42Nan3p1BQbd9kkmpUE
MD5:	2A44E1D9349639A5023EF6BA827E5EBF
SHA1:	3EAE8E19289B8DC463FA832A2AF03C7568197BB5
SHA-256:	75F5AD64CF17D21A3329DADD95DFB8C3CF3D7DB0353D45594B797CE29AB62608
SHA-512:	B84B1ABD03D8270C1FC34C734A119FA3DFC3037F37B0F91535EAE7F2FFA86642585D745C20F2F10A28BB108B072C4AC103863A66BD56286E2EB00C87D8E1BCC7
Malicious:	false
Preview:	....M.!.u..A...KC..O=..~.M9._f4.......>....=...h.......F,.".{.X..^1...l.1f.]hy...Lb..e...._/...k...0.A...9..).(.LYw.v..[.....3.>!.Y.U ........SB..d..H........k.....K.th.....#....:x.iu.~..q..O.+.nJ..KV..F.{:.w....D.l$.....0vG...y..0C.i.9.7....^...6+.W9Cs..$..].tK.v..>W..#.E..6i.}}...2DE..D......j..(\|.%._..<lz....aG.F.t=...........o...ur<......_G.coZ.&....9u.\u.+O?.S.....%.:g..t.......^"....k...`....+...x.R.)....~...9b8.D..n$N....!.....m<b...R.....c(..n./...Y...t....(.N.^..)..]....._)).?...Dr....p7x..i..B....5..G!"~...UW;.F..g....O!....R..s]J..W..._...:&.. !..l..dY...Q.c.H.cy...f.t.....k.6...?.:.fv..[u....H.............\|..,..5.#.......8..U@.c.j....&..43 .=.7.!.........R....v..;.j.....;z*..t...A........z..r..7...c.,....r._..u.:..c.%.G.cHP......u..a...w...a.............8.P...Q..........M..x..!$...8fi(.J...:.7..W~...V..X...x7m.~.U..a6......].K.Nl.'.aO.~..[.....n\.M.t...x...l./.))Bz.B....\|...7K3..UJ.....?K.n....8.-.W..Nq...H....b.y...R.^.A.

C:\Users\user\Desktop\RAYHIWGKDI\SFPUSAFIOL.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.876357117837626
Encrypted:	false
SSDEEP:	24:rgkUONEwuq7cmHIPWxPoqlkIa2P0wW9e4C+MyRHAIlRlx5dA1lSU/gNIw5R0O7fd:roqFBxPzkInPGe4CpyRnx5XxfrF
MD5:	A208959D7FEC5984C229CAB6417FAD35
SHA1:	D0A537AF5F97339AFF46BF6582A06172A2572E42
SHA-256:	83BBE1B654FF7EAF2F4A5DA4CFB0B59631B282B6EB071658E1C68D3E3D3FFFD8
SHA-512:	FCE27439754A94A980AB770ED155CAEA7499B78E6671526B8006A04561847F787FEF3F1C4710D7FAEA837118CD5A3F8A4C415BC41745C78EFBA3EA166EDC1B1B
Malicious:	false
Preview:	m.V..pzf0...hY......Q....1Th...$...J.W...].&)._..1..._.....M#!}.k....%..X.4..).....&X..%F.=...2..":....-.NG..<....56.zB".Z.5...w`E.g..{.RE.."..Z.......3..y(...h...R....O..2.oD.v.'..#c.s..t..1.l...]d^9?n......Z..1.2...J......s$...K]z...Z#!-..k.dH)z.nL.....f.-...$I.e..E...5...}d..U.[W.N.....:+..\r{q{..Qz...;...5.fzR.d.x!.b........\...}..~.i.z?.:M.p...e....j..I.,...y.A.W.!...}....g."A.?rD+..#.O.#..q>......l......."~53.?va.t5.Ds.&....)B........\...........6g1dpC.g..mJ....^..i.....v..}..4..T..O.).&e..\|..j.....N..S....GU{.......[~t.(..+$...gB..../..\.6.z.q.Z.#`.....-.:v.sK.",....U...@..l...QANSp=...S...3.WHj....h;aZ..d{w.-.%\| ......).1.^.......>L........M.^.....H.@q%$..Z.n...AT..z.......>Y..s..._..1.e..t.[.Q.[.t.j*......,i..PZ...N......~.xe.%...\..(..!$....&6@......o5.D..=...}...@.......b...-r#+.IO...g....'.g`.z_.0.a...Z.....:}I..(.:I7=t.(M3....[\.%..M.o..V.P.+...>..LR.tP...tfx.?Vw...w.8.v....r...L....P.\|A.xDw....?.....iP..^f....j.j...JA.

C:\Users\user\Desktop\RAYHIWGKDI\SFPUSAFIOL.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.876357117837626
Encrypted:	false
SSDEEP:	24:rgkUONEwuq7cmHIPWxPoqlkIa2P0wW9e4C+MyRHAIlRlx5dA1lSU/gNIw5R0O7fd:roqFBxPzkInPGe4CpyRnx5XxfrF
MD5:	A208959D7FEC5984C229CAB6417FAD35
SHA1:	D0A537AF5F97339AFF46BF6582A06172A2572E42
SHA-256:	83BBE1B654FF7EAF2F4A5DA4CFB0B59631B282B6EB071658E1C68D3E3D3FFFD8
SHA-512:	FCE27439754A94A980AB770ED155CAEA7499B78E6671526B8006A04561847F787FEF3F1C4710D7FAEA837118CD5A3F8A4C415BC41745C78EFBA3EA166EDC1B1B
Malicious:	false
Preview:	m.V..pzf0...hY......Q....1Th...$...J.W...].&)._..1..._.....M#!}.k....%..X.4..).....&X..%F.=...2..":....-.NG..<....56.zB".Z.5...w`E.g..{.RE.."..Z.......3..y(...h...R....O..2.oD.v.'..#c.s..t..1.l...]d^9?n......Z..1.2...J......s$...K]z...Z#!-..k.dH)z.nL.....f.-...$I.e..E...5...}d..U.[W.N.....:+..\r{q{..Qz...;...5.fzR.d.x!.b........\...}..~.i.z?.:M.p...e....j..I.,...y.A.W.!...}....g."A.?rD+..#.O.#..q>......l......."~53.?va.t5.Ds.&....)B........\...........6g1dpC.g..mJ....^..i.....v..}..4..T..O.).&e..\|..j.....N..S....GU{.......[~t.(..+$...gB..../..\.6.z.q.Z.#`.....-.:v.sK.",....U...@..l...QANSp=...S...3.WHj....h;aZ..d{w.-.%\| ......).1.^.......>L........M.^.....H.@q%$..Z.n...AT..z.......>Y..s..._..1.e..t.[.Q.[.t.j*......,i..PZ...N......~.xe.%...\..(..!$....&6@......o5.D..=...}...@.......b...-r#+.IO...g....'.g`.z_.0.a...Z.....:}I..(.:I7=t.(M3....[\.%..M.o..V.P.+...>..LR.tP...tfx.?Vw...w.8.v....r...L....P.\|A.xDw....?.....iP..^f....j.j...JA.

C:\Users\user\Desktop\RAYHIWGKDI\SQRKHNBNYN.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.883435926798336
Encrypted:	false
SSDEEP:	48:KE/Z3WLh1T8FcVRrhGckFsJ08WaW0aY1qw:KExm9yFc3rh/2rxgXX
MD5:	A0D402B3FB2FE7EB5E954A6E72987D95
SHA1:	82F0633507B44AE37FDE21C914C6AD439A6ADF8C
SHA-256:	57302B963792C5E6E7596035FD211F0AE5CB376C1175E2255D5DF6DB7125C3C3
SHA-512:	45413E245FCB49B364C5C68AF5051B60C12154209D553037A2024D1A2B10CD5DDFDE180C9CA4C7532902D3F7658C7876A7EAC82C7A4FB79DC438941AB7B04C17
Malicious:	false
Preview:	T...6/......5.U...q..L.Z.<.}.o...PJ.d...+/5m..[w..L..F^k!x......'.Y..M=b...E...j..B..#...%M......673k6.....3M.v.#O:.4l.78...V.KQ...o...~....S..Y...>.....1Q..........%....$F....".3..,G........k.LSA...'.\.......%..uN..Yq.j..&;X6..c.h.....np?.a.^pA......b....h(.)........-u..{..z...7pmt.5..}...@...Y....`U....T..izo7;;..~....eTOO......(..G...BJ..iY5.'....kW.7.u.`..?...0~..``.9]....6........$.C.....T.d.t...m.16.N!RP.4..+.K[`.}L..I."......%F..k...J-Z..G.....Z..sh.k.".......'...V]....i.sK..aD.e.@...R.R.....!.....+C.-PfZ...#...U....._:7.n.t........PY..K......`k.[.#mw....e0.w.B.y6...w.t..;..4........;...7...ox....x. X...xy...9Q?{f...:..{.._y=m......zi.`(Wg..J..a,.a..'A..,........a..Z..2.0.\|...U.XI..M......g..8...j..z}.<w...s...>.g/Uyi..t.h.&...A8...!.x..J.'.J%H.._M...x..r..=.f...fyd.5.........t@...snv=a.`.....Rz...j1zr@.\.....b....E\|.s.&G0\|V.S.........XbzlHD#..O..D.q.......N.>5.6..j.\E."k.}.}6W;.]......./..g..... ..z.KX.2...7.a..

C:\Users\user\Desktop\RAYHIWGKDI\SQRKHNBNYN.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.883435926798336
Encrypted:	false
SSDEEP:	48:KE/Z3WLh1T8FcVRrhGckFsJ08WaW0aY1qw:KExm9yFc3rh/2rxgXX
MD5:	A0D402B3FB2FE7EB5E954A6E72987D95
SHA1:	82F0633507B44AE37FDE21C914C6AD439A6ADF8C
SHA-256:	57302B963792C5E6E7596035FD211F0AE5CB376C1175E2255D5DF6DB7125C3C3
SHA-512:	45413E245FCB49B364C5C68AF5051B60C12154209D553037A2024D1A2B10CD5DDFDE180C9CA4C7532902D3F7658C7876A7EAC82C7A4FB79DC438941AB7B04C17
Malicious:	false
Preview:	T...6/......5.U...q..L.Z.<.}.o...PJ.d...+/5m..[w..L..F^k!x......'.Y..M=b...E...j..B..#...%M......673k6.....3M.v.#O:.4l.78...V.KQ...o...~....S..Y...>.....1Q..........%....$F....".3..,G........k.LSA...'.\.......%..uN..Yq.j..&;X6..c.h.....np?.a.^pA......b....h(.)........-u..{..z...7pmt.5..}...@...Y....`U....T..izo7;;..~....eTOO......(..G...BJ..iY5.'....kW.7.u.`..?...0~..``.9]....6........$.C.....T.d.t...m.16.N!RP.4..+.K[`.}L..I."......%F..k...J-Z..G.....Z..sh.k.".......'...V]....i.sK..aD.e.@...R.R.....!.....+C.-PfZ...#...U....._:7.n.t........PY..K......`k.[.#mw....e0.w.B.y6...w.t..;..4........;...7...ox....x. X...xy...9Q?{f...:..{.._y=m......zi.`(Wg..J..a,.a..'A..,........a..Z..2.0.\|...U.XI..M......g..8...j..z}.<w...s...>.g/Uyi..t.h.&...A8...!.x..J.'.J%H.._M...x..r..=.f...fyd.5.........t@...snv=a.`.....Rz...j1zr@.\.....b....E\|.s.&G0\|V.S.........XbzlHD#..O..D.q.......N.>5.6..j.\E."k.}.}6W;.]......./..g..... ..z.KX.2...7.a..

C:\Users\user\Desktop\RAYHIWGKDI\WKXEWIOTXI.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8756828415700415
Encrypted:	false
SSDEEP:	48:nqD1dHIK9GrVyuvby5XLTgJ1kdPTOt5PpsV:nqRdoKopZWCJ1kRSPpsV
MD5:	4C7144943F4DE5E92478EC4933FDB03F
SHA1:	70C462EA488134F3079D0240C041EC6084AB74D2
SHA-256:	793D9BC7313AFD074758E2E764E90B1B437937ACFAEBAC248D87690812F32A05
SHA-512:	4834BE3868F2B1F2C0312A5D0E68D998C5B6E51B42DFAC1BB50070B2F3FBF57E9F14BB75E908C8077327821CCD9A647068CC077830F77B916BB04A10ED2F1C15
Malicious:	true
Preview:	..`........p....m.;q@c..;Fs ...h3.>..1.s.I.h..<7xZ..9.....j@.$..<.xHE.j$..W..v.]W..)d...T..=.........$V..g.x&....AQ.........NK.5.8..?Ms..R.{.MN...w.`.N.x.u.O.F..D.....X0K..B...dY......Aq.._B..8X..V.B0.^..y..SK>.[..v..L..k...~.y..]..I.....q4ysB...%.O...cT..\|...hr..:.13n.......0h...."..x.....LO.9.... ...rV!`#...\|}...)....M.&.......h.....k....1C..:.ZF...o..F.VC...S.h.`...S#5...>.zP.$..H.....Q...B.....6.k.x..\|.:.G@ u..epo....G.<.....W.;X."....bR...5k.m,.8f\|bN..q...&Wju.5..8...n.,V..n..)....Vm.'F.d.....w5L.L4z.......E...B..<..O!B..u........ ..o....D.\]}#..Cq2P....z@3iy.+M....#U..w.Q.$q^rZ.X.s:._.X0......K..<Fk.}...:....s.!7...gj...P .....PO.NzA,^.I&...F..?d.M.Z......z."... ...V..V...0/.....R...&.b.d.......R......F#; ..=W....4..[.9..B..%o,..Q.t... ..\.lL........9 .{s.=.6..J,..]vf.K..An..Wr0....Y....x....P.$R.l.....f.B.....$?.VV3mslB3..=.id.~s.z.....-...'.T.P.u.m......K..H.~.m"...4.g..fH\|...T...<.{.!.....:.^;NnJ.St........t..n...Y...s....Y

C:\Users\user\Desktop\RAYHIWGKDI\WKXEWIOTXI.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8756828415700415
Encrypted:	false
SSDEEP:	48:nqD1dHIK9GrVyuvby5XLTgJ1kdPTOt5PpsV:nqRdoKopZWCJ1kRSPpsV
MD5:	4C7144943F4DE5E92478EC4933FDB03F
SHA1:	70C462EA488134F3079D0240C041EC6084AB74D2
SHA-256:	793D9BC7313AFD074758E2E764E90B1B437937ACFAEBAC248D87690812F32A05
SHA-512:	4834BE3868F2B1F2C0312A5D0E68D998C5B6E51B42DFAC1BB50070B2F3FBF57E9F14BB75E908C8077327821CCD9A647068CC077830F77B916BB04A10ED2F1C15
Malicious:	false
Preview:	..`........p....m.;q@c..;Fs ...h3.>..1.s.I.h..<7xZ..9.....j@.$..<.xHE.j$..W..v.]W..)d...T..=.........$V..g.x&....AQ.........NK.5.8..?Ms..R.{.MN...w.`.N.x.u.O.F..D.....X0K..B...dY......Aq.._B..8X..V.B0.^..y..SK>.[..v..L..k...~.y..]..I.....q4ysB...%.O...cT..\|...hr..:.13n.......0h...."..x.....LO.9.... ...rV!`#...\|}...)....M.&.......h.....k....1C..:.ZF...o..F.VC...S.h.`...S#5...>.zP.$..H.....Q...B.....6.k.x..\|.:.G@ u..epo....G.<.....W.;X."....bR...5k.m,.8f\|bN..q...&Wju.5..8...n.,V..n..)....Vm.'F.d.....w5L.L4z.......E...B..<..O!B..u........ ..o....D.\]}#..Cq2P....z@3iy.+M....#U..w.Q.$q^rZ.X.s:._.X0......K..<Fk.}...:....s.!7...gj...P .....PO.NzA,^.I&...F..?d.M.Z......z."... ...V..V...0/.....R...&.b.d.......R......F#; ..=W....4..[.9..B..%o,..Q.t... ..\.lL........9 .{s.=.6..J,..]vf.K..An..Wr0....Y....x....P.$R.l.....f.B.....$?.VV3mslB3..=.id.~s.z.....-...'.T.P.u.m......K..H.~.m"...4.g..fH\|...T...<.{.!.....:.^;NnJ.St........t..n...Y...s....Y

C:\Users\user\Desktop\RAYHIWGKDI\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Desktop\SFPUSAFIOL.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863649069564363
Encrypted:	false
SSDEEP:	24:c3qZWqydSddfSQDvLo8MdL1fLxQDcfkaPLKBRhqKz1sGehNoTQ2TY:jbf36evLoNDxfkaPLKBSg0o+
MD5:	C8D3075ADE2B5C57134248A9C8D6F080
SHA1:	DB38C8C1758F040C8CECA428D70A282965790624
SHA-256:	7FC3304F7763DDA0CEDEBA2B619C8C629E4CB929BF8EFDF72100D1738FB0F2B7
SHA-512:	83CADF83A5556F834F1DBD9BF0A59E58E11C0C00BB8C5922ABC7802394798B3EF1EC2A75A6758AE7FFCB3317804A32E7AEB4924A5A451FFD6D7CFF22E028A5C5
Malicious:	false
Preview:	...I'eB.v.. ..-:=.%.gS!...r.n....]...Qn..w.Mk.L....Um8"}...N.0d.7..'..;du......i..9.m..(.Eb..._....Z.!GcK.`..9......+.Rp..8.Ud.c..m.;.....^r.G..8C.v.\<]..........C.S.0b$3.d....oXo....(; i.V.....I...XB3.....cWB...u...V"..9...P.}....6..A?.W.`......e.y..s`..R......R......hh.#.....8.."......m.f.t.W..q.x..g.....>...%..WNDC....P....i.z._{.I..PO..............F.pNg...&.U.y.......7)[q..s..`k2.&...1........3.....k.$.."..h..5Y@.#.b..pQ.Hm..."....?..%......(`@...mRb8x._.G.......nZ..aD.7..0....P..2.(....pU..a....N..O`II....r...\|3..?d..<B....Q.LWT.m_.......J\s....Q.M.`.)%4..Q...O.[..H.G4`.....D'..{.Hn..0h.......g..m.6....M.#......Q.Ce.y..7E...2.+~y.".R.d..@.....,..}.^.1.D..<.N../........o.l..d......K....8......qG.IR.5..NT....k..n.B^7.r.f].I..w......A..&..H..j.}As.b.]...QCe.z..{.^.T@.^.....q'.+....S...X$.Q...........*..v.6.........&.k.F.G....~.w\.c.~.}2..^.....].....b...m.8.........Sp....6.L...;J..A<.+;..4.#.+.hS...`...\..pR......

C:\Users\user\Desktop\SFPUSAFIOL.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863649069564363
Encrypted:	false
SSDEEP:	24:c3qZWqydSddfSQDvLo8MdL1fLxQDcfkaPLKBRhqKz1sGehNoTQ2TY:jbf36evLoNDxfkaPLKBSg0o+
MD5:	C8D3075ADE2B5C57134248A9C8D6F080
SHA1:	DB38C8C1758F040C8CECA428D70A282965790624
SHA-256:	7FC3304F7763DDA0CEDEBA2B619C8C629E4CB929BF8EFDF72100D1738FB0F2B7
SHA-512:	83CADF83A5556F834F1DBD9BF0A59E58E11C0C00BB8C5922ABC7802394798B3EF1EC2A75A6758AE7FFCB3317804A32E7AEB4924A5A451FFD6D7CFF22E028A5C5
Malicious:	false
Preview:	...I'eB.v.. ..-:=.%.gS!...r.n....]...Qn..w.Mk.L....Um8"}...N.0d.7..'..;du......i..9.m..(.Eb..._....Z.!GcK.`..9......+.Rp..8.Ud.c..m.;.....^r.G..8C.v.\<]..........C.S.0b$3.d....oXo....(; i.V.....I...XB3.....cWB...u...V"..9...P.}....6..A?.W.`......e.y..s`..R......R......hh.#.....8.."......m.f.t.W..q.x..g.....>...%..WNDC....P....i.z._{.I..PO..............F.pNg...&.U.y.......7)[q..s..`k2.&...1........3.....k.$.."..h..5Y@.#.b..pQ.Hm..."....?..%......(`@...mRb8x._.G.......nZ..aD.7..0....P..2.(....pU..a....N..O`II....r...\|3..?d..<B....Q.LWT.m_.......J\s....Q.M.`.)%4..Q...O.[..H.G4`.....D'..{.Hn..0h.......g..m.6....M.#......Q.Ce.y..7E...2.+~y.".R.d..@.....,..}.^.1.D..<.N../........o.l..d......K....8......qG.IR.5..NT....k..n.B^7.r.f].I..w......A..&..H..j.}As.b.]...QCe.z..{.^.T@.^.....q'.+....S...X$.Q...........*..v.6.........&.k.F.G....~.w\.c.~.}2..^.....].....b...m.8.........Sp....6.L...;J..A<.+;..4.#.+.hS...`...\..pR......

C:\Users\user\Desktop\SFPUSAFIOL.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868344490206085
Encrypted:	false
SSDEEP:	48:94eJznxrefXmrEAljfRSmG7FmviYKJfbc0t:94mVe/k7xGx8WJDB
MD5:	444A405D85B08F28FAC8822A2BA03D86
SHA1:	8A3BD37D98C8C56D9651DCCC2A45EE66F8D967FF
SHA-256:	8C3D14D36FE1168D9BD2121754FCE87B1DFEF4A553CE389FAFD42996587E34FA
SHA-512:	DDE34BE9855ED60BAAC5B5BE64594AC68C27593EC6909577C691EC681B3B57128A9B87AC1014EF088F3D4ABEB0FDBBA9D8341250D9141126DEC918864F2AB6FF
Malicious:	false
Preview:	..%...A.jK....U.q"...I.....\|.jB....}.....o...V..#W.-....D..B..nu.KC..6.K....(.E.oQ...j..F..<a....O(..........$...n.. ......'QH=d.+S.F".(.T;...f.aw:..`k.C..=..D..Lm..R.p.?..".d._....B."..V..4...v.h..a.W.=..K.l..j$(,.tK......G.9X..<,.._.!E.a.3...&_......l\|u+.E/4..rY8Ve...kV2=.Jp.B..c...+.5..6..#..X........~...<..vB..`..u...R.:.8..2.R.Ok..[p...o#9......EGa+.~Sm\|..G'..%. +...F...).....l....t.....f.{...U..Z.D...1w..H83;....AH.5..VF.xO..&7.'`[j...No.....c'!I.......(.^H.V.LE.9R#3u.........L4.:...!..,......2.Q'.....P...As............,..\.].P...S..F.....9.!..I....-#...E.@Q.z.0.r?.WU.}...[..V..d.\...S.b.ir..d)}....Q[.&s}.ao......,.%.~l.]..%..d.D.?y..O.......D3Z........z.g-.fH4.^Y.dY..=+t#=-.x......s..5.....9-t..t.dW..Z:...K.g0N......X.E.....%X...@Fu..........c../..$.$Y.D..9e...[.,...\.*:.4XQ,j.R.G...p..@J....n.Z..j...GL.......y.l....q.94.....$.y...7...>8.6..D.N"0..t..O...;...o1?.+zbY.z...\|..K...eO.f.K"..y.`Iu....`.5...Ek0.K.R#.C...y.]..m

C:\Users\user\Desktop\SFPUSAFIOL.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868344490206085
Encrypted:	false
SSDEEP:	48:94eJznxrefXmrEAljfRSmG7FmviYKJfbc0t:94mVe/k7xGx8WJDB
MD5:	444A405D85B08F28FAC8822A2BA03D86
SHA1:	8A3BD37D98C8C56D9651DCCC2A45EE66F8D967FF
SHA-256:	8C3D14D36FE1168D9BD2121754FCE87B1DFEF4A553CE389FAFD42996587E34FA
SHA-512:	DDE34BE9855ED60BAAC5B5BE64594AC68C27593EC6909577C691EC681B3B57128A9B87AC1014EF088F3D4ABEB0FDBBA9D8341250D9141126DEC918864F2AB6FF
Malicious:	false
Preview:	..%...A.jK....U.q"...I.....\|.jB....}.....o...V..#W.-....D..B..nu.KC..6.K....(.E.oQ...j..F..<a....O(..........$...n.. ......'QH=d.+S.F".(.T;...f.aw:..`k.C..=..D..Lm..R.p.?..".d._....B."..V..4...v.h..a.W.=..K.l..j$(,.tK......G.9X..<,.._.!E.a.3...&_......l\|u+.E/4..rY8Ve...kV2=.Jp.B..c...+.5..6..#..X........~...<..vB..`..u...R.:.8..2.R.Ok..[p...o#9......EGa+.~Sm\|..G'..%. +...F...).....l....t.....f.{...U..Z.D...1w..H83;....AH.5..VF.xO..&7.'`[j...No.....c'!I.......(.^H.V.LE.9R#3u.........L4.:...!..,......2.Q'.....P...As............,..\.].P...S..F.....9.!..I....-#...E.@Q.z.0.r?.WU.}...[..V..d.\...S.b.ir..d)}....Q[.&s}.ao......,.%.~l.]..%..d.D.?y..O.......D3Z........z.g-.fH4.^Y.dY..=+t#=-.x......s..5.....9-t..t.dW..Z:...K.g0N......X.E.....%X...@Fu..........c../..$.$Y.D..9e...[.,...\.*:.4XQ,j.R.G...p..@J....n.Z..j...GL.......y.l....q.94.....$.y...7...>8.6..D.N"0..t..O...;...o1?.+zbY.z...\|..K...eO.f.K"..y.`Iu....`.5...Ek0.K.R#.C...y.]..m

C:\Users\user\Desktop\SQRKHNBNYN.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.867119726273332
Encrypted:	false
SSDEEP:	24:WpwmXRYIeuOzW8EDkGPFnNlxNs+H6RaCPmwGTLpm6SxLP2m4OE1hgymyRR:EXrVQjEDDxW+HD51VQ32hgymy3
MD5:	83CCC356766A6E2D0B6FB1411485787F
SHA1:	0EA06C8F1B54AFD14DB18BC9AEB7ED4F60864C7C
SHA-256:	EB19F9F3BB82CC3C38C639531474B347209D56E7282D2D397C1EA485E5FA453C
SHA-512:	10D66B5C1B5F899DAD1E2F509B7E5588704F4FB4DEA60DCAF16C40C89B2E921FAE32E8414E3147B443F9FFBCD104B85345C743277E5516C8BC4C7A0F9688B077
Malicious:	false
Preview:	.Zo%.O...e.......1...&..U.@.s1.v.T....N.".^w.T.V....<..u;..{..,F):.t..........zdB.L..@.....q.aO11n..w...{Q.6..n\.@...1T}._...thV.=..YH,}..V...\J.0...w.n.@.....c\|3[3v.2.x\|.^..rJ~..h....PY.E..w...X..3T.......7U.o..T.3..K......:S..Q.3X3.....o...R.y.A.@(.-2......k....1..F.k....+..:Z..c?~O..U.....vD..........Z9i.=.e.`..S.W..U...<>CXe.....F.).aVO..&..Aa.@....M..b........ ..y.~M.K.`.D.......$.6.463`...g...]..iy.....zu.......k..........1.Y....a..d.........U.R7)..~...#..tn_.0J...%5}..k.e.n..d..Fb.bK..n..+....7;...`....%......"E}\(. ..W.M9.FU.T`>...@.v.....M......~...........m...~93(..!...^.+1...C..x..ofZ.....2y.'.q.%......83....8...c.L.T....{.'{z[..g>.9.........M!j.jw...,..1\|d....L....:..r..$)..T..S..w.._.'.1j5...W..'S.\6Ex.YG../...8.{....S.\h>.d[b.h.(.T...C}`.r..............,.D...1..x.N..0J..2_3.)O....Z.K..D5......~B%.....i..l.2..A..k..Y._......c.G.(...uX;...t...P..{F..v.$..[...2....\|C._@#pN..J....A..:]b..8,6B.c.. "..I....A.K..:~A.M\

C:\Users\user\Desktop\SQRKHNBNYN.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.867119726273332
Encrypted:	false
SSDEEP:	24:WpwmXRYIeuOzW8EDkGPFnNlxNs+H6RaCPmwGTLpm6SxLP2m4OE1hgymyRR:EXrVQjEDDxW+HD51VQ32hgymy3
MD5:	83CCC356766A6E2D0B6FB1411485787F
SHA1:	0EA06C8F1B54AFD14DB18BC9AEB7ED4F60864C7C
SHA-256:	EB19F9F3BB82CC3C38C639531474B347209D56E7282D2D397C1EA485E5FA453C
SHA-512:	10D66B5C1B5F899DAD1E2F509B7E5588704F4FB4DEA60DCAF16C40C89B2E921FAE32E8414E3147B443F9FFBCD104B85345C743277E5516C8BC4C7A0F9688B077
Malicious:	false
Preview:	.Zo%.O...e.......1...&..U.@.s1.v.T....N.".^w.T.V....<..u;..{..,F):.t..........zdB.L..@.....q.aO11n..w...{Q.6..n\.@...1T}._...thV.=..YH,}..V...\J.0...w.n.@.....c\|3[3v.2.x\|.^..rJ~..h....PY.E..w...X..3T.......7U.o..T.3..K......:S..Q.3X3.....o...R.y.A.@(.-2......k....1..F.k....+..:Z..c?~O..U.....vD..........Z9i.=.e.`..S.W..U...<>CXe.....F.).aVO..&..Aa.@....M..b........ ..y.~M.K.`.D.......$.6.463`...g...]..iy.....zu.......k..........1.Y....a..d.........U.R7)..~...#..tn_.0J...%5}..k.e.n..d..Fb.bK..n..+....7;...`....%......"E}\(. ..W.M9.FU.T`>...@.v.....M......~...........m...~93(..!...^.+1...C..x..ofZ.....2y.'.q.%......83....8...c.L.T....{.'{z[..g>.9.........M!j.jw...,..1\|d....L....:..r..$)..T..S..w.._.'.1j5...W..'S.\6Ex.YG../...8.{....S.\h>.d[b.h.(.T...C}`.r..............,.D...1..x.N..0J..2_3.)O....Z.K..D5......~B%.....i..l.2..A..k..Y._......c.G.(...uX;...t...P..{F..v.$..[...2....\|C._@#pN..J....A..:]b..8,6B.c.. "..I....A.K..:~A.M\

C:\Users\user\Desktop\UOOJJOZIRH.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.849372919886071
Encrypted:	false
SSDEEP:	48:Bg73Ib2PJRikSZBlzfjL44oJ0j7Ibvm4/miyac3:Bg73ICL5wz7LsJ0jsuYyac3
MD5:	1438ABC4A66E88C1E76DC99D18D0FBA8
SHA1:	86E983D408D239B1EC9D95E50D4B5964F064A68A
SHA-256:	81BA839FCED0BA5ABC19F3211852902AA23ED96FE8E946DBB3479E4E1F7B07EB
SHA-512:	96EF3669CA5B70468370DD2A87417466528B45E7AF64E4F361B19B64CF5275025FED403504E2F80CA51154D681AEC7790DA3E85284E85AC92CC4E361FB8DAE66
Malicious:	false
Preview:	.rJ...)q...4.....f.x.u..>Y.id....RH...j......y.A!..*q....b~..O..]%~....v>.......p...J^...8.N.n.p#.SD...b.E...8..N....=Be.S.M.uR]Kw8...9x/.D..9.dI...p...o..`?...?0u.>..M..k3.g.%.{1EqV..JQ...\|.u.G..De.5Z0cdC.@.2.......&.6.v{.!..{..Y. f'.&.g...M..Xw6......~.0k.."+..$..uy....b.b.J..~oM.J.."...79.)P.........8..#...w01.....;...$....b.V..8..>.......g]7.$.z..%...>]..4...3f........0e.d.)....v.+.....C.._~D..`,..j"..q+..7>.:\|.\vC.p.O....Z.....';Wp).l ..S..@...,.Z...........P`.....0.....Oyt`\nn%..A)..h#..b&....N.H$.O.1.j...{?.]+..X..,.4#r.)......"1.J......V....t..c.f.A....m.H40d..K..I~.@...tC...v..H......6j.......BxLp../..j.....F.]Q^.$(.w...V......:..%...u.+k/O....~...v....8......[....T..0?.0.z.yoG.)...7bq0....."..Yz.n.;x.Ga.$.k..i..P.o.`n!2....C.b.....:..+...u.9..w....!8..}.....I..._.v5]..1.........I(.9.....\...p...Is}._7......om0..8..1C.>..\ ,%zl...../..'.'.(.v....2.'Q...+i.H...h..n.J>...$..X.\.. .>(!.=S.D!......!\)}...q....H.SK.UE...v....b._.Hi.

C:\Users\user\Desktop\UOOJJOZIRH.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.849372919886071
Encrypted:	false
SSDEEP:	48:Bg73Ib2PJRikSZBlzfjL44oJ0j7Ibvm4/miyac3:Bg73ICL5wz7LsJ0jsuYyac3
MD5:	1438ABC4A66E88C1E76DC99D18D0FBA8
SHA1:	86E983D408D239B1EC9D95E50D4B5964F064A68A
SHA-256:	81BA839FCED0BA5ABC19F3211852902AA23ED96FE8E946DBB3479E4E1F7B07EB
SHA-512:	96EF3669CA5B70468370DD2A87417466528B45E7AF64E4F361B19B64CF5275025FED403504E2F80CA51154D681AEC7790DA3E85284E85AC92CC4E361FB8DAE66
Malicious:	false
Preview:	.rJ...)q...4.....f.x.u..>Y.id....RH...j......y.A!..*q....b~..O..]%~....v>.......p...J^...8.N.n.p#.SD...b.E...8..N....=Be.S.M.uR]Kw8...9x/.D..9.dI...p...o..`?...?0u.>..M..k3.g.%.{1EqV..JQ...\|.u.G..De.5Z0cdC.@.2.......&.6.v{.!..{..Y. f'.&.g...M..Xw6......~.0k.."+..$..uy....b.b.J..~oM.J.."...79.)P.........8..#...w01.....;...$....b.V..8..>.......g]7.$.z..%...>]..4...3f........0e.d.)....v.+.....C.._~D..`,..j"..q+..7>.:\|.\vC.p.O....Z.....';Wp).l ..S..@...,.Z...........P`.....0.....Oyt`\nn%..A)..h#..b&....N.H$.O.1.j...{?.]+..X..,.4#r.)......"1.J......V....t..c.f.A....m.H40d..K..I~.@...tC...v..H......6j.......BxLp../..j.....F.]Q^.$(.w...V......:..%...u.+k/O....~...v....8......[....T..0?.0.z.yoG.)...7bq0....."..Yz.n.;x.Ga.$.k..i..P.o.`n!2....C.b.....:..+...u.9..w....!8..}.....I..._.v5]..1.........I(.9.....\...p...Is}._7......om0..8..1C.>..\ ,%zl...../..'.'.(.v....2.'Q...+i.H...h..n.J>...$..X.\.. .>(!.=S.D!......!\)}...q....H.SK.UE...v....b._.Hi.

C:\Users\user\Desktop\VAMYDFPUND.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.866635922799093
Encrypted:	false
SSDEEP:	48:0QveiYAu02vQoCcNUqY/BIvU19+0sQGO9wi9:xPJs4ot4KEAOes
MD5:	C1E3F9439165663EE6734E3E549B253B
SHA1:	AE38E60165A309DDBE7A2271F95057E3FF145117
SHA-256:	D0033BC9EE6C17249648A35A0867076815891D26F36090732C1F0C1276A9185B
SHA-512:	8D327A2B49862804A77B54AF5DAAB92485AC2D0C5A3D953C658C332E25936F29D1F5E36025B5C10E675F9F6AF62223CF72B91B42381BFC481B1929483976B688
Malicious:	false
Preview:	.$.u..Z.5.9}..VO.....L[..0.>..6d2S..t.CS.Z..}N...y.8....[.....s#l..H...c....>a....V.y...?J.7<5E..tB...E...D..%).z..l.V.wq.k!.'Kv9b.r.iw.45.[.....h.+........:.u4...O..{y. [.;..,833q.....s.'8. .H.....T..,=?<.4.5.OS......w..0X...$.#....\|c..A...kG...01X..x60SF.!..;..Vk.@.z.}.O5hB....Clz..u.....L4..-k..!.Yk~T+=5.5..`.I...28..........l....v/.U.C.s...eyf_6&...=..@..o9..U9.{.........k."_a..qm't.D.a.`.$..6.\........2x(.......x.7..t`....L&..g.O....P...9..J".../.yU\..+..]@.BXQGF............D.jH%&.V.YZ.)J...Wx....{...GEQ]X..Iy...:..m.u....>.2.r.....&..m..J...Y:A8..\|...k.i>.VO.vX...4!..ij..u..I....}.......;o...R.A..I].....J.}...O1...n..D...0..?...71M.P.Y.~..../>~D.._+z\|.".....~,.y...C....[.=sL;>"Yp7?../......!.........`..:r.$V.....P.7t..H6..J..W.I.:(............q......D....3.8.}}.....{./..]o.....L=.O.W.o~.`..[.B...O?...5.....p..<.v.:.0...O.\|X.7Mz.......m0l]l.){Phy..%...+ys{AW.....=.....b..`3.T.@.E..;~..... .k1..Uhv...S.....9<.<.$..H0.M3\|.TW..AK...

C:\Users\user\Desktop\VAMYDFPUND.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.866635922799093
Encrypted:	false
SSDEEP:	48:0QveiYAu02vQoCcNUqY/BIvU19+0sQGO9wi9:xPJs4ot4KEAOes
MD5:	C1E3F9439165663EE6734E3E549B253B
SHA1:	AE38E60165A309DDBE7A2271F95057E3FF145117
SHA-256:	D0033BC9EE6C17249648A35A0867076815891D26F36090732C1F0C1276A9185B
SHA-512:	8D327A2B49862804A77B54AF5DAAB92485AC2D0C5A3D953C658C332E25936F29D1F5E36025B5C10E675F9F6AF62223CF72B91B42381BFC481B1929483976B688
Malicious:	false
Preview:	.$.u..Z.5.9}..VO.....L[..0.>..6d2S..t.CS.Z..}N...y.8....[.....s#l..H...c....>a....V.y...?J.7<5E..tB...E...D..%).z..l.V.wq.k!.'Kv9b.r.iw.45.[.....h.+........:.u4...O..{y. [.;..,833q.....s.'8. .H.....T..,=?<.4.5.OS......w..0X...$.#....\|c..A...kG...01X..x60SF.!..;..Vk.@.z.}.O5hB....Clz..u.....L4..-k..!.Yk~T+=5.5..`.I...28..........l....v/.U.C.s...eyf_6&...=..@..o9..U9.{.........k."_a..qm't.D.a.`.$..6.\........2x(.......x.7..t`....L&..g.O....P...9..J".../.yU\..+..]@.BXQGF............D.jH%&.V.YZ.)J...Wx....{...GEQ]X..Iy...:..m.u....>.2.r.....&..m..J...Y:A8..\|...k.i>.VO.vX...4!..ij..u..I....}.......;o...R.A..I].....J.}...O1...n..D...0..?...71M.P.Y.~..../>~D.._+z\|.".....~,.y...C....[.=sL;>"Yp7?../......!.........`..:r.$V.....P.7t..H6..J..W.I.:(............q......D....3.8.}}.....{./..]o.....L=.O.W.o~.`..[.B...O?...5.....p..<.v.:.0...O.\|X.7Mz.......m0l]l.){Phy..%...+ys{AW.....=.....b..`3.T.@.E..;~..... .k1..Uhv...S.....9<.<.$..H0.M3\|.TW..AK...

C:\Users\user\Desktop\WKXEWIOTXI.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.852644926380614
Encrypted:	false
SSDEEP:	24:ggoUJ+MXow1fonCNw48x5b+jirlOi6QBXRONzzumk4ly9g/Q7n4coxUV2vt4cfQ:gdQowBotLrp1R0zLk4wF4/swE
MD5:	1556FD80BD25B8C93EB48B5120892908
SHA1:	5B8CFC3D5050DD3404E70284AD683C8B75C9AC72
SHA-256:	78C2603482A0FC24095F50A1F56F5B5C38AB33EAC7990F44B2D9AC4D997FE7E6
SHA-512:	076C63D1C09CA9C1632F90739E509D6507ED38D0186AE0A7F9D68EE66AC29C6E640A3B4B7693895C9347921BD54866C6D4BCDC8361CA5AA7027B29A990F35AB3
Malicious:	false
Preview:	.B....e.Wt.g..=L.03.....N.6.G..kE..#!.o....G...,...-at...3A..Vc...b..[.jU...!.z..........U.5.....S.K.v.g..`....M.Z.2...?.i.h..v...R..N.J..0...;.^....f.g...r..F]F.]=..8E$L^..t.....I_.X..^U..{W.......\|7.".&..v......G...2..)..2.....+r(..x].,p..f6A..m.V.VXM\.I.....Ksw._.p0.. V%8..MzK......x...I~_..R.l,....n..>.....C......?.!2.....,........k...(...Ep.!.VbB.!M......R..Nn..Xa...Rk.a......C.+k..V..=.7..+.eB.r.#.67..+...$.s.!._H..r..9,..vE..n..i....".....J.?.k.EO....RE.&..xp&...c4n....?Rn.jU..%.z.;.m.....LS...t....eG..WC..G..AO..{.....i.j..........O..r.9.R.3...\..!.}&c..7.....J_0.3H.......`.(f.:=\|E.....G..O\|7..6.qz`...0.TB..O.RZs..BWC..\+.....x-F1.`[.....;.B..A.K........n.L.......e_...p..{..j.'b)ywz/.;8. $....!%p',.......}..K1.. %,.,...E.......9..../.(....~..o....w....7.p...7.nt....$.I.&.C...XW.8..N.Q.{.lo.t........9._<`D..:k..B\|....6......L.....V.(J..H]}~j.@.....SWea....=G..LE.=..tN.VA!I7.G....Z.....FF...r}.(.d>...Oa9.S...t....g.*.

C:\Users\user\Desktop\WKXEWIOTXI.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.852644926380614
Encrypted:	false
SSDEEP:	24:ggoUJ+MXow1fonCNw48x5b+jirlOi6QBXRONzzumk4ly9g/Q7n4coxUV2vt4cfQ:gdQowBotLrp1R0zLk4wF4/swE
MD5:	1556FD80BD25B8C93EB48B5120892908
SHA1:	5B8CFC3D5050DD3404E70284AD683C8B75C9AC72
SHA-256:	78C2603482A0FC24095F50A1F56F5B5C38AB33EAC7990F44B2D9AC4D997FE7E6
SHA-512:	076C63D1C09CA9C1632F90739E509D6507ED38D0186AE0A7F9D68EE66AC29C6E640A3B4B7693895C9347921BD54866C6D4BCDC8361CA5AA7027B29A990F35AB3
Malicious:	false
Preview:	.B....e.Wt.g..=L.03.....N.6.G..kE..#!.o....G...,...-at...3A..Vc...b..[.jU...!.z..........U.5.....S.K.v.g..`....M.Z.2...?.i.h..v...R..N.J..0...;.^....f.g...r..F]F.]=..8E$L^..t.....I_.X..^U..{W.......\|7.".&..v......G...2..)..2.....+r(..x].,p..f6A..m.V.VXM\.I.....Ksw._.p0.. V%8..MzK......x...I~_..R.l,....n..>.....C......?.!2.....,........k...(...Ep.!.VbB.!M......R..Nn..Xa...Rk.a......C.+k..V..=.7..+.eB.r.#.67..+...$.s.!._H..r..9,..vE..n..i....".....J.?.k.EO....RE.&..xp&...c4n....?Rn.jU..%.z.;.m.....LS...t....eG..WC..G..AO..{.....i.j..........O..r.9.R.3...\..!.}&c..7.....J_0.3H.......`.(f.:=\|E.....G..O\|7..6.qz`...0.TB..O.RZs..BWC..\+.....x-F1.`[.....;.B..A.K........n.L.......e_...p..{..j.'b)ywz/.;8. $....!%p',.......}..K1.. %,.,...E.......9..../.(....~..o....w....7.p...7.nt....$.I.&.C...XW.8..N.Q.{.lo.t........9._<`D..:k..B\|....6......L.....V.(J..H]}~j.@.....SWea....=G..LE.=..tN.VA!I7.G....Z.....FF...r}.(.d>...Oa9.S...t....g.*.

C:\Users\user\Desktop\WKXEWIOTXI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.873475234767591
Encrypted:	false
SSDEEP:	48:gMDNF+tTeqiVBMUZW83gC7lgBbN0ix+/UfDs9:XDz+LiDMMWS7lUNG/8Ds9
MD5:	3E939872C49BBD70CD0CEC53BE33E0B5
SHA1:	A7C704B70AB939A474E12ACBD8F3854D9A1C4318
SHA-256:	309027CB39D9C2CCEAF4C2491E4F211E71E02C295F726904923F27937915168B
SHA-512:	5616849E5C923E66873C1FD869487DA6FE63AF86E717099D4E722AB1831205D6DD5A2375BA56C5AD5F2FF352A6C436A0EC9B7EA933BE6D92B558CD95DA08BC32
Malicious:	false
Preview:	...Q.8d_...P.c....f....dli......J?..yUk.oG>....Q.....>...L.Q..Y..2.p......:,.....R.\|.)...$@.%..&"j..(!.........j..;..l.[....A2.H.J. .c..b......].$...lk."El}.>..h...n,D..9....G..J....xZ.......&..b4T.Cz..&..h.O.Q+..t.$...6..V...v.....r.\|...:..r...g..l....@.>).}.+.Q7...D.~.C.`...\%.z.Y.g.....X.?Qb..9.Tq(...+g...X..../}....]..L..N8.u..R1....=.Q%3.x....u..U.G.n..L...{C.v.M'V.V..'V...........z..#_#....Y...".....(..c!........20..l&..~...w.q)GG.....\|w..ls.....$^_wj.h...J...e.\.s..s8.n........0..PR=s.~..$.....W. ...... ....1~1..W.}.j]...+..il.'.{..U..W4rp.X..^.%.....~...Y2..f.......J."..(..Y.v`Y0...;...h..`..W/..:...'.*...&.-..e..^.A)..Ho.1b7. ...aL...z^Z.0~..yJ..L.8.5.R.{.K.@`..;..~.Q...Qy.V^....7..k..;PY..]./9....LR...].Wi..D~Pu.....pFk..Z.u.?MIH.._..:1.9.5"\....%.kt..!....4o.........2Z...V........;k.)....X.6...E..rI].?./r..I...>..hQ'.{..P....\Z......m?.+.T.... Y..0..Q..#.p..<y.G......$..5..3C.]p...c0..a.tXUa....7..>...j.H0.m.F...

C:\Users\user\Desktop\WKXEWIOTXI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.873475234767591
Encrypted:	false
SSDEEP:	48:gMDNF+tTeqiVBMUZW83gC7lgBbN0ix+/UfDs9:XDz+LiDMMWS7lUNG/8Ds9
MD5:	3E939872C49BBD70CD0CEC53BE33E0B5
SHA1:	A7C704B70AB939A474E12ACBD8F3854D9A1C4318
SHA-256:	309027CB39D9C2CCEAF4C2491E4F211E71E02C295F726904923F27937915168B
SHA-512:	5616849E5C923E66873C1FD869487DA6FE63AF86E717099D4E722AB1831205D6DD5A2375BA56C5AD5F2FF352A6C436A0EC9B7EA933BE6D92B558CD95DA08BC32
Malicious:	false
Preview:	...Q.8d_...P.c....f....dli......J?..yUk.oG>....Q.....>...L.Q..Y..2.p......:,.....R.\|.)...$@.%..&"j..(!.........j..;..l.[....A2.H.J. .c..b......].$...lk."El}.>..h...n,D..9....G..J....xZ.......&..b4T.Cz..&..h.O.Q+..t.$...6..V...v.....r.\|...:..r...g..l....@.>).}.+.Q7...D.~.C.`...\%.z.Y.g.....X.?Qb..9.Tq(...+g...X..../}....]..L..N8.u..R1....=.Q%3.x....u..U.G.n..L...{C.v.M'V.V..'V...........z..#_#....Y...".....(..c!........20..l&..~...w.q)GG.....\|w..ls.....$^_wj.h...J...e.\.s..s8.n........0..PR=s.~..$.....W. ...... ....1~1..W.}.j]...+..il.'.{..U..W4rp.X..^.%.....~...Y2..f.......J."..(..Y.v`Y0...;...h..`..W/..:...'.*...&.-..e..^.A)..Ho.1b7. ...aL...z^Z.0~..yJ..L.8.5.R.{.K.@`..;..~.Q...Qy.V^....7..k..;PY..]./9....LR...].Wi..D~Pu.....pFk..Z.u.?MIH.._..:1.9.5"\....%.kt..!....4o.........2Z...V........;k.)....X.6...E..rI].?./r..I...>..hQ'.{..P....\Z......m?.+.T.... Y..0..Q..#.p..<y.G......$..5..3C.]p...c0..a.tXUa....7..>...j.H0.m.F...

C:\Users\user\Desktop\WKXEWIOTXI.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8608614189691215
Encrypted:	false
SSDEEP:	24:L6+FtWuA0wDLGnTPq3+GmUvabUtYzAPDkrBVx/IaOSX8xwiqO/ib9Fa88wlm/:+yQGGLYOuGmUvHtYkA1Vx/F2qxb9vhlm
MD5:	ABD912B758000460D5BC7080EEBB0EAF
SHA1:	D341D1A82CEF4C0222F10046968805B2A557236E
SHA-256:	775643A12803D8D6D4FFAC4BD0CBCB1B5D8BF7AB6F752AD2A30695E146454BA3
SHA-512:	AEE77AAFEC8C9F15F0E7129ED320EF8A8F62D677203CF0E00EA68C4B76F3156DBCDC2DD0DC63A17F9BDC5FB256F557E97893E79F57F5A6E8E88BFF133904B0A0
Malicious:	false
Preview:	.n....4,X....".0.<....2%.e.h..t.r.I.H\.....Y...{3..F...F.+f.%)+.D../.p....Q...l.\|..).)..U.p...~..~....E..y...Qp.O\)...)B._?&.?...]w.C}G.....uY..S...1s..%.. .wz.0.-d...9....4....T..s.`...W.....J...>XvI..lP.C..h.3.g...6...e1g..&.K.R/P...../...dz.].(...7?.....{../..9........x..%,_.C....2......2..A.....xYC..2..F.@9.+..<e...j!.sh.........4rR+...d=..7c.M18L.o;..e0J.B.Ju!.....].S._..<:.M....z.x.?................wk.9~...h....y.....4......2.uA)...;.?..e9.....=...h#s.D.'.....f..%GK...t..-.z$....QO..,C.x,...(`0$.)].........?..P..p7.P.]/X.L3 6.n.n....42.e.,.C..........'4.M..3.!(.J.-.t^dV........P......#`..5.v.Po.[.iYR....[.).>.........:-..h4n'.1/\|...p.3.GNoK.Uc.9.n.}.)8...i$.Num..K....... .....j.wHc....xF....d4....Z...2....h.;....z...]+.pBDJ?..l..;?jiF..!..Jo.-R...!9.3.<l..]-....@...P.e.14..'b.QOl.[....?.zni....et..).....h..8D...%.O~..F_w.'...YF.j.....Q...9.a8^....j......G"...QD.;..+.w.;.B0Vl^Qp..{...B.Z..i...S.O{.>./.x.].n.__..a.uz3....@,8\.....G.

C:\Users\user\Desktop\WKXEWIOTXI.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8608614189691215
Encrypted:	false
SSDEEP:	24:L6+FtWuA0wDLGnTPq3+GmUvabUtYzAPDkrBVx/IaOSX8xwiqO/ib9Fa88wlm/:+yQGGLYOuGmUvHtYkA1Vx/F2qxb9vhlm
MD5:	ABD912B758000460D5BC7080EEBB0EAF
SHA1:	D341D1A82CEF4C0222F10046968805B2A557236E
SHA-256:	775643A12803D8D6D4FFAC4BD0CBCB1B5D8BF7AB6F752AD2A30695E146454BA3
SHA-512:	AEE77AAFEC8C9F15F0E7129ED320EF8A8F62D677203CF0E00EA68C4B76F3156DBCDC2DD0DC63A17F9BDC5FB256F557E97893E79F57F5A6E8E88BFF133904B0A0
Malicious:	false
Preview:	.n....4,X....".0.<....2%.e.h..t.r.I.H\.....Y...{3..F...F.+f.%)+.D../.p....Q...l.\|..).)..U.p...~..~....E..y...Qp.O\)...)B._?&.?...]w.C}G.....uY..S...1s..%.. .wz.0.-d...9....4....T..s.`...W.....J...>XvI..lP.C..h.3.g...6...e1g..&.K.R/P...../...dz.].(...7?.....{../..9........x..%,_.C....2......2..A.....xYC..2..F.@9.+..<e...j!.sh.........4rR+...d=..7c.M18L.o;..e0J.B.Ju!.....].S._..<:.M....z.x.?................wk.9~...h....y.....4......2.uA)...;.?..e9.....=...h#s.D.'.....f..%GK...t..-.z$....QO..,C.x,...(`0$.)].........?..P..p7.P.]/X.L3 6.n.n....42.e.,.C..........'4.M..3.!(.J.-.t^dV........P......#`..5.v.Po.[.iYR....[.).>.........:-..h4n'.1/\|...p.3.GNoK.Uc.9.n.}.)8...i$.Num..K....... .....j.wHc....xF....d4....Z...2....h.;....z...]+.pBDJ?..l..;?jiF..!..Jo.-R...!9.3.<l..]-....@...P.e.14..'b.QOl.[....?.zni....et..).....h..8D...%.O~..F_w.'...YF.j.....Q...9.a8^....j......G"...QD.;..+.w.;.B0Vl^Qp..{...B.Z..i...S.O{.>./.x.].n.__..a.uz3....@,8\.....G.

C:\Users\user\Desktop\Word.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2987
Entropy (8bit):	7.9336873271664645
Encrypted:	false
SSDEEP:	48:XRJz9EesJtchUQsryKIc9pY6q1DT/OLN36tBI9+O5M1ydI3A1M/cg1RwaQxWJ9ra:LKesJtchjsmKICqBT/Oxqts+OXCj3wa+
MD5:	8A3F62D58BF3D8C8AEAAAEBFC058AFED
SHA1:	CA621ECF6042D49C5223EE7CA8ADA3C02A751A25
SHA-256:	6C178AC3F794AD5606EF6D467F575F82052614E6D10A7438914656985F21E86E
SHA-512:	6F6AD4297C84CBB531678F9C9451949509F93566AB980AA6546C34BC6CA2C754BE8C99B33A69F37E066E860E22EF276F9E78E14CB31D933547D18B443EBDAD54
Malicious:	false
Preview:	..[:....&.O...\).....F......A..KM_0.H\.......H..G.:@..tL.;....F'..._..nS..nu......{}...U.\..5:..`m....U...s.!.2.h7']-d..+.3.9..?}.$....}.&R.AXL1g....}...>.7.`rC!..o..l..p.ku.......`;{.@.p..2..0.3...z>...@..C.."M....8b}T....w.U.... .......0.%\|.z.....3.....1......j....$...g.....P.lc..w.6..v..)..<c....~.N!v4..c.2.!..1)!....#U. 't.......s..u.3.r.$.A_Cw..W..cCi.....{U..5^..'.......Z:%4.m.V.E@.W.Dd.X....u..@...<.R..q.7X.~c..,.A.X....b.4).<M.u...-.$d5?........k...t)A+.].j..........g8....._.d.\OaHH....uT..A.pN.ht..g"l.K.8."R.Yr[....9/.......U."..=.T...VXx.Q..+L\|f..Jn.b.o.....}.,.}t....U.b...F&.....d.........rF.....IfE......,..g<.......R.w..N.q..8.E.Xx..1.=r].r.@.C....u@....j.....[...d..h~...+...Q.$.oC2..$H.UH7...N..&..#S..E2#...S..T.c. .j?....."..'.../....m......v....$WEA.=f.+.DGf3Gk9@2...`m..BO..D...]je...^D:.Q<..$!.A.4........A.T.w`...1.-Y.......Kh3.C..V}...._..s....R..1....[.m0..?.^.k..d.>.v.....MJB.:..y..(.HH.s.Qw.T...2.M.......uI...."^...

C:\Users\user\Desktop\Word.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2987
Entropy (8bit):	7.9336873271664645
Encrypted:	false
SSDEEP:	48:XRJz9EesJtchUQsryKIc9pY6q1DT/OLN36tBI9+O5M1ydI3A1M/cg1RwaQxWJ9ra:LKesJtchjsmKICqBT/Oxqts+OXCj3wa+
MD5:	8A3F62D58BF3D8C8AEAAAEBFC058AFED
SHA1:	CA621ECF6042D49C5223EE7CA8ADA3C02A751A25
SHA-256:	6C178AC3F794AD5606EF6D467F575F82052614E6D10A7438914656985F21E86E
SHA-512:	6F6AD4297C84CBB531678F9C9451949509F93566AB980AA6546C34BC6CA2C754BE8C99B33A69F37E066E860E22EF276F9E78E14CB31D933547D18B443EBDAD54
Malicious:	false
Preview:	..[:....&.O...\).....F......A..KM_0.H\.......H..G.:@..tL.;....F'..._..nS..nu......{}...U.\..5:..`m....U...s.!.2.h7']-d..+.3.9..?}.$....}.&R.AXL1g....}...>.7.`rC!..o..l..p.ku.......`;{.@.p..2..0.3...z>...@..C.."M....8b}T....w.U.... .......0.%\|.z.....3.....1......j....$...g.....P.lc..w.6..v..)..<c....~.N!v4..c.2.!..1)!....#U. 't.......s..u.3.r.$.A_Cw..W..cCi.....{U..5^..'.......Z:%4.m.V.E@.W.Dd.X....u..@...<.R..q.7X.~c..,.A.X....b.4).<M.u...-.$d5?........k...t)A+.].j..........g8....._.d.\OaHH....uT..A.pN.ht..g"l.K.8."R.Yr[....9/.......U."..=.T...VXx.Q..+L\|f..Jn.b.o.....}.,.}t....U.b...F&.....d.........rF.....IfE......,..g<.......R.w..N.q..8.E.Xx..1.=r].r.@.C....u@....j.....[...d..h~...+...Q.$.oC2..$H.UH7...N..&..#S..E2#...S..T.c. .j?....."..'.../....m......v....$WEA.=f.+.DGf3Gk9@2...`m..BO..D...]je...^D:.Q<..$!.A.4........A.T.w`...1.-Y.......Kh3.C..V}...._..s....R..1....[.m0..?.^.k..d.>.v.....MJB.:..y..(.HH.s.Qw.T...2.M.......uI...."^...

C:\Users\user\Desktop\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Documents\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.867951059095531
Encrypted:	false
SSDEEP:	48:shpPaZxcDzNjLs6Bo1F9b9whubpOgYTJzu71C7szdXCp:dkzN3sN1Db2husg6pqWszd+
MD5:	D8EA8BDD0D0045F8E3EF46575FAC596D
SHA1:	AF5B61FC575AD39DC13E193E16E03A42B84A35D5
SHA-256:	65BAEC431EE2C4A568A8025FA3A776C38B26DF55D3D0A14212A6C38183B5CA3C
SHA-512:	CD165A3A2CCE09FD6ECD77322D589F69FB34ECC797E2348629DF654CA2B533457AA04FA6FDDCF1451F3531BEBF5D20F18B2BB7D80492EAED8497FAB8E7F97933
Malicious:	false
Preview:	.h.o.V..$9..L.]..........]o...$.-.VW.g.......:.:.....'.."B..G.....x.(t..=+....P.t)O......+H.7...`.m.w..s.?..X...K.....2..Us9...........`..;9.Re.k.k..f..C.u2.S.H..D...a...JFw..u..@.W...%..P....Z]-.m.q.........4..\5y...X..c.6.me...C.6.K.....rY.h.oH.......[..0.m..D..hU{.@l.$....S".C..3...&h.o.].A .C......s.k..s.hm...O......G.ob`..Y..+....j.d....Fc...$B.{.....-$._.....].H....]...g....#...."........Cm.-..M.....6....;....`.(}.q.R.]..J....js.X.....Ze>..$iA.%bB}rDQ.tzs.,..&..l.......^K...Oz....=1].[.jd.......n,...0.7.F.!..F....,...RP.\yS.c+.....:..d........x._&.Y..57B`..o....e....3.V..D..tKp..d...w.P.j[...5..-..m...;.\y....q.W4Wz..7v0....K......x....I....E>q..........2.i$I..g....b.....a...z.y......L.=.W6&.IX./J\..i.Z.As....~.&#.V....;..fC...H7..>.U.........e..9m....}......W.W..h....+.f..(i.m@5....k....q2.F.D.7...BCX...?ZE...$B...F.d...h.%.4.b..p.:...1.u....gr=.......B@..5swUp.....SRY..e.VC w..g...3...dT.'....1<?\|..K!(.{x....q.I..........' .

C:\Users\user\Documents\BPMLNOBVSB.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.867951059095531
Encrypted:	false
SSDEEP:	48:shpPaZxcDzNjLs6Bo1F9b9whubpOgYTJzu71C7szdXCp:dkzN3sN1Db2husg6pqWszd+
MD5:	D8EA8BDD0D0045F8E3EF46575FAC596D
SHA1:	AF5B61FC575AD39DC13E193E16E03A42B84A35D5
SHA-256:	65BAEC431EE2C4A568A8025FA3A776C38B26DF55D3D0A14212A6C38183B5CA3C
SHA-512:	CD165A3A2CCE09FD6ECD77322D589F69FB34ECC797E2348629DF654CA2B533457AA04FA6FDDCF1451F3531BEBF5D20F18B2BB7D80492EAED8497FAB8E7F97933
Malicious:	false
Preview:	.h.o.V..$9..L.]..........]o...$.-.VW.g.......:.:.....'.."B..G.....x.(t..=+....P.t)O......+H.7...`.m.w..s.?..X...K.....2..Us9...........`..;9.Re.k.k..f..C.u2.S.H..D...a...JFw..u..@.W...%..P....Z]-.m.q.........4..\5y...X..c.6.me...C.6.K.....rY.h.oH.......[..0.m..D..hU{.@l.$....S".C..3...&h.o.].A .C......s.k..s.hm...O......G.ob`..Y..+....j.d....Fc...$B.{.....-$._.....].H....]...g....#...."........Cm.-..M.....6....;....`.(}.q.R.]..J....js.X.....Ze>..$iA.%bB}rDQ.tzs.,..&..l.......^K...Oz....=1].[.jd.......n,...0.7.F.!..F....,...RP.\yS.c+.....:..d........x._&.Y..57B`..o....e....3.V..D..tKp..d...w.P.j[...5..-..m...;.\y....q.W4Wz..7v0....K......x....I....E>q..........2.i$I..g....b.....a...z.y......L.=.W6&.IX./J\..i.Z.As....~.&#.V....;..fC...H7..>.U.........e..9m....}......W.W..h....+.f..(i.m@5....k....q2.F.D.7...BCX...?ZE...$B...F.d...h.%.4.b..p.:...1.u....gr=.......B@..5swUp.....SRY..e.VC w..g...3...dT.'....1<?\|..K!(.{x....q.I..........' .

C:\Users\user\Documents\BPMLNOBVSB.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8617160835712365
Encrypted:	false
SSDEEP:	24:fSr3u+qlt4YHAI0TreEUzQyDATZMyGZf291y4TuMk1YO8MfjdkQlEKgnRdWFIe:fSr3upkneZ/DGidYXqMOYUmQL2EFIe
MD5:	4DDCDCD8D4616EE21F1532BD0C1EEE21
SHA1:	CFC0D3098139AE8A934CCF3CA7C2CFC22E42E7DB
SHA-256:	E682B1068BC2F8FBEBF7CD946378630F57DB2639728B5D13DB3773A59DFE7575
SHA-512:	89EB3A17DF02A71D6E6065FDD37C56C154504F2E17B431AD632C855BB91622584778A82A7EBDB8EA39E1857C4CFAFF79256BC9A64D60CCA99C1D1739F5018E7E
Malicious:	false
Preview:	.U .....x-..../........tu8B..._......1.%E.P8..t..........Yp.....H.x...:B...+H...y..q.;\|.l;..T.#...B...sJ)(T..;~.U..'_..Msm....d.t.s.]..1e.Hfs..b ........9nk$...f....la.$.6.+..y.8}..?...x7.r..c....>`iv.q9q<..\|........\...9.....).8}...>o1..v..G=..#K..u?..>.4...G..R.........'&.2:..0D-.U....4..v...^..p..>.>.L./\....c\|)..]/.........+F.....Y...;.A.{j?}u...Z9..#"...._(.xO...m...O..x_.....:.8.(..'\....[..^.S..>Ex..4..pl......HTa.i..b..1....d._..)...VR..u......!...$.BHw...H..(.......]H..k.r...Y&...}.;$............E...J...m.`.Y...3F..3......?(..i.........s...@...........\|....xf..ev.I.$..ur........w......X.E.K....P.nQ9..eUD.(...F&\|.#.S7..C.(...J'.). .....Y..SC.._.].A.+R........h....)@.M...........8.DO...n?.rq.i........(.....c.e.....g......-~]_...V.#..?.. \|.y.@>.....S.fu..@+.......lZ..f./.R.l...M.S.....`.l.w........5..!M......H.\eW....m..Ne....Gi......P...N.$....A?.......Z..ce........J..s.U...3.......t'F.Y$.....?..=..48e.D#;KO......

C:\Users\user\Documents\BPMLNOBVSB.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8617160835712365
Encrypted:	false
SSDEEP:	24:fSr3u+qlt4YHAI0TreEUzQyDATZMyGZf291y4TuMk1YO8MfjdkQlEKgnRdWFIe:fSr3upkneZ/DGidYXqMOYUmQL2EFIe
MD5:	4DDCDCD8D4616EE21F1532BD0C1EEE21
SHA1:	CFC0D3098139AE8A934CCF3CA7C2CFC22E42E7DB
SHA-256:	E682B1068BC2F8FBEBF7CD946378630F57DB2639728B5D13DB3773A59DFE7575
SHA-512:	89EB3A17DF02A71D6E6065FDD37C56C154504F2E17B431AD632C855BB91622584778A82A7EBDB8EA39E1857C4CFAFF79256BC9A64D60CCA99C1D1739F5018E7E
Malicious:	false
Preview:	.U .....x-..../........tu8B..._......1.%E.P8..t..........Yp.....H.x...:B...+H...y..q.;\|.l;..T.#...B...sJ)(T..;~.U..'_..Msm....d.t.s.]..1e.Hfs..b ........9nk$...f....la.$.6.+..y.8}..?...x7.r..c....>`iv.q9q<..\|........\...9.....).8}...>o1..v..G=..#K..u?..>.4...G..R.........'&.2:..0D-.U....4..v...^..p..>.>.L./\....c\|)..]/.........+F.....Y...;.A.{j?}u...Z9..#"...._(.xO...m...O..x_.....:.8.(..'\....[..^.S..>Ex..4..pl......HTa.i..b..1....d._..)...VR..u......!...$.BHw...H..(.......]H..k.r...Y&...}.;$............E...J...m.`.Y...3F..3......?(..i.........s...@...........\|....xf..ev.I.$..ur........w......X.E.K....P.nQ9..eUD.(...F&\|.#.S7..C.(...J'.). .....Y..SC.._.].A.+R........h....)@.M...........8.DO...n?.rq.i........(.....c.e.....g......-~]_...V.#..?.. \|.y.@>.....S.fu..@+.......lZ..f./.R.l...M.S.....`.l.w........5..!M......H.\eW....m..Ne....Gi......P...N.$....A?.......Z..ce........J..s.U...3.......t'F.Y$.....?..=..48e.D#;KO......

C:\Users\user\Documents\BPMLNOBVSB\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.857085318926333
Encrypted:	false
SSDEEP:	48:yWipnDeFH3XBZGaczsIZ3tAVsl/EBR2qxy3:d0nDepR4ac4+/EBR2qA3
MD5:	416E84F404232B1C3A4BC350CDA30C68
SHA1:	A50084C8A7FE34CC2D3DED49242EBEA87FA66D60
SHA-256:	CF632F6DB5F7585F5FF883A6AC845865CB9C415F43647598E7FB36C88B89B74D
SHA-512:	E01C42D582AFF3BBE9AAAF8CE850F0750E03EF8E75750CBE15620C7018B7BDDCD2D45C370B8DFAB235FD63884D2ED82883BF2734B995ED84CC80B7747714C0A4
Malicious:	false
Preview:	p"..QFl.rM......0.!..6..A.5o.u....k.....9..M+VC......-.)!....F.}.)DI..o..Aj4^d..FUoI..u..............#..l.SoyQ...N.....&c...j.9....j.>.Z..u....~..Ge.k.\..S>fHC......E..7..{.....KtC....F+b>.OA..<....5\..`..........hQ.....=.or..t._..V{...1Fy.tI.{..Q..\......s.M2.m\'.....?.x&.,._.g.ocK]..=.....{r.=T`0.......t.a.."..'..w.....gn?p...W.[..p....Y.sG.).L.......?w._.....I...&lsel...tcZj..<.O..s.;.....=."..../{...C...\|+.:A....H.C..H..#....J...=.u....Xhx.....I......M...(...]....n........bFW/...09.....4......X..r3...O...O^..<.E;.^.N=f..e.\..O....+'..&.^.r.9.)..7..(.+...?......?...Y/..s.)#.F..9...p..4(.....4._.. .#......&".l.c .ia1..U.J.=..%...`.1.....D..........v.Yt.$J"#.}...Q..p..eQko...).]x3.i. 5/....[..!.#E...t.q...o..\...y....E..5.V.[3v.......j.w@.o:p...Ee...O.l.U........4[.].k.Z.............BG......".qb3&..tD.'..!$s....?!`.7. .....>..5v3[....q~....~......E.(j...@..i.r.xn..G.{.}...D,J.aCT.k.!.sC).g.....X...gx.=...;.7..@...r ...m...Z......S..gO`.t

C:\Users\user\Documents\BPMLNOBVSB\BPMLNOBVSB.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.857085318926333
Encrypted:	false
SSDEEP:	48:yWipnDeFH3XBZGaczsIZ3tAVsl/EBR2qxy3:d0nDepR4ac4+/EBR2qA3
MD5:	416E84F404232B1C3A4BC350CDA30C68
SHA1:	A50084C8A7FE34CC2D3DED49242EBEA87FA66D60
SHA-256:	CF632F6DB5F7585F5FF883A6AC845865CB9C415F43647598E7FB36C88B89B74D
SHA-512:	E01C42D582AFF3BBE9AAAF8CE850F0750E03EF8E75750CBE15620C7018B7BDDCD2D45C370B8DFAB235FD63884D2ED82883BF2734B995ED84CC80B7747714C0A4
Malicious:	false
Preview:	p"..QFl.rM......0.!..6..A.5o.u....k.....9..M+VC......-.)!....F.}.)DI..o..Aj4^d..FUoI..u..............#..l.SoyQ...N.....&c...j.9....j.>.Z..u....~..Ge.k.\..S>fHC......E..7..{.....KtC....F+b>.OA..<....5\..`..........hQ.....=.or..t._..V{...1Fy.tI.{..Q..\......s.M2.m\'.....?.x&.,._.g.ocK]..=.....{r.=T`0.......t.a.."..'..w.....gn?p...W.[..p....Y.sG.).L.......?w._.....I...&lsel...tcZj..<.O..s.;.....=."..../{...C...\|+.:A....H.C..H..#....J...=.u....Xhx.....I......M...(...]....n........bFW/...09.....4......X..r3...O...O^..<.E;.^.N=f..e.\..O....+'..&.^.r.9.)..7..(.+...?......?...Y/..s.)#.F..9...p..4(.....4._.. .#......&".l.c .ia1..U.J.=..%...`.1.....D..........v.Yt.$J"#.}...Q..p..eQko...).]x3.i. 5/....[..!.#E...t.q...o..\...y....E..5.V.[3v.......j.w@.o:p...Ee...O.l.U........4[.].k.Z.............BG......".qb3&..tD.'..!$s....?!`.7. .....>..5v3[....q~....~......E.(j...@..i.r.xn..G.{.}...D,J.aCT.k.!.sC).g.....X...gx.=...;.7..@...r ...m...Z......S..gO`.t

C:\Users\user\Documents\BPMLNOBVSB\FENIVHOIKN.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.872743839121471
Encrypted:	false
SSDEEP:	48:NHgsFYk485sRRnQeZ43XsVtoVydDytXAxiFe:JgGYkr5yl6XKtoYVyNAxd
MD5:	F4539D4EF14C76C9645B3EFD4F734312
SHA1:	E7628A31BEC62668C29F7B82EAAE983F34E8B55B
SHA-256:	3276A00005F427AC997D2511A8CC40FEE0AACC33E75EDA94C8F003C7CF20C4BB
SHA-512:	5213A7C4FF86FC263C7539731365623FE46C5A2EBB9655354F3DB7A1330B435DD9F2797FCB0E9740961DC8275318D6E0EA7B5185CB1649E579A84A81CD192B90
Malicious:	false
Preview:	7e.w.....B....n..:..49..&.H..b..F..j.}.VN..%....4............W.GTR...!....x..Q......TR."...D..(..VF.W.A...m...{...w..mlB../6...G.o.=r.%.W(6.J.)<...Cuu.E.bc..]....j....].Q)..-.^.B..y..a...>.....n..,......fB...a.:8..;.......Z...3.C..c%..{.......i...W.4i?t_....3..RN\|Q.2......"D....v..x...B.....H.54!.o..i...e.T:....3.@.-....r.V...}.Z).\..d..../..I._.O...i1...XH...b"..f..!.&..iL....../..6....if..1%...uB;6......H.SL....73..p....!.....B=.!..U....1..+..R.2ei.?..NM,.p.-..e\|...3....G..6>..'.....v..s.,..2h7.......(d.",.B.$m.v........?.....^.L.v....U..Q....L..2vC..~k...e...+....E...Z.',jkl..$".=....`..3w....i\|.hqm.p...@.ok<a..'>s...Z..}......&!.B2VA2R..Nd.:.@.tT%P.....b...,.g.22.ZZ3.P2...I...7.1)~..6.g.I.l.B...Js.w0....bb..Z.&.)w.ll.......q.,<.!....m@......:..eO0...:....I..?..H.o...(......c..{..X.R..\*..+.+.d....({t\|........E.QK.:.:+..kMZ.P..T...R..p.....W.,\|j....?:h.Zj.Oh...._m6..pos...mX..H.Gm.c$=.T8.g:.!`....V..9.........2..X!.A...7` ...8.a....

C:\Users\user\Documents\BPMLNOBVSB\FENIVHOIKN.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.872743839121471
Encrypted:	false
SSDEEP:	48:NHgsFYk485sRRnQeZ43XsVtoVydDytXAxiFe:JgGYkr5yl6XKtoYVyNAxd
MD5:	F4539D4EF14C76C9645B3EFD4F734312
SHA1:	E7628A31BEC62668C29F7B82EAAE983F34E8B55B
SHA-256:	3276A00005F427AC997D2511A8CC40FEE0AACC33E75EDA94C8F003C7CF20C4BB
SHA-512:	5213A7C4FF86FC263C7539731365623FE46C5A2EBB9655354F3DB7A1330B435DD9F2797FCB0E9740961DC8275318D6E0EA7B5185CB1649E579A84A81CD192B90
Malicious:	false
Preview:	7e.w.....B....n..:..49..&.H..b..F..j.}.VN..%....4............W.GTR...!....x..Q......TR."...D..(..VF.W.A...m...{...w..mlB../6...G.o.=r.%.W(6.J.)<...Cuu.E.bc..]....j....].Q)..-.^.B..y..a...>.....n..,......fB...a.:8..;.......Z...3.C..c%..{.......i...W.4i?t_....3..RN\|Q.2......"D....v..x...B.....H.54!.o..i...e.T:....3.@.-....r.V...}.Z).\..d..../..I._.O...i1...XH...b"..f..!.&..iL....../..6....if..1%...uB;6......H.SL....73..p....!.....B=.!..U....1..+..R.2ei.?..NM,.p.-..e\|...3....G..6>..'.....v..s.,..2h7.......(d.",.B.$m.v........?.....^.L.v....U..Q....L..2vC..~k...e...+....E...Z.',jkl..$".=....`..3w....i\|.hqm.p...@.ok<a..'>s...Z..}......&!.B2VA2R..Nd.:.@.tT%P.....b...,.g.22.ZZ3.P2...I...7.1)~..6.g.I.l.B...Js.w0....bb..Z.&.)w.ll.......q.,<.!....m@......:..eO0...:....I..?..H.o...(......c..{..X.R..\*..+.+.d....({t\|........E.QK.:.:+..kMZ.P..T...R..p.....W.,\|j....?:h.Zj.Oh...._m6..pos...mX..H.Gm.c$=.T8.g:.!`....V..9.........2..X!.A...7` ...8.a....

C:\Users\user\Documents\BPMLNOBVSB\SFPUSAFIOL.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8717425384417075
Encrypted:	false
SSDEEP:	48:uXVC7QgGXflfZT9Uke9X2ih/tWshL9T2mHzd0:usQgGXflf8kKX2W/tW4T2mTd0
MD5:	2136B900FAC70938C1219B3E1916E774
SHA1:	1AB6933FBCEBBE34A0457BA89611AB370315B5F6
SHA-256:	6869F318E470E094C0C5AE3F78038169631ABED9EB0C8A7B17490DE3C246169D
SHA-512:	846BF83D317BD6C82083FFD871ECE7EA406ACC7B745AAA3AEB53F23FF1529E3A6B3D2026BC5F30A2C72E98F1DADF5D94C87928AFE7CCE0BCCEF4EA1A88FDF3FF
Malicious:	false
Preview:	(...6f6......P....1>...}.Ax..%...R...$.=...:}/.....N...z9..u.}...%h..b.U..?..rw......@(..`.H..Z..5.....A.a.q.F..\..;......n..26.v.....i...X..P.4..zU...E2.R.1w...].0M5...[...%v..?......C.y...[ Nv.x#!..ka.g...B....R..2_....l...4@6....L.<K.D....{......?....{..v.p.Vrf...G.I.....-.B....}.+., ......~W-@.....}.[u9c..(.....id...az.....oW......>..Y&<..78....U.6.m...Q.G.F.....E.Qes.7w.O,....l}...{.S.-D.U.....S]..t.?.....L.l..}.n..<.H..[.a..p.D 4..bm.......U..J....i........-\|...1......8......% .`!2{.m..\|M..J).@O.S.Q...."..U]..H..+..b.._%..H.F...-......O.. .i..G...o" H.h..q.<...........?.7..]wA..lW.\..h........d.s4./2r../..}.qh.......L...".F.?.N..E../4.Dn.......Yf.....`...!.$.U].. 8.y..ZRZ..e...{...Hc.Z..9.e..w....[.......j...~\0)./.9w.?8..zI;o.a.%t(....6.`]....E....z..1.....4......B.ZS\.....<...H2....6....1X...V.v...s...?G.Zd.&H.......2^L..1tVP.....cAX.\.}.%..U5....p.}?L..hq.n.j.on..9L._.9]..X#l...l...o...g3....e.L.e..Q.)...Yn.j$?.I,..Y

C:\Users\user\Documents\BPMLNOBVSB\SFPUSAFIOL.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8717425384417075
Encrypted:	false
SSDEEP:	48:uXVC7QgGXflfZT9Uke9X2ih/tWshL9T2mHzd0:usQgGXflf8kKX2W/tW4T2mTd0
MD5:	2136B900FAC70938C1219B3E1916E774
SHA1:	1AB6933FBCEBBE34A0457BA89611AB370315B5F6
SHA-256:	6869F318E470E094C0C5AE3F78038169631ABED9EB0C8A7B17490DE3C246169D
SHA-512:	846BF83D317BD6C82083FFD871ECE7EA406ACC7B745AAA3AEB53F23FF1529E3A6B3D2026BC5F30A2C72E98F1DADF5D94C87928AFE7CCE0BCCEF4EA1A88FDF3FF
Malicious:	false
Preview:	(...6f6......P....1>...}.Ax..%...R...$.=...:}/.....N...z9..u.}...%h..b.U..?..rw......@(..`.H..Z..5.....A.a.q.F..\..;......n..26.v.....i...X..P.4..zU...E2.R.1w...].0M5...[...%v..?......C.y...[ Nv.x#!..ka.g...B....R..2_....l...4@6....L.<K.D....{......?....{..v.p.Vrf...G.I.....-.B....}.+., ......~W-@.....}.[u9c..(.....id...az.....oW......>..Y&<..78....U.6.m...Q.G.F.....E.Qes.7w.O,....l}...{.S.-D.U.....S]..t.?.....L.l..}.n..<.H..[.a..p.D 4..bm.......U..J....i........-\|...1......8......% .`!2{.m..\|M..J).@O.S.Q...."..U]..H..+..b.._%..H.F...-......O.. .i..G...o" H.h..q.<...........?.7..]wA..lW.\..h........d.s4./2r../..}.qh.......L...".F.?.N..E../4.Dn.......Yf.....`...!.$.U].. 8.y..ZRZ..e...{...Hc.Z..9.e..w....[.......j...~\0)./.9w.?8..zI;o.a.%t(....6.`]....E....z..1.....4......B.ZS\.....<...H2....6....1X...V.v...s...?G.Zd.&H.......2^L..1tVP.....cAX.\.}.%..U5....p.}?L..hq.n.j.on..9L._.9]..X#l...l...o...g3....e.L.e..Q.)...Yn.j$?.I,..Y

C:\Users\user\Documents\BPMLNOBVSB\UOOJJOZIRH.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.875994961608378
Encrypted:	false
SSDEEP:	24:mvpYszXeOcfadPxpqafLJLiLzg20sNFozmrVlNgSsDDELs4+BWo+uLJuCWe:EzcQxAAL+g2djo6Jve0s4+l+1CWe
MD5:	3622050F7EBEBB604362099BA9829A79
SHA1:	61B17977AFAAE799DADEDDAD80021BA768641317
SHA-256:	D2E98AE131B4094B062E7D0E943B05E17116E64278814D0D0DC59A108BED11D8
SHA-512:	5C4A10C451CBD17143780016729980D2EF164F81E0E5413FD612F5A9979F64D1D07ADEA8DBFDA2E06C142D117DEEDE5E089BBC363A02AF0295ED6FCE8ABC9708
Malicious:	false
Preview:	.>.w...6.E.c.m_...~.&...!'..P.t.4.M..,.'..~n&..R..J...:......&._.-C2...dM..S.1\bG.k..P....`....`.......g.4.{`....u....,....&..oM9.6.......7....T...U.....H.M..B...cc$...V3.5.vOh.....F.4^.'Lb.;.%.lU..c.d..P.8Yf..)Y....Sk<>...=.w.....uh..o.p....<Z+p...2.MY/o.1.3..... .r}k...S(&....N..@S.i.N."I7;$5.ID...F.......5m.w...\..7..5.qdq...\RQg..A.....&9.6...Rx-oE....\|.9...p.Uk3...]...z.ie....j...Y.wA....._.-$..]xLh.W..s;...3...w...:....f.j....k...I.O...(0.Gs....p\.gRA....%.CV.Hp.4....G...U.b.^....;.d..MVH..%...).H65"..xQ...-c\|...C...Y..=..w@~i..L..[.F...u7...F.7E...B..e....O...8.5<3.0.ZC..9..(..dS.$o. ..(w.....:....h-t^.W..#D...lR..qf......Q..$...U`..c3..~7X.O...1e...4..zW.Y...&8...pS(..+.4BlL.-.....n..Oq.WD.K^AJ..z..?..w....r...<,JJ.(.4Qu.`...r..;.Mk4.?..T0..M..n...2.X..9#{.......k...hV...ya.....4.....I{...5......t.z...HIBv....Y..^.7............d.R..X......Ds.E.7..h;.-&F..6ybbI.0.........80......N.P.`..X.\....6....6.....<.D8....xb.........

C:\Users\user\Documents\BPMLNOBVSB\UOOJJOZIRH.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.875994961608378
Encrypted:	false
SSDEEP:	24:mvpYszXeOcfadPxpqafLJLiLzg20sNFozmrVlNgSsDDELs4+BWo+uLJuCWe:EzcQxAAL+g2djo6Jve0s4+l+1CWe
MD5:	3622050F7EBEBB604362099BA9829A79
SHA1:	61B17977AFAAE799DADEDDAD80021BA768641317
SHA-256:	D2E98AE131B4094B062E7D0E943B05E17116E64278814D0D0DC59A108BED11D8
SHA-512:	5C4A10C451CBD17143780016729980D2EF164F81E0E5413FD612F5A9979F64D1D07ADEA8DBFDA2E06C142D117DEEDE5E089BBC363A02AF0295ED6FCE8ABC9708
Malicious:	false
Preview:	.>.w...6.E.c.m_...~.&...!'..P.t.4.M..,.'..~n&..R..J...:......&._.-C2...dM..S.1\bG.k..P....`....`.......g.4.{`....u....,....&..oM9.6.......7....T...U.....H.M..B...cc$...V3.5.vOh.....F.4^.'Lb.;.%.lU..c.d..P.8Yf..)Y....Sk<>...=.w.....uh..o.p....<Z+p...2.MY/o.1.3..... .r}k...S(&....N..@S.i.N."I7;$5.ID...F.......5m.w...\..7..5.qdq...\RQg..A.....&9.6...Rx-oE....\|.9...p.Uk3...]...z.ie....j...Y.wA....._.-$..]xLh.W..s;...3...w...:....f.j....k...I.O...(0.Gs....p\.gRA....%.CV.Hp.4....G...U.b.^....;.d..MVH..%...).H65"..xQ...-c\|...C...Y..=..w@~i..L..[.F...u7...F.7E...B..e....O...8.5<3.0.ZC..9..(..dS.$o. ..(w.....:....h-t^.W..#D...lR..qf......Q..$...U`..c3..~7X.O...1e...4..zW.Y...&8...pS(..+.4BlL.-.....n..Oq.WD.K^AJ..z..?..w....r...<,JJ.(.4Qu.`...r..;.Mk4.?..T0..M..n...2.X..9#{.......k...hV...ya.....4.....I{...5......t.z...HIBv....Y..^.7............d.R..X......Ds.E.7..h;.-&F..6ybbI.0.........80......N.P.`..X.\....6....6.....<.D8....xb.........

C:\Users\user\Documents\BPMLNOBVSB\VAMYDFPUND.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.862009506774409
Encrypted:	false
SSDEEP:	24:r5ivixeJC1vlTO2YW1foYCcTpEFWBz1CH45jXG0uJ6TTcVdESKsFM8ypGmA3+eSe:r5Giz7/sYCcGgBz18C2BVvTypTA5
MD5:	538F9C39D4FF15E5C3F5A015C898113D
SHA1:	FB8132A65077768DB9D38876014FAAC9C4EF03D4
SHA-256:	1B102FD56164BC9DCE13B9BF0AD5E9AFC0736F8843869CB2CBBE44B08A0FE26D
SHA-512:	77B73A20F0327807CB142F2A09792432BCA27D5F7E4BA4CFCBFD1B525FD5B948A8C79F57FDB163D40E9A0C4142053E8A4110AA3CE672A7D0F61340B9E04FD26D
Malicious:	false
Preview:	...v.wA...\|hJ.j.M...2\|..^...D...<....l..!BvLup.v..!G.....J.....v...M.?.Vm.%:.{.^.^.C......p<....{l.....7...l$.e....._.....\,....)#G...&.s......aK../....&#......w..u...zP..ZH.Z...Jn.%...........&l..s3{...Us..Y/`...._.G.&..6}.....U..P.v....g...C.$.W..D..&.^@P.q...3u...`...Dn&.U...x....O.+W.p....^...'.iV...4.G.....3PBqp.........v.Y..w.cw..O(.a4..Z..MFW...N<.\.y<M.7.XH...2......I...m....R...$9.2{....1..i...m...O?.tj y.....p..n.e...UY...N...m..v,.....L..I.I...6.d...1.F.......uy.`....7.*...G....b (][&..Y..fm......x.....1<.\|....sO.-v.T..y...'.s.q.....DSh.)gM...t yD38..k..w.-..2.....\|.C.../......F$G......Yz..)...2...$$...cB....J.?...F.^&.D.i.S...z..{.yqi;V..6...{...N-n.....7t...<.p@}.[..r........ .........j....D/5...@(}^._6X{.....%.."...?.C._^_.Y\.=..\|Y{.6u.\|..&.......k.+.......{.W..aS.8NC........g..c:?os.C.W2..6.:NU...{2...N^...o....u....!.Pu.13.6.~.....X.X....1.s8..-.......mAlF......9./.f...8../]..7Tyv.U..?....R.....Q..U.Q....R.

C:\Users\user\Documents\BPMLNOBVSB\VAMYDFPUND.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.862009506774409
Encrypted:	false
SSDEEP:	24:r5ivixeJC1vlTO2YW1foYCcTpEFWBz1CH45jXG0uJ6TTcVdESKsFM8ypGmA3+eSe:r5Giz7/sYCcGgBz18C2BVvTypTA5
MD5:	538F9C39D4FF15E5C3F5A015C898113D
SHA1:	FB8132A65077768DB9D38876014FAAC9C4EF03D4
SHA-256:	1B102FD56164BC9DCE13B9BF0AD5E9AFC0736F8843869CB2CBBE44B08A0FE26D
SHA-512:	77B73A20F0327807CB142F2A09792432BCA27D5F7E4BA4CFCBFD1B525FD5B948A8C79F57FDB163D40E9A0C4142053E8A4110AA3CE672A7D0F61340B9E04FD26D
Malicious:	false
Preview:	...v.wA...\|hJ.j.M...2\|..^...D...<....l..!BvLup.v..!G.....J.....v...M.?.Vm.%:.{.^.^.C......p<....{l.....7...l$.e....._.....\,....)#G...&.s......aK../....&#......w..u...zP..ZH.Z...Jn.%...........&l..s3{...Us..Y/`...._.G.&..6}.....U..P.v....g...C.$.W..D..&.^@P.q...3u...`...Dn&.U...x....O.+W.p....^...'.iV...4.G.....3PBqp.........v.Y..w.cw..O(.a4..Z..MFW...N<.\.y<M.7.XH...2......I...m....R...$9.2{....1..i...m...O?.tj y.....p..n.e...UY...N...m..v,.....L..I.I...6.d...1.F.......uy.`....7.*...G....b (][&..Y..fm......x.....1<.\|....sO.-v.T..y...'.s.q.....DSh.)gM...t yD38..k..w.-..2.....\|.C.../......F$G......Yz..)...2...$$...cB....J.?...F.^&.D.i.S...z..{.yqi;V..6...{...N-n.....7t...<.p@}.[..r........ .........j....D/5...@(}^._6X{.....%.."...?.C._^_.Y\.=..\|Y{.6u.\|..&.......k.+.......{.W..aS.8NC........g..c:?os.C.W2..6.:NU...{2...N^...o....u....!.Pu.13.6.~.....X.X....1.s8..-.......mAlF......9./.f...8../]..7Tyv.U..?....R.....Q..U.Q....R.

C:\Users\user\Documents\BPMLNOBVSB\WKXEWIOTXI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.860987030083488
Encrypted:	false
SSDEEP:	24:AzYauJh8iwcibbWfidzg2Ukvh4IH3E+F0eBDbN3ejmlnrhj02p5O5ne2vGlUnueO:AUakETbkeLvNienNOjshj0ncJT5+1hm1
MD5:	D78B1EFEBBA7B960F9638DF511FD0EE6
SHA1:	3340CC82ECA81066AADABC26DEAAA53D3FEB534B
SHA-256:	9F18194403FF98DDBA0B78ECC8CD285C7E7607487B33A1BC4EBD18FA0D9EE247
SHA-512:	D2F6C5E87F0907F19155DD2BF0FB8E086A3BDED74FB6FC9300B9A2BFD6D267DA46F8C455E09D0EAD140FC31DCDB5FECBB0744ECA7EED799E9D54CC7A97A9B8E2
Malicious:	false
Preview:	..X..M..TE....>+.s.e..!'...S..X..<N...3\|}..~......x.C.">v......-.....H..w...k.[..<.....BZ..3;Uxr(vs....I.yc..&QQ.h.......C.o..^.-.W.Gk..3. ...#.G.kw:.8..{0....Zdj2....$F!.F .7...\IY..YQ.....}.Y...MN....w...O.>.6.....;...0....0>.....J<j....oX..#..w6H..O#.qYlIu.$..h....k...Y.....ng.@.h...R..S..<<.....s../f......D,..F.....hl......C.T.o..(.a.w....g..........,f".a.....%\..<..3.....c..E..&~.[..Sg....).i..w..".+s....I.s..~.@.\.....z.d.....B.$........PD.u2n...(0j..rD...=..a..5.}...GH..Q.%tg....+[......,....u#X..p.\...M.\|.8.Z.f6.k..............4#RA...3...k....S.,....V....V.. ..HR..4v'....M.A.>..............2$...`*y.......@C...h..f.ETLB.v..i.. ..-.d.4..4DUXx=.0...W7.zJ.Y...e..L.....&)X...q..E.y.aTa.l..H...X...G0_......a.b..Y&1.B...`f.vsT..k..2`...,..9J.P0pSV......].#l@D.#.a.g..t$c....!...xRI..7...<.p.E. .UF.%.4.&.."G[....X..y.F..!.....}...^N....=..8....r5....D.....k3....]I.......C.%.`....?.....d.1].@.h...g..'..L......w...[....".R.G.K_?..36.yR.......l

C:\Users\user\Documents\BPMLNOBVSB\WKXEWIOTXI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.860987030083488
Encrypted:	false
SSDEEP:	24:AzYauJh8iwcibbWfidzg2Ukvh4IH3E+F0eBDbN3ejmlnrhj02p5O5ne2vGlUnueO:AUakETbkeLvNienNOjshj0ncJT5+1hm1
MD5:	D78B1EFEBBA7B960F9638DF511FD0EE6
SHA1:	3340CC82ECA81066AADABC26DEAAA53D3FEB534B
SHA-256:	9F18194403FF98DDBA0B78ECC8CD285C7E7607487B33A1BC4EBD18FA0D9EE247
SHA-512:	D2F6C5E87F0907F19155DD2BF0FB8E086A3BDED74FB6FC9300B9A2BFD6D267DA46F8C455E09D0EAD140FC31DCDB5FECBB0744ECA7EED799E9D54CC7A97A9B8E2
Malicious:	false
Preview:	..X..M..TE....>+.s.e..!'...S..X..<N...3\|}..~......x.C.">v......-.....H..w...k.[..<.....BZ..3;Uxr(vs....I.yc..&QQ.h.......C.o..^.-.W.Gk..3. ...#.G.kw:.8..{0....Zdj2....$F!.F .7...\IY..YQ.....}.Y...MN....w...O.>.6.....;...0....0>.....J<j....oX..#..w6H..O#.qYlIu.$..h....k...Y.....ng.@.h...R..S..<<.....s../f......D,..F.....hl......C.T.o..(.a.w....g..........,f".a.....%\..<..3.....c..E..&~.[..Sg....).i..w..".+s....I.s..~.@.\.....z.d.....B.$........PD.u2n...(0j..rD...=..a..5.}...GH..Q.%tg....+[......,....u#X..p.\...M.\|.8.Z.f6.k..............4#RA...3...k....S.,....V....V.. ..HR..4v'....M.A.>..............2$...`*y.......@C...h..f.ETLB.v..i.. ..-.d.4..4DUXx=.0...W7.zJ.Y...e..L.....&)X...q..E.y.aTa.l..H...X...G0_......a.b..Y&1.B...`f.vsT..k..2`...,..9J.P0pSV......].#l@D.#.a.g..t$c....!...xRI..7...<.p.E. .UF.%.4.&.."G[....X..y.F..!.....}...^N....=..8....r5....D.....k3....]I.......C.%.`....?.....d.1].@.h...g..'..L......w...[....".R.G.K_?..36.yR.......l

C:\Users\user\Documents\BPMLNOBVSB\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Documents\CURQNKVOIX.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.867259877492837
Encrypted:	false
SSDEEP:	48:atnpjHOE/q8PhaePUxBF8Fa6WKWr3bM6p31CmqGADm3lgIW:afJ/q8PD/GKWr3bB1CWAhP
MD5:	6B5BA40BECE2DB95388B853350F956D8
SHA1:	818C0E1040ACE54B8930C55EAD58FE496723D05C
SHA-256:	CB6CF75BA0BCC35C9103FC5557CCF607A4428214D3B83074362B75C9C3BCD19D
SHA-512:	5FC8530AD21295C834DED49F2A0187B5FA4FD5839CE63BD958F851BB22A0FEA0BE465EE5726767983A0932FD62D1C4DB5440FE1E52F6A13524B0EF9AAA91B947
Malicious:	false
Preview:	.1.t....)a.......K.!0.0.r.X{.`....N......l..:...i...%........$....u..o._...F]...'.,..l.<.....NpBD...r.....[........xbw...?j).4R.P.>........e4^.x.V..v...]#.67]...o~]....T.....a....-o..yJ...h.x..Bv..-..N.mt.....5[..I.%...X.W........{S1.w.^KHA..!.J..^?;..:w.Th...GRG...Rn<oG@..$54..7..C.D.{.n...VZ.. m.....I...I.}.b......L...Px..,@1..&..].{..;(....f...a ....k8..Pm8..aG.'t..[.W...mu...y....<[..-.....0...>.......8...<.}.f..e....<...j.h....)...q7b;:.4...#..:/..uf.1$........@..P......?MZR.#tGZ]3S...=QDi.X....e...b'A..m%:.9...F.......X....a..t...y....&.G..__,...\|^7.....T.7.8.^F.(xX.1.G...$..&.....z..<RcV. ..0....=..w...F..z.p....`_&...?q.fd.R.GAPf.A..m.....U$.-..}-...O..O..D...XX.K..A{..=.".Q...D..6J.$@}...x.;...T......3.7.%...m...9.;....zm...2.uMe!.-.8Sw.1..R@.:...l@.Q*.{9#mZg\ypRa}...-.[.A..F.`.{t.%v.B/TStm,..g.......}m....V...@..a.AM...19.......\....Q:..X.6LLjUT.#...z.^.7?....d.A....^\|....8f.PT.{p?Z..s.EY.t.1/tz..e!.e7....-;..e..e...).......

C:\Users\user\Documents\CURQNKVOIX.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.867259877492837
Encrypted:	false
SSDEEP:	48:atnpjHOE/q8PhaePUxBF8Fa6WKWr3bM6p31CmqGADm3lgIW:afJ/q8PD/GKWr3bB1CWAhP
MD5:	6B5BA40BECE2DB95388B853350F956D8
SHA1:	818C0E1040ACE54B8930C55EAD58FE496723D05C
SHA-256:	CB6CF75BA0BCC35C9103FC5557CCF607A4428214D3B83074362B75C9C3BCD19D
SHA-512:	5FC8530AD21295C834DED49F2A0187B5FA4FD5839CE63BD958F851BB22A0FEA0BE465EE5726767983A0932FD62D1C4DB5440FE1E52F6A13524B0EF9AAA91B947
Malicious:	false
Preview:	.1.t....)a.......K.!0.0.r.X{.`....N......l..:...i...%........$....u..o._...F]...'.,..l.<.....NpBD...r.....[........xbw...?j).4R.P.>........e4^.x.V..v...]#.67]...o~]....T.....a....-o..yJ...h.x..Bv..-..N.mt.....5[..I.%...X.W........{S1.w.^KHA..!.J..^?;..:w.Th...GRG...Rn<oG@..$54..7..C.D.{.n...VZ.. m.....I...I.}.b......L...Px..,@1..&..].{..;(....f...a ....k8..Pm8..aG.'t..[.W...mu...y....<[..-.....0...>.......8...<.}.f..e....<...j.h....)...q7b;:.4...#..:/..uf.1$........@..P......?MZR.#tGZ]3S...=QDi.X....e...b'A..m%:.9...F.......X....a..t...y....&.G..__,...\|^7.....T.7.8.^F.(xX.1.G...$..&.....z..<RcV. ..0....=..w...F..z.p....`_&...?q.fd.R.GAPf.A..m.....U$.-..}-...O..O..D...XX.K..A{..=.".Q...D..6J.$@}...x.;...T......3.7.%...m...9.;....zm...2.uMe!.-.8Sw.1..R@.:...l@.Q*.{9#mZg\ypRa}...-.[.A..F.`.{t.%v.B/TStm,..g.......}m....V...@..a.AM...19.......\....Q:..X.6LLjUT.#...z.^.7?....d.A....^\|....8f.PT.{p?Z..s.EY.t.1/tz..e!.e7....-;..e..e...).......

C:\Users\user\Documents\FENIVHOIKN.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8874266188902515
Encrypted:	false
SSDEEP:	24:g7xInZx0K8c7UKNF/jLfpJbJSKZbXQYXf7aPyiAejIFKBM6DUadVm:xBfFZLRVMI8yiAKKiUadY
MD5:	C01D27B18B0F64D2145FE904AB6C8F26
SHA1:	EC44018BC5DD4F1E5967843F69729BCD5C33BEF7
SHA-256:	5039A1BFEE2D2247F4B0B8F4996BF74A300DD5A81315322FD454D80966D49213
SHA-512:	7451AE61F67E0775961BC062436D96E286E0E4C40B90720EAA69189F47113E00683FC7DF83272DB38F9EE2705D75570712405A84389816A7AD049F6879DFDD4C
Malicious:	false
Preview:	..b.X......0....b3...N}F"6.#2...Z...{..#&0c,.'....F..=P...s....X....@..k....<...7~...n..8.p.../}h...v..p.c....$.!...t.5...CZ....n.$......d.>F....Z)..:...{.A..(u.gG..:KTn..g.UPM.G.!..eo..u..P:.{Z..h;8..N..CP.....'..e.>.5.A..p.'..I.[...:...6.e...S.K.s.m.Y..+?.J-...^.a.......A...CB..T.Z.L1.x.;:.W.fZ..US..:...9.."....@d."..v.......#.`....Fiw@.r.9Z.\|3%..$ ....N0.~.n...;.,.......{}..(..h.r.....$.U.g.A....`.1......q..t....,......q...\/7........jA....?n!._..g...a...1..}.qT.v...t..X.sx+?_.D.I....(..A>....W+.._..>-?..I...X.u.R.k....j.-..&.@Y.y..&..#t..,^/..f\|r..f5...U.<+...WC:3PI...d..Z....6.+.i..wf....._..+..+...`a.\HC.S....Xb4Bi"d...c..?..n.....f......An.V.&.&..7.._.Ze.. S.M....~.....Y}...t....1.6.G.v..4.U..m,.dJy.3.........4.........C\.....R.V...7.Y..%.m......w.j....5...P..D}..F............ .{........;[N.@.pY\|{....s..e1..l..$\|...j.@&0.\|@a.v...$.Z.(1...[...q\.!..........!\..4.0...4.~I...22d(..\._..I....m..H.U_B../=...r..<l$.P...Q...k.

C:\Users\user\Documents\FENIVHOIKN.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8874266188902515
Encrypted:	false
SSDEEP:	24:g7xInZx0K8c7UKNF/jLfpJbJSKZbXQYXf7aPyiAejIFKBM6DUadVm:xBfFZLRVMI8yiAKKiUadY
MD5:	C01D27B18B0F64D2145FE904AB6C8F26
SHA1:	EC44018BC5DD4F1E5967843F69729BCD5C33BEF7
SHA-256:	5039A1BFEE2D2247F4B0B8F4996BF74A300DD5A81315322FD454D80966D49213
SHA-512:	7451AE61F67E0775961BC062436D96E286E0E4C40B90720EAA69189F47113E00683FC7DF83272DB38F9EE2705D75570712405A84389816A7AD049F6879DFDD4C
Malicious:	false
Preview:	..b.X......0....b3...N}F"6.#2...Z...{..#&0c,.'....F..=P...s....X....@..k....<...7~...n..8.p.../}h...v..p.c....$.!...t.5...CZ....n.$......d.>F....Z)..:...{.A..(u.gG..:KTn..g.UPM.G.!..eo..u..P:.{Z..h;8..N..CP.....'..e.>.5.A..p.'..I.[...:...6.e...S.K.s.m.Y..+?.J-...^.a.......A...CB..T.Z.L1.x.;:.W.fZ..US..:...9.."....@d."..v.......#.`....Fiw@.r.9Z.\|3%..$ ....N0.~.n...;.,.......{}..(..h.r.....$.U.g.A....`.1......q..t....,......q...\/7........jA....?n!._..g...a...1..}.qT.v...t..X.sx+?_.D.I....(..A>....W+.._..>-?..I...X.u.R.k....j.-..&.@Y.y..&..#t..,^/..f\|r..f5...U.<+...WC:3PI...d..Z....6.+.i..wf....._..+..+...`a.\HC.S....Xb4Bi"d...c..?..n.....f......An.V.&.&..7.._.Ze.. S.M....~.....Y}...t....1.6.G.v..4.U..m,.dJy.3.........4.........C\.....R.V...7.Y..%.m......w.j....5...P..D}..F............ .{........;[N.@.pY\|{....s..e1..l..$\|...j.@&0.\|@a.v...$.Z.(1...[...q\.!..........!\..4.0...4.~I...22d(..\._..I....m..H.U_B../=...r..<l$.P...Q...k.

C:\Users\user\Documents\FENIVHOIKN.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.856056187481957
Encrypted:	false
SSDEEP:	24:2IPnZlYgO2ygG7uF+n+RhnjV2KNXVZqpMJHP09k75wyaNvMdJdeCvLcO5/Vqpi4i:2Iv3YgiDu++xx/DFFpuwiCDcO5/Uunb
MD5:	618CC7B6D6B6C6BCB324735D9B12341D
SHA1:	5522288E49FED97592A56899245B5A87C0FD458D
SHA-256:	A83CA909263225EFD7FD9C2488045FB889AEAB2407E01E4AF1305A699E8835C0
SHA-512:	EA006E5703F60C961893BAAEFE2995E174B7C88D0D7EBBBFF26C00ED63584330936A28434069B3DDA60BED57EC6C4DCCBE41524A87B41E8CEDD9A4C977F58D45
Malicious:	false
Preview:	.B...-p..]W..6u.r..b,.cv...<Z..]...6.}...$.........e.......>p .i....Va............FFU.............=K.W9.U...9..=p.J.!J.....5.7.lr.>V....8`..K....ox6...Q>.....<"B0I.A9....(.zB7.2oL...[3.;.HS.....E..+.?...$(......h..6......k(....x...x.{..y.RL.g.Ti.`%g.$.....>..\.Z{S..r..b8.q<..Q/_M.,gvJ.^.r....w.K......e.b.....,....9y....%M.A...7p..px...n.Op.wDNI7..e.\|...i.;..9.epv.X..~.h._.N[...;...Q]..`C...5....e........YE.&:q.b<.....p.2!.O>.FiyI...^V...dJ.7...C....h$#....qJW1._(..%).@.y%.YC............\1.`...\|8..S...!.]0R.;..CV...$..C......=....8...e....$.\.~.8...,..9i.e.....~$..&H./..E./..2..+...w.....P.s..J\|..<sr...=d.4.]?.E.....I.o.U\|.G.j.r..E..?^.bK7R..Gax....9.....w..90..k..y.&.nf.....\|...X..6Q....GQx.jZ.9/..U.jAm.Q...u+....".6uYa.....3.@.x...=Y.T...K.&=....{.2.;..i.RvO..".<...G.7...<r-_..A.u.K.`>.b@....V1..g](.P....4.t.....,..g!..~[...1j..(....n..I.....K..3.....e..q.R0..{..`...:.B.y..].=....3M.p.j*.(.d.,j....<#...K-....(..+...CM'.T{e..+.

C:\Users\user\Documents\FENIVHOIKN.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.856056187481957
Encrypted:	false
SSDEEP:	24:2IPnZlYgO2ygG7uF+n+RhnjV2KNXVZqpMJHP09k75wyaNvMdJdeCvLcO5/Vqpi4i:2Iv3YgiDu++xx/DFFpuwiCDcO5/Uunb
MD5:	618CC7B6D6B6C6BCB324735D9B12341D
SHA1:	5522288E49FED97592A56899245B5A87C0FD458D
SHA-256:	A83CA909263225EFD7FD9C2488045FB889AEAB2407E01E4AF1305A699E8835C0
SHA-512:	EA006E5703F60C961893BAAEFE2995E174B7C88D0D7EBBBFF26C00ED63584330936A28434069B3DDA60BED57EC6C4DCCBE41524A87B41E8CEDD9A4C977F58D45
Malicious:	false
Preview:	.B...-p..]W..6u.r..b,.cv...<Z..]...6.}...$.........e.......>p .i....Va............FFU.............=K.W9.U...9..=p.J.!J.....5.7.lr.>V....8`..K....ox6...Q>.....<"B0I.A9....(.zB7.2oL...[3.;.HS.....E..+.?...$(......h..6......k(....x...x.{..y.RL.g.Ti.`%g.$.....>..\.Z{S..r..b8.q<..Q/_M.,gvJ.^.r....w.K......e.b.....,....9y....%M.A...7p..px...n.Op.wDNI7..e.\|...i.;..9.epv.X..~.h._.N[...;...Q]..`C...5....e........YE.&:q.b<.....p.2!.O>.FiyI...^V...dJ.7...C....h$#....qJW1._(..%).@.y%.YC............\1.`...\|8..S...!.]0R.;..CV...$..C......=....8...e....$.\.~.8...,..9i.e.....~$..&H./..E./..2..+...w.....P.s..J\|..<sr...=d.4.]?.E.....I.o.U\|.G.j.r..E..?^.bK7R..Gax....9.....w..90..k..y.&.nf.....\|...X..6Q....GQx.jZ.9/..U.jAm.Q...u+....".6uYa.....3.@.x...=Y.T...K.&=....{.2.;..i.RvO..".<...G.7...<r-_..A.u.K.`>.b@....V1..g](.P....4.t.....,..g!..~[...1j..(....n..I.....K..3.....e..q.R0..{..`...:.B.y..].=....3M.p.j*.(.d.,j....<#...K-....(..+...CM'.T{e..+.

C:\Users\user\Documents\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8651974634593085
Encrypted:	false
SSDEEP:	48:LyelPIvcPDfzScpvcav2PbIon/ovpyQlQPrZW0:/yvYHvlv2Rn/ovpyQMW0
MD5:	8544D78176376717E24C7FCB0169C459
SHA1:	EE6419BF5E9E58C6A2F0353D56008925DD15BDD3
SHA-256:	F693B9A915FC5C6A64C88576263B6405B9ACD32E444ACD3E606858B50F97CB13
SHA-512:	EAE072AE3AE291A4EC4829A4D752F6BC8450D7912F532B68112B0CEC043D295227EB4C25773CDBF85B8E90F0452494AE130B2C8FB386F0A5F555EF9E099FBC96
Malicious:	false
Preview:	.........p..1....J...l..H..i.X.&....7.T>I..._...&x.r...nl..{.g...u.d!..(....!...8...r@.h5W.&..{.z)s....hA .S..oUzGim......W....[.~.<Ccdm.j.>..D..)W.....y&...f.P..R.X........1k..Q..N..\2.~.(.o..4U.....:#..S.!$.....$..-e..N.(r.6V.H;.1.N..BZ.W+..p..8.P.y}....hY\...).9....b..vp......N.7.Ba8.D.J. ...}f.M..}...ge.&Lo]o._...Z........+.K.h.-.?.=.4F@.....rb...C+..d:..).u.D..!B.}..?.....n\|.....6Z....."..M.o...>....R;r..[..?(.n....WTw.3>.4Q.(P...,.,........Rxr......$...Vo....^..+....:....~-....%.......0.#....p...t....r.l../.....T.$.~.\|}...4.u._f..._........+< .?..X.W!.R......v..{..U...........Z#j...P..'..e8Y.E j,..."3JJ.Y......&E(^`.J..h..F.5....Z..W..C....J..3.Y..>..H[^.a2.I".+R.....<n:.m..-p..a....s.N..T:...n.I..-o........t....../i].i..rW.j...<.z.~<..C..J....l....]J...!.R...).....He.;,S...#U5+d??..t.{..P%.n.y.u.=..?:..A7v..}.q...kj.#...m..".....[.".:...:..-BU0...'pr..v....g.....5. ...cM..:$...\....K.....K...uy.<w.....r.z+.yz..h.....?;~.j./.L..`.oT.

C:\Users\user\Documents\LSBIHQFDVT.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8651974634593085
Encrypted:	false
SSDEEP:	48:LyelPIvcPDfzScpvcav2PbIon/ovpyQlQPrZW0:/yvYHvlv2Rn/ovpyQMW0
MD5:	8544D78176376717E24C7FCB0169C459
SHA1:	EE6419BF5E9E58C6A2F0353D56008925DD15BDD3
SHA-256:	F693B9A915FC5C6A64C88576263B6405B9ACD32E444ACD3E606858B50F97CB13
SHA-512:	EAE072AE3AE291A4EC4829A4D752F6BC8450D7912F532B68112B0CEC043D295227EB4C25773CDBF85B8E90F0452494AE130B2C8FB386F0A5F555EF9E099FBC96
Malicious:	false
Preview:	.........p..1....J...l..H..i.X.&....7.T>I..._...&x.r...nl..{.g...u.d!..(....!...8...r@.h5W.&..{.z)s....hA .S..oUzGim......W....[.~.<Ccdm.j.>..D..)W.....y&...f.P..R.X........1k..Q..N..\2.~.(.o..4U.....:#..S.!$.....$..-e..N.(r.6V.H;.1.N..BZ.W+..p..8.P.y}....hY\...).9....b..vp......N.7.Ba8.D.J. ...}f.M..}...ge.&Lo]o._...Z........+.K.h.-.?.=.4F@.....rb...C+..d:..).u.D..!B.}..?.....n\|.....6Z....."..M.o...>....R;r..[..?(.n....WTw.3>.4Q.(P...,.,........Rxr......$...Vo....^..+....:....~-....%.......0.#....p...t....r.l../.....T.$.~.\|}...4.u._f..._........+< .?..X.W!.R......v..{..U...........Z#j...P..'..e8Y.E j,..."3JJ.Y......&E(^`.J..h..F.5....Z..W..C....J..3.Y..>..H[^.a2.I".+R.....<n:.m..-p..a....s.N..T:...n.I..-o........t....../i].i..rW.j...<.z.~<..C..J....l....]J...!.R...).....He.;,S...#U5+d??..t.{..P%.n.y.u.=..?:..A7v..}.q...kj.#...m..".....[.".:...:..-BU0...'pr..v....g.....5. ...cM..:$...\....K.....K...uy.<w.....r.z+.yz..h.....?;~.j./.L..`.oT.

C:\Users\user\Documents\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863335294197113
Encrypted:	false
SSDEEP:	24:adOb6gZILbnwwOWnAKNPjqulIQOI1788UWFGID1yoWvfX4cx2IWRLwrRJYfMdsiy:zt6lKIGIDPWYlfLe2b
MD5:	6815569198930FC6389320529A7D8CAD
SHA1:	8DD03426326C7D9AB8B445BB4CA69DBF84FC1DA6
SHA-256:	0F15B7B81C3A181E05975A014F42F441E76FDDF8D4C8D3CBD7BE248A4736718B
SHA-512:	5784BE9AB1B997788CB15CA9418BBE63A12F00A1784B7799A66006A29D1CE8F3284BD8567508261C77586E081A4BEC24E61C2D604607E5D26AFB82B139DF03F2
Malicious:	false
Preview:	.........v....f.I5we...b.........G...D+&}.c.......6-....+....;j.Q..).asO...iE.ZW.8...AUq..M.G1w.mg.........ew`Vw.\.......7......W......"..N......EQe.8..a...t.~8.!.e.\Y...F....tr..#..l..Y.#...)....V.<n....(.....B(....x..'.D..9..b..X...B`....ab.U....2.l...0.....W..3[.3qU9k..C..+.yN..K.cQ..W.M5.5..h4M%xG..q....Z.@...J..l..8...N{......v.h...js.~...i...........?O..h..C....V.R...h5!..,.1?my..$.>.v..x./.=.:.........c..... ..S.s...._.C..-..^.....Ky.........u...K.cdN3ZJ3Pz.{.60...%T.\..d.g....!...6.A}....[...}.r..%$....{....4V..9...W.......`.a.h'\5....G..?...9......5.....G_.$....5...D+.@..h. .Y....}...@(.SS....B&..B.+X..p/..<..o.3../....6....,{.vy..2...g..d.]...n...d8Yl...p...y..3.1.i..lx.....M.......G...O.dW.[..L.I(S..'3....Qr...]?..u...q........&]2...ic$pQ/.u.....:.*..#....o.rN.....;.%...$...xO.j....D!S.....#....b. .dR.8..v+x.O.0..f<8..oi..\..."b..x.Q....:...nq.4.QRz..1.G....a..0...R....5t....7... ..^f..?7.xZ.\|)...VRrX........@..M.ES.K.d.@.V\;%6..(..

C:\Users\user\Documents\NIKHQAIQAU.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.863335294197113
Encrypted:	false
SSDEEP:	24:adOb6gZILbnwwOWnAKNPjqulIQOI1788UWFGID1yoWvfX4cx2IWRLwrRJYfMdsiy:zt6lKIGIDPWYlfLe2b
MD5:	6815569198930FC6389320529A7D8CAD
SHA1:	8DD03426326C7D9AB8B445BB4CA69DBF84FC1DA6
SHA-256:	0F15B7B81C3A181E05975A014F42F441E76FDDF8D4C8D3CBD7BE248A4736718B
SHA-512:	5784BE9AB1B997788CB15CA9418BBE63A12F00A1784B7799A66006A29D1CE8F3284BD8567508261C77586E081A4BEC24E61C2D604607E5D26AFB82B139DF03F2
Malicious:	false
Preview:	.........v....f.I5we...b.........G...D+&}.c.......6-....+....;j.Q..).asO...iE.ZW.8...AUq..M.G1w.mg.........ew`Vw.\.......7......W......"..N......EQe.8..a...t.~8.!.e.\Y...F....tr..#..l..Y.#...)....V.<n....(.....B(....x..'.D..9..b..X...B`....ab.U....2.l...0.....W..3[.3qU9k..C..+.yN..K.cQ..W.M5.5..h4M%xG..q....Z.@...J..l..8...N{......v.h...js.~...i...........?O..h..C....V.R...h5!..,.1?my..$.>.v..x./.=.:.........c..... ..S.s...._.C..-..^.....Ky.........u...K.cdN3ZJ3Pz.{.60...%T.\..d.g....!...6.A}....[...}.r..%$....{....4V..9...W.......`.a.h'\5....G..?...9......5.....G_.$....5...D+.@..h. .Y....}...@(.SS....B&..B.+X..p/..<..o.3../....6....,{.vy..2...g..d.]...n...d8Yl...p...y..3.1.i..lx.....M.......G...O.dW.[..L.I(S..'3....Qr...]?..u...q........&]2...ic$pQ/.u.....:.*..#....o.rN.....;.%...$...xO.j....D!S.....#....b. .dR.8..v+x.O.0..f<8..oi..\..."b..x.Q....:...nq.4.QRz..1.G....a..0...R....5t....7... ..^f..?7.xZ.\|)...VRrX........@..M.ES.K.d.@.V\;%6..(..

C:\Users\user\Documents\NIKHQAIQAU\BPMLNOBVSB.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.853695198149787
Encrypted:	false
SSDEEP:	24:+/4XMiT1mbh2jvqqY3JKAX+DtO3r0LcZVCQtWfKTqhMvpuR3yyDXR2FaL2A4Ao:+Ls0h2TSEAX+DQZVZtwKgMYDHFo
MD5:	FD6ED50EFA2540FA49C610769A8BAF4F
SHA1:	026EA896338F6C1909CBC5BFDB1FBDAB81616AFC
SHA-256:	F1324C7834F854E5B3C78BF96B60FFC8CC9FC26B6669826A2BFC34A72C6FB39E
SHA-512:	FDA8882F85CE0AFDA7347C0A89B8813676B6D1FBE7129576CFED9102BE88C4BB99E66CEA8D1442AF4A324D4C6215A60328C5AB0D705373F71A2BB1378EED839B
Malicious:	false
Preview:	.)..9l.L.;X=.DJv$....e.......=4.4p0..y....,..!..:.$<..../.u.......3..R..D.9.P?...E'-xF....7.{../3...\|\....HB8..e.......7...$.../.,6.S`..G...2....k.=......a..B&B.....;.nf.%`.T.R.8Q.m.........!.).M..J;..U.&...k..A...9.ph..c.ad....$7..$.......U..x....,.4hU.@..Vl....3J.<[0.U4Ho2..qE=M.{..... .b.o.v...g.....Kn....\|.r...."8X..in.k2E.X..<.d..)...S.,..y...~..4_.Q..K....?.6uO.......j#.J.6..I.....8.D)..K....J.jD......b..F...f.....8...j.lD.....{.-..Z...0..-yd.mp...{."O...K.F...o..f..QF.!..<C.i.q.....,..`....h]IF.6.+.....}.[...r.v.gU...u..ye..bp..$..dl....4..g.z.<=I4.!z.G(.L.EG....W..^......R.(.].~.tU.]..J;..Z........Zkk...Q.........0-...t...a"(..7.8ar.!..s=R..\(.....\|nf@.{.....,..>.lf...E...3.=.[.k..>.E[.......f8.J/...:^...S.^N....@.JTG.@..?.N..e......-....<..$..........I..."..LYL..:&..q.+<`..1R.....{..'..~..n.k.I....~.&.....-.>........`...f..wE.G...9.....T.....K...).(Z.&.?].........)<\..\|...:.B..*..M.F.N[ .).`..].j..X..~k.........h......Zo.4..

C:\Users\user\Documents\NIKHQAIQAU\BPMLNOBVSB.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.853695198149787
Encrypted:	false
SSDEEP:	24:+/4XMiT1mbh2jvqqY3JKAX+DtO3r0LcZVCQtWfKTqhMvpuR3yyDXR2FaL2A4Ao:+Ls0h2TSEAX+DQZVZtwKgMYDHFo
MD5:	FD6ED50EFA2540FA49C610769A8BAF4F
SHA1:	026EA896338F6C1909CBC5BFDB1FBDAB81616AFC
SHA-256:	F1324C7834F854E5B3C78BF96B60FFC8CC9FC26B6669826A2BFC34A72C6FB39E
SHA-512:	FDA8882F85CE0AFDA7347C0A89B8813676B6D1FBE7129576CFED9102BE88C4BB99E66CEA8D1442AF4A324D4C6215A60328C5AB0D705373F71A2BB1378EED839B
Malicious:	false
Preview:	.)..9l.L.;X=.DJv$....e.......=4.4p0..y....,..!..:.$<..../.u.......3..R..D.9.P?...E'-xF....7.{../3...\|\....HB8..e.......7...$.../.,6.S`..G...2....k.=......a..B&B.....;.nf.%`.T.R.8Q.m.........!.).M..J;..U.&...k..A...9.ph..c.ad....$7..$.......U..x....,.4hU.@..Vl....3J.<[0.U4Ho2..qE=M.{..... .b.o.v...g.....Kn....\|.r...."8X..in.k2E.X..<.d..)...S.,..y...~..4_.Q..K....?.6uO.......j#.J.6..I.....8.D)..K....J.jD......b..F...f.....8...j.lD.....{.-..Z...0..-yd.mp...{."O...K.F...o..f..QF.!..<C.i.q.....,..`....h]IF.6.+.....}.[...r.v.gU...u..ye..bp..$..dl....4..g.z.<=I4.!z.G(.L.EG....W..^......R.(.].~.tU.]..J;..Z........Zkk...Q.........0-...t...a"(..7.8ar.!..s=R..\(.....\|nf@.{.....,..>.lf...E...3.=.[.k..>.E[.......f8.J/...:^...S.^N....@.JTG.@..?.N..e......-....<..$..........I..."..LYL..:&..q.+<`..1R.....{..'..~..n.k.I....~.&.....-.>........`...f..wE.G...9.....T.....K...).(Z.&.?].........)<\..\|...:.B..*..M.F.N[ .).`..].j..X..~k.........h......Zo.4..

C:\Users\user\Documents\NIKHQAIQAU\CURQNKVOIX.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8669784276300945
Encrypted:	false
SSDEEP:	24:1Zm1kv6oFS+k+iKTXDttN0yFUp2vnPe6YdHlRb0hG2rYC/CWWxP3n3OHJikXH:skvkiieXDttOyrPe6EHlt0s2z/CJx3+V
MD5:	DDC8F882ECB524197B53D2B4A5EFDC89
SHA1:	7367005B89E73D0C3B0CC181E08B1E7921D4266B
SHA-256:	1D6B2F1DFFB747A7A35EA41C214DBACA156CA688F93A848552A79B28D7724C5C
SHA-512:	F3478F528D66A90BC69A3D1A453644A389105B73E8B4D05208DD1517228D6FFDB6249C9A5FB2DEA9E3E7A663C4BC0D9334DBFDB36FACC542B17D2CC9E624968D
Malicious:	false
Preview:	F.:....Xl..\|x.].5.X.q.P...Q..3\|.!O......O.K.....Vq."..BO..0".Uf..(&S.......\......s.W........%u...........KG...IRMV...C@.kI.......C@./.W.e..!<.37..?./.g..8:dbY.9`.......m.}b". .....MI.=b/.....%..tB....<.u...<.G.(...o.....T.....0@.p....{)...mQ..J_9z>.....X......z.l)Q..Y...J{..m).....2@8[K'......[.<QN.<.}.:..+..@..._(\H..[.~.wz.B{qOQ.=q\|..~#.>.I\|.T..{..I......#..+..w...Y.>.0.#Nv...f.(.k.m.....F.5.<A...c.h.L.....=....h./5<....l....JQ\|........}H...'..o...../u.......-m.cx..X.:.O..(.4...H.U..[e......%t...V...Jqy...W.....b)I..&.....I.8g..08^&P.~.......y.({1m....vr.D.Sy[~;......'...."..O..7...~k..~....9.....r.5hK.0...B.L 1...........H...ks.......8j.."n...Dd...Z,.:..@O.....$.?.H...% s.U.#....:L....3.o4.z.o#+....2KFI.....z.^.*d..\|.O..z.......Xw..-.....O~m~m..ff.......SE...^...C.l?..Bg(...Gd.~C'.6..a.e...v....w...%...=.......~.R\(.)mw3.M...b....G...'.u....#3..w..O..nL..o..X.....[.Ycr..&...B.YR....5..5S.~.8....H..y..>.P.EwoS..hLS...........7 ..D.

C:\Users\user\Documents\NIKHQAIQAU\CURQNKVOIX.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8669784276300945
Encrypted:	false
SSDEEP:	24:1Zm1kv6oFS+k+iKTXDttN0yFUp2vnPe6YdHlRb0hG2rYC/CWWxP3n3OHJikXH:skvkiieXDttOyrPe6EHlt0s2z/CJx3+V
MD5:	DDC8F882ECB524197B53D2B4A5EFDC89
SHA1:	7367005B89E73D0C3B0CC181E08B1E7921D4266B
SHA-256:	1D6B2F1DFFB747A7A35EA41C214DBACA156CA688F93A848552A79B28D7724C5C
SHA-512:	F3478F528D66A90BC69A3D1A453644A389105B73E8B4D05208DD1517228D6FFDB6249C9A5FB2DEA9E3E7A663C4BC0D9334DBFDB36FACC542B17D2CC9E624968D
Malicious:	false
Preview:	F.:....Xl..\|x.].5.X.q.P...Q..3\|.!O......O.K.....Vq."..BO..0".Uf..(&S.......\......s.W........%u...........KG...IRMV...C@.kI.......C@./.W.e..!<.37..?./.g..8:dbY.9`.......m.}b". .....MI.=b/.....%..tB....<.u...<.G.(...o.....T.....0@.p....{)...mQ..J_9z>.....X......z.l)Q..Y...J{..m).....2@8[K'......[.<QN.<.}.:..+..@..._(\H..[.~.wz.B{qOQ.=q\|..~#.>.I\|.T..{..I......#..+..w...Y.>.0.#Nv...f.(.k.m.....F.5.<A...c.h.L.....=....h./5<....l....JQ\|........}H...'..o...../u.......-m.cx..X.:.O..(.4...H.U..[e......%t...V...Jqy...W.....b)I..&.....I.8g..08^&P.~.......y.({1m....vr.D.Sy[~;......'...."..O..7...~k..~....9.....r.5hK.0...B.L 1...........H...ks.......8j.."n...Dd...Z,.:..@O.....$.?.H...% s.U.#....:L....3.o4.z.o#+....2KFI.....z.^.*d..\|.O..z.......Xw..-.....O~m~m..ff.......SE...^...C.l?..Bg(...Gd.~C'.6..a.e...v....w...%...=.......~.R\(.)mw3.M...b....G...'.u....#3..w..O..nL..o..X.....[.Ycr..&...B.YR....5..5S.~.8....H..y..>.P.EwoS..hLS...........7 ..D.

C:\Users\user\Documents\NIKHQAIQAU\FENIVHOIKN.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8624306196266955
Encrypted:	false
SSDEEP:	24:aUiceayEVVzN3pWqRix4K6qjXrvYJvVcGM9ppJTB7ClkQmFXMHgtRpUaqF88Jc7z:aUiPanVzN5WNxvjS50JtG3mVogVnnW8r
MD5:	7C76EEA7B87E39E94B1BF0785798B097
SHA1:	45A4025332C8F646BF7D2A0C57095EBB3986C992
SHA-256:	EC679404D41ED5B03D0DFE804554F0FC5E038D395B835FEFD985DCCF0C1E81ED
SHA-512:	56C11AF8C0E27DDD9B3CD940EB91F92609D492CC17FB21176C81BE2AB08E86A4CE5CB26763DD13968C55C2829F3A47FCBC8FAFEC8141112F9663830D0FB18AEE
Malicious:	false
Preview:	.L....E..R&^..a.<.\|LH^.`B..6.u".8.I.~.Z2S.....I...xp...u.nA.\R.......B.E2=N.}....x.%=.....{.'..mS...>}.:B.\R.].}..oua2/........[+.N...s.$Uq.J..q...R$..w......U...Ln.. ....DS...#dB.....aT.z...).....i(....n.....'oE.^.&.oX.Z...g...[y[.6D..c.YhVP..w.....b}....}..v..0....G..bhXUJ.Oh$%....8^H..&.?..^QV=........g.b..j....\|.........q.mV:...k.5..%..\|.].3Z..W/a\(...{.#.:.c.qTq....&..t.......l.r&....C......+.Q.b...qnZdrK....../".?\|$...J.!.u....I.....4$.W;.1.`}..\.....,."...#4....7.......\]..k@.L#J..;p"^Tv....1..\..K...i..l....@.Q..8...C..:.-.J.k2..?../o.F..J...W..[."y.....P......xX.N..jD.$.[#.;mf...G.3,.....a.k..(Q..........t..?.........)..t.^pg..L...;ra~...G.&..^e..c...`.L.....Z...g...^.x.._.O..4...>.a.H.E......IW.X....,...7..}y......jp./.\|.e>Fjf.z....E.!...'....G.[.t.2~.s_=r..5.]H..&C..L.p.............)..\|.A[.X..m.....Gq..'.R.D....L/.g..k.e..>.Hj.Ep5....4......k...y....d.n.k..^.1..5.:......N..M{.F...4.../g.}^S..D.......'.VB*..E...

C:\Users\user\Documents\NIKHQAIQAU\FENIVHOIKN.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8624306196266955
Encrypted:	false
SSDEEP:	24:aUiceayEVVzN3pWqRix4K6qjXrvYJvVcGM9ppJTB7ClkQmFXMHgtRpUaqF88Jc7z:aUiPanVzN5WNxvjS50JtG3mVogVnnW8r
MD5:	7C76EEA7B87E39E94B1BF0785798B097
SHA1:	45A4025332C8F646BF7D2A0C57095EBB3986C992
SHA-256:	EC679404D41ED5B03D0DFE804554F0FC5E038D395B835FEFD985DCCF0C1E81ED
SHA-512:	56C11AF8C0E27DDD9B3CD940EB91F92609D492CC17FB21176C81BE2AB08E86A4CE5CB26763DD13968C55C2829F3A47FCBC8FAFEC8141112F9663830D0FB18AEE
Malicious:	false
Preview:	.L....E..R&^..a.<.\|LH^.`B..6.u".8.I.~.Z2S.....I...xp...u.nA.\R.......B.E2=N.}....x.%=.....{.'..mS...>}.:B.\R.].}..oua2/........[+.N...s.$Uq.J..q...R$..w......U...Ln.. ....DS...#dB.....aT.z...).....i(....n.....'oE.^.&.oX.Z...g...[y[.6D..c.YhVP..w.....b}....}..v..0....G..bhXUJ.Oh$%....8^H..&.?..^QV=........g.b..j....\|.........q.mV:...k.5..%..\|.].3Z..W/a\(...{.#.:.c.qTq....&..t.......l.r&....C......+.Q.b...qnZdrK....../".?\|$...J.!.u....I.....4$.W;.1.`}..\.....,."...#4....7.......\]..k@.L#J..;p"^Tv....1..\..K...i..l....@.Q..8...C..:.-.J.k2..?../o.F..J...W..[."y.....P......xX.N..jD.$.[#.;mf...G.3,.....a.k..(Q..........t..?.........)..t.^pg..L...;ra~...G.&..^e..c...`.L.....Z...g...^.x.._.O..4...>.a.H.E......IW.X....,...7..}y......jp./.\|.e>Fjf.z....E.!...'....G.[.t.2~.s_=r..5.]H..&C..L.p.............)..\|.A[.X..m.....Gq..'.R.D....L/.g..k.e..>.Hj.Ep5....4......k...y....d.n.k..^.1..5.:......N..M{.F...4.../g.}^S..D.......'.VB*..E...

C:\Users\user\Documents\NIKHQAIQAU\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.84267577826609
Encrypted:	false
SSDEEP:	48:c48OQ41xehKOhr+/N+08pYhWkCn3GYhoAHPW/Pc:T8vGyKu+w0PV5tAvIPc
MD5:	5A03A989AFC9A2708E2AC4F0A1AF92E1
SHA1:	E290A7FBE0FEA122872A456971975EF10EEDB6F7
SHA-256:	AEA0D93F517E7417740A2FDA0F714D9AA4477D60D0FFB3D870674659E3DD56D8
SHA-512:	934926E38DA0B553D5D34A3AFB86387F2B53D5E2546823F4D3A4FA7CB704A73BAE3990020F10F905A8A5CB121EF0A6D16F5A274A47EEC55401CF518DCBA7156E
Malicious:	false
Preview:	._.).~....dc;.{......9..c.G2...b...B.S.z.k).....n..S.9......0....2..\L.M.L.6.C785dP..]....8&U..Db..........f.m.h....~...zn.q...".j...2.%..G.X!..mb.!;.....}...D.a.x.?..f.+%.8m.7[.2.......Z.9...\...pF.Y.c.=..q..n..C.j,.(....M..g..a.....".6.V...aZv@...4'.a4.(uv.r.k.$.........=H...S.v.@....r.C@?u.P...... ....}..]#.K4..$X.s....)~.nm....ZY....=y.Q../B8.TF^.W.%m...M..\|.w..m..2.,.D..[..g.a'........1f.5....cG.nS7.C..nY..lD]....A.>.28... .'.`..{8.':?r..w.-..\|.]%....V.-..p.Y9.:,9.....d....+.>..l\...;.`.....<.l....S...c...W=.......)(.;.].c-... .iS0`r../O.(o......P.c!h...w4.....~J.."...b..PeFL..3..e.}u...j..GD..[.o.......0...&.K.........?.c..h_.L}). .p...%.d..Jay.r....5...'H...P3..~...0...$.....!.......`..4......yG(..P.....u_.%YV.d....R..=.5.E..4#..(n'...OI..aE.....Z+.C...6:M.....z...d%Q..i.~.#h..'...F.!U.}\a....l.!....3....@.+......xv)..V......l.+i,bz..\{..{.3....cgU..T....U;....E.....J}RJK.:u.Dn/...QrR-^..w.....l.(..f.C.s.........WU...0.

C:\Users\user\Documents\NIKHQAIQAU\NIKHQAIQAU.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.84267577826609
Encrypted:	false
SSDEEP:	48:c48OQ41xehKOhr+/N+08pYhWkCn3GYhoAHPW/Pc:T8vGyKu+w0PV5tAvIPc
MD5:	5A03A989AFC9A2708E2AC4F0A1AF92E1
SHA1:	E290A7FBE0FEA122872A456971975EF10EEDB6F7
SHA-256:	AEA0D93F517E7417740A2FDA0F714D9AA4477D60D0FFB3D870674659E3DD56D8
SHA-512:	934926E38DA0B553D5D34A3AFB86387F2B53D5E2546823F4D3A4FA7CB704A73BAE3990020F10F905A8A5CB121EF0A6D16F5A274A47EEC55401CF518DCBA7156E
Malicious:	false
Preview:	._.).~....dc;.{......9..c.G2...b...B.S.z.k).....n..S.9......0....2..\L.M.L.6.C785dP..]....8&U..Db..........f.m.h....~...zn.q...".j...2.%..G.X!..mb.!;.....}...D.a.x.?..f.+%.8m.7[.2.......Z.9...\...pF.Y.c.=..q..n..C.j,.(....M..g..a.....".6.V...aZv@...4'.a4.(uv.r.k.$.........=H...S.v.@....r.C@?u.P...... ....}..]#.K4..$X.s....)~.nm....ZY....=y.Q../B8.TF^.W.%m...M..\|.w..m..2.,.D..[..g.a'........1f.5....cG.nS7.C..nY..lD]....A.>.28... .'.`..{8.':?r..w.-..\|.]%....V.-..p.Y9.:,9.....d....+.>..l\...;.`.....<.l....S...c...W=.......)(.;.].c-... .iS0`r../O.(o......P.c!h...w4.....~J.."...b..PeFL..3..e.}u...j..GD..[.o.......0...&.K.........?.c..h_.L}). .p...%.d..Jay.r....5...'H...P3..~...0...$.....!.......`..4......yG(..P.....u_.%YV.d....R..=.5.E..4#..(n'...OI..aE.....Z+.C...6:M.....z...d%Q..i.~.#h..'...F.!U.}\a....l.!....3....@.+......xv)..V......l.+i,bz..\{..{.3....cgU..T....U;....E.....J}RJK.:u.Dn/...QrR-^..w.....l.(..f.C.s.........WU...0.

C:\Users\user\Documents\NIKHQAIQAU\RAYHIWGKDI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.84681800810677
Encrypted:	false
SSDEEP:	24:yxwWHH4cDmF36Fqz4XsIQqhnK4KzWsPlYqEyamXqCNgpzGP/P8b4r:MwpcDmQUzosfq9VNsPlYQamX/gtG/o4r
MD5:	4CB739723F8BC3B676A8A76FB546CE62
SHA1:	78E72F8CAF2B028331B6E51472167E0E95673C2F
SHA-256:	32D694A350AB8C1ED2E6FA4C584DFF75092751F860B112A541C50249E56EC811
SHA-512:	87737445732E1026ECBE0BB239E7AB08CF4DDEAEECF0607A9AE112303CE21BD7F3A69C8C823DEFEE86632EA2260FC214B302EAB4ADDAC173C2998BEB69EBFD1A
Malicious:	false
Preview:	....^......5.....>.g...8.u....4...."..y..9P...1.?...6.k..Edob\|..o..(bH^~....x`AFx.SB.`...O.z.G.(.......4?1.....$....q..~`.3..)..ou{.......>+,....t.Z....z.j......c"...i......u..3.%..f...G.'.`.z.ht.lJ...V.....<l(.q:..B...u]....o.l.U.<.'........#ul..<.u.).K.A.@.361.?.F\|G..".....'(.^@.._..o(........H.7...!./.BS.q.S...R.>.{..0......X....pHL....u...h\i,.u\`..C....Q......8r.....(SDG....U.....>..[..4.E......)o.....T.\|.]...\......b..#.._....kr....KC.x..yW...%$.Xf.'/T...Gd...)..../.gPX..D..Ir.K....p..}8.......]D_..]T.W...J.=.&.y@...r>....h........8.(.....,\.?..Y......&.[..VZ..$..o.$.7i..r..Q.04..P..<xC8......._..g.5u. R......R..+f..j........^}..e..G.e.......i...UD8....R.$..i....V..O {.Gm$...e...I.....v......(.V....?9t...[.. ~..v<....-......e.W+^.&q,R............S.@O.g..=.4.Iv.n.f..'~.....o.V...X'.h...Z..D......h.V.%.x.o...h..f.......Y.I:}<.....z..]p....[....+t...N.>..0.........F........A.s.ze>..m......B<.;.'.2.fO-(R......z

C:\Users\user\Documents\NIKHQAIQAU\RAYHIWGKDI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.84681800810677
Encrypted:	false
SSDEEP:	24:yxwWHH4cDmF36Fqz4XsIQqhnK4KzWsPlYqEyamXqCNgpzGP/P8b4r:MwpcDmQUzosfq9VNsPlYQamX/gtG/o4r
MD5:	4CB739723F8BC3B676A8A76FB546CE62
SHA1:	78E72F8CAF2B028331B6E51472167E0E95673C2F
SHA-256:	32D694A350AB8C1ED2E6FA4C584DFF75092751F860B112A541C50249E56EC811
SHA-512:	87737445732E1026ECBE0BB239E7AB08CF4DDEAEECF0607A9AE112303CE21BD7F3A69C8C823DEFEE86632EA2260FC214B302EAB4ADDAC173C2998BEB69EBFD1A
Malicious:	false
Preview:	....^......5.....>.g...8.u....4...."..y..9P...1.?...6.k..Edob\|..o..(bH^~....x`AFx.SB.`...O.z.G.(.......4?1.....$....q..~`.3..)..ou{.......>+,....t.Z....z.j......c"...i......u..3.%..f...G.'.`.z.ht.lJ...V.....<l(.q:..B...u]....o.l.U.<.'........#ul..<.u.).K.A.@.361.?.F\|G..".....'(.^@.._..o(........H.7...!./.BS.q.S...R.>.{..0......X....pHL....u...h\i,.u\`..C....Q......8r.....(SDG....U.....>..[..4.E......)o.....T.\|.]...\......b..#.._....kr....KC.x..yW...%$.Xf.'/T...Gd...)..../.gPX..D..Ir.K....p..}8.......]D_..]T.W...J.=.&.y@...r>....h........8.(.....,\.?..Y......&.[..VZ..$..o.$.7i..r..Q.04..P..<xC8......._..g.5u. R......R..+f..j........^}..e..G.e.......i...UD8....R.$..i....V..O {.Gm$...e...I.....v......(.V....?9t...[.. ~..v<....-......e.W+^.&q,R............S.@O.g..=.4.Iv.n.f..'~.....o.V...X'.h...Z..D......h.V.%.x.o...h..f.......Y.I:}<.....z..]p....[....+t...N.>..0.........F........A.s.ze>..m......B<.;.'.2.fO-(R......z

C:\Users\user\Documents\NIKHQAIQAU\WKXEWIOTXI.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.874551815355377
Encrypted:	false
SSDEEP:	24:dZojb/5dIngIsDuCw8Gy+xQFt9fKtR5NW0Nvztk8ymqZTp+Npo0WahYQrdXFnc:8jtigACwny+xQtJKfNZPyNp+Xo6dXO
MD5:	20BE569622F39600C20963B229DC4F32
SHA1:	B575A505293F089B03EF1C713A442D5215D9B14D
SHA-256:	D873013B3699380A50A8110A084CAEEDC2683D5223BF749CD97622DE807FE73E
SHA-512:	AC576B3CD06BEAB2A86E87F371623A5AF2EE4BCE9DD6B94817868776DBE7E79FC0904D829745B61EE2902F23238A18ECB43806D45360D2D2E92485CD37A378CD
Malicious:	false
Preview:	...k......=Ts..KQ....~....:W,.Xp.ROR...z....s..r...Vi.w. 8:.M6{..h ...7P.}..Y...2.n...$/....&UE.y.....8..c.W......E.=J5...u.o....z.m...)....&..4x.7.?...I...3..`[...-.......hq_b...o..p.....>.......!./n..^.....n....(.....b1...7.....B.>.<..<.Rf1S..fpt...H..T...1....M.c..1.2.....N....}..uw.x5$....G.,.2..9`....=vS.b....j3.\....).W)q.0m..i2:. .f.}4.Ke.}d.F.nJ....../\|K\93.x.QW.F.8.g...L._..s.&..]...W......$.....G0.D.Z..H0.:.P...3....]....0tt.GFr4......<........../6.H.C..}}..ZU.T6.A...a....:.T..'P....t....C..upJs.x..>P/.......\...hN./m_.i.>..F..]..J..>%..{+nd.fPd.s.h.M...R2.fWN....".D.1.R~S.S.3z..d...I...`....N..'....0+.........C.Q...f0.....T2....K..N..F`...P..g....X...........V..>..l.L}Y(r3..^.!.eCE\.q.+.bf.K/cV.6.Ny..lj.-.....[.Y..w.....`.7.#.&.1....+I[J.[.R.;0.....0ak.;.t.....3(...b.FH8.q.A[s.N.I.er.....^..m..y.q..y..R..l..S...2..V..K^.z..'^..5..6.u{zl.X....0z.).X[:.....trh..m).l.~OWn.l.u...4[Z)"....\..ALe.8b... ./..f..ig.0*..5.E.$.._@....%2

C:\Users\user\Documents\NIKHQAIQAU\WKXEWIOTXI.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.874551815355377
Encrypted:	false
SSDEEP:	24:dZojb/5dIngIsDuCw8Gy+xQFt9fKtR5NW0Nvztk8ymqZTp+Npo0WahYQrdXFnc:8jtigACwny+xQtJKfNZPyNp+Xo6dXO
MD5:	20BE569622F39600C20963B229DC4F32
SHA1:	B575A505293F089B03EF1C713A442D5215D9B14D
SHA-256:	D873013B3699380A50A8110A084CAEEDC2683D5223BF749CD97622DE807FE73E
SHA-512:	AC576B3CD06BEAB2A86E87F371623A5AF2EE4BCE9DD6B94817868776DBE7E79FC0904D829745B61EE2902F23238A18ECB43806D45360D2D2E92485CD37A378CD
Malicious:	false
Preview:	...k......=Ts..KQ....~....:W,.Xp.ROR...z....s..r...Vi.w. 8:.M6{..h ...7P.}..Y...2.n...$/....&UE.y.....8..c.W......E.=J5...u.o....z.m...)....&..4x.7.?...I...3..`[...-.......hq_b...o..p.....>.......!./n..^.....n....(.....b1...7.....B.>.<..<.Rf1S..fpt...H..T...1....M.c..1.2.....N....}..uw.x5$....G.,.2..9`....=vS.b....j3.\....).W)q.0m..i2:. .f.}4.Ke.}d.F.nJ....../\|K\93.x.QW.F.8.g...L._..s.&..]...W......$.....G0.D.Z..H0.:.P...3....]....0tt.GFr4......<........../6.H.C..}}..ZU.T6.A...a....:.T..'P....t....C..upJs.x..>P/.......\...hN./m_.i.>..F..]..J..>%..{+nd.fPd.s.h.M...R2.fWN....".D.1.R~S.S.3z..d...I...`....N..'....0+.........C.Q...f0.....T2....K..N..F`...P..g....X...........V..>..l.L}Y(r3..^.!.eCE\.q.+.bf.K/cV.6.Ny..lj.-.....[.Y..w.....`.7.#.&.1....+I[J.[.R.;0.....0ak.;.t.....3(...b.FH8.q.A[s.N.I.er.....^..m..y.q..y..R..l..S...2..V..K^.z..'^..5..6.u{zl.X....0z.).X[:.....trh..m).l.~OWn.l.u...4[Z)"....\..ALe.8b... ./..f..ig.0*..5.E.$.._@....%2

C:\Users\user\Documents\NIKHQAIQAU\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Documents\QNCYCDFIJJ.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.870338762321185
Encrypted:	false
SSDEEP:	24:78oxwygWLyC+kTPHKdT4CPYrgteXTTFO3CEsaaAqEp2GKB/hVLoWha/+exZ73G:7d4tYc6hO3CEpaAqEp+pHnIZLG
MD5:	DB7006329832235F48D545D81CBACA30
SHA1:	EA21AA286B1E52584F4D54D3F922836C1770DC43
SHA-256:	2277DE34FB3B7D6E18D5D72DE4471C2F8EF9E93D0D5A7566EBD1BE9FB2A33360
SHA-512:	239646A5EA719EC284F1D868DB28079A758B5A693F3DB4BA136AE3F1E537D63E0931EB351448E0C04084053F23A93854F3FD6C66ECCE881A17FB981E5E12BC33
Malicious:	false
Preview:	..B_.......'.L:.!.IT.a.j0^..I.^...=k.{..Q^7..!..^...r...i...g.~....1S._!.\|.yMz!..yH...)./..hQ...].i.Px.M.6.....Uto.4..Qx.V.Q...\|YD..!F.T`.T.....H,_..q3VB.u...W+pj/..0c.k......2.....S..[.....N\'fnsuoN.-.....65....w.........(?.VEZ.]z.,...X...y...o.>h.y.;.....a.d.....UL:$.#....j.M.@a..z...u.\|.C..W..u0Kj..mG+/UB.u.%Y..?...E.[\.Z>vAv....,.ORU@..&j..$n../G....![...o..c..s.).k.W;Q]?...e.A..F.&..V.V..p..3..+..T^..o..........Q.....1.8..d..gi......3j..xzs.......ZB....~...e.....`...[.Y.....`).i.{.N.S...b.n0.c.b..e...y...n.<.n.\B..K.W.0}a.`kB...Z6.......$.!g.ZM..N...$..p+..;1..\|.D....x./..:Z..I{rg..7..p$^4.L..\.\...Pc..IC...8U..k.aG....EU..kPg....M...B.v.....i.R.M.t~..w...O....K8..wM5.....5.........A...E......%G}......._5B...gl.h........~v..G.%e...v'M..'........%.E.3.a....._+..T..+.3.S.G.!.q.7..&f.<..5`N.p ..K@..g....x.....\~k.$>......SP....h.........}#...i.Qv..Q.d....Y.....0.N.0...a...&..c`....\|...[..R.d....i.ZB.%\G..m%.....t.ZM/.O.2.u.]D..c.

C:\Users\user\Documents\QNCYCDFIJJ.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.870338762321185
Encrypted:	false
SSDEEP:	24:78oxwygWLyC+kTPHKdT4CPYrgteXTTFO3CEsaaAqEp2GKB/hVLoWha/+exZ73G:7d4tYc6hO3CEpaAqEp+pHnIZLG
MD5:	DB7006329832235F48D545D81CBACA30
SHA1:	EA21AA286B1E52584F4D54D3F922836C1770DC43
SHA-256:	2277DE34FB3B7D6E18D5D72DE4471C2F8EF9E93D0D5A7566EBD1BE9FB2A33360
SHA-512:	239646A5EA719EC284F1D868DB28079A758B5A693F3DB4BA136AE3F1E537D63E0931EB351448E0C04084053F23A93854F3FD6C66ECCE881A17FB981E5E12BC33
Malicious:	false
Preview:	..B_.......'.L:.!.IT.a.j0^..I.^...=k.{..Q^7..!..^...r...i...g.~....1S._!.\|.yMz!..yH...)./..hQ...].i.Px.M.6.....Uto.4..Qx.V.Q...\|YD..!F.T`.T.....H,_..q3VB.u...W+pj/..0c.k......2.....S..[.....N\'fnsuoN.-.....65....w.........(?.VEZ.]z.,...X...y...o.>h.y.;.....a.d.....UL:$.#....j.M.@a..z...u.\|.C..W..u0Kj..mG+/UB.u.%Y..?...E.[\.Z>vAv....,.ORU@..&j..$n../G....![...o..c..s.).k.W;Q]?...e.A..F.&..V.V..p..3..+..T^..o..........Q.....1.8..d..gi......3j..xzs.......ZB....~...e.....`...[.Y.....`).i.{.N.S...b.n0.c.b..e...y...n.<.n.\B..K.W.0}a.`kB...Z6.......$.!g.ZM..N...$..p+..;1..\|.D....x./..:Z..I{rg..7..p$^4.L..\.\...Pc..IC...8U..k.aG....EU..kPg....M...B.v.....i.R.M.t~..w...O....K8..wM5.....5.........A...E......%G}......._5B...gl.h........~v..G.%e...v'M..'........%.E.3.a....._+..T..+.3.S.G.!.q.7..&f.<..5`N.p ..K@..g....x.....\~k.$>......SP....h.........}#...i.Qv..Q.d....Y.....0.N.0...a...&..c`....\|...[..R.d....i.ZB.%\G..m%.....t.ZM/.O.2.u.]D..c.

C:\Users\user\Documents\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.862665894015821
Encrypted:	false
SSDEEP:	48:XW8uKXe6oy2eYCPHVfdv/yFsD/8O+0ifbTqdPZ0:XW8VXZoyXYCP1FU1Rbo0
MD5:	641D90EFFD62ED9217C81D1781AB0B1C
SHA1:	0E6D12BDBD50917CFE5441EDC10050F2B565921E
SHA-256:	4E255CA8B8666F0AB4D79F2854EF8F7CDBBA60EA2E7DB4857CB323FEE96B7D49
SHA-512:	5190E2B4FB8030AD3EBE53FAB04762331AC7FD07C38A35E339164F2CE5E479C7BB6D2B1EC8883458181895341EC88033B5C87BD5A19A5A06774D43B49E7A9CCD
Malicious:	false
Preview:	p...>6..O...V.s../c..Dk..\|w.. ..Mri.\.%.JT.e.g..n.+.W..9._....,.g..Y$93?...oX3&......X.$lP...>+&(_..gbrG0,3+.O.N......7.Q.W.9..(x..El7t{....)..!....'.1..`T..b...2.eIz.pQpL7.....7...=..cB..uA$c..x........I[E./..B4........9M..9%Q.J.,.]..w..x.b.....\\kh..g;..N...G.......c._/..?.1....#o...:...V.8x...P..T.>2....l..@..,......k.\|.t.............`ao&..6.N.^5Z.=...c...d.....&8..i..7...../..!k...8amq..r...ml.....ug........Q.^)m=E...6.".O..4Qa#Gd.X..E...h.X..,\.......?....G.......:....c O..Xp..{5.......e]..GH.....$..F..L.1..n....j.s..m..y%...r...>.Cz...JR.F.%-....F.U'/.a...m=....z..I...I.M,mSG.\|..[.%.....Y[..2.&....z.\F).......w.P.r...Q.%.M..h..'.(.x..........3........E(.".F.x..>R.On.t...........9Y...9.3.K......6....S.r...)...3}]...\|.3..w...=.......(.....[..H..FdR.t..@....a....N.G...nz..9.G...$....Y!...._.I._.......X...m.F..<gXm..K..7...5.....MO..#./.IJJ..%.n..o+ .r.>(.V..P....4./AX!8.QV.../f..Q=..*nO l........n....AG.m.{V.G...!r34..........D.....'..X....O

C:\Users\user\Documents\RAYHIWGKDI.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.862665894015821
Encrypted:	false
SSDEEP:	48:XW8uKXe6oy2eYCPHVfdv/yFsD/8O+0ifbTqdPZ0:XW8VXZoyXYCP1FU1Rbo0
MD5:	641D90EFFD62ED9217C81D1781AB0B1C
SHA1:	0E6D12BDBD50917CFE5441EDC10050F2B565921E
SHA-256:	4E255CA8B8666F0AB4D79F2854EF8F7CDBBA60EA2E7DB4857CB323FEE96B7D49
SHA-512:	5190E2B4FB8030AD3EBE53FAB04762331AC7FD07C38A35E339164F2CE5E479C7BB6D2B1EC8883458181895341EC88033B5C87BD5A19A5A06774D43B49E7A9CCD
Malicious:	false
Preview:	p...>6..O...V.s../c..Dk..\|w.. ..Mri.\.%.JT.e.g..n.+.W..9._....,.g..Y$93?...oX3&......X.$lP...>+&(_..gbrG0,3+.O.N......7.Q.W.9..(x..El7t{....)..!....'.1..`T..b...2.eIz.pQpL7.....7...=..cB..uA$c..x........I[E./..B4........9M..9%Q.J.,.]..w..x.b.....\\kh..g;..N...G.......c._/..?.1....#o...:...V.8x...P..T.>2....l..@..,......k.\|.t.............`ao&..6.N.^5Z.=...c...d.....&8..i..7...../..!k...8amq..r...ml.....ug........Q.^)m=E...6.".O..4Qa#Gd.X..E...h.X..,\.......?....G.......:....c O..Xp..{5.......e]..GH.....$..F..L.1..n....j.s..m..y%...r...>.Cz...JR.F.%-....F.U'/.a...m=....z..I...I.M,mSG.\|..[.%.....Y[..2.&....z.\F).......w.P.r...Q.%.M..h..'.(.x..........3........E(.".F.x..>R.On.t...........9Y...9.3.K......6....S.r...)...3}]...\|.3..w...=.......(.....[..H..FdR.t..@....a....N.G...nz..9.G...$....Y!...._.I._.......X...m.F..<gXm..K..7...5.....MO..#./.IJJ..%.n..o+ .r.>(.V..P....4./AX!8.QV.../f..Q=..*nO l........n....AG.m.{V.G...!r34..........D.....'..X....O

C:\Users\user\Documents\RAYHIWGKDI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.856183687181616
Encrypted:	false
SSDEEP:	24:ImY7efqPApbF6z4EB5eNHbJBDiLs8JhYi7vahUzoEBE4SgNqp+BfdlDyPWTspDs:IV8qPA5sEEBK7JBmLN50nUSiRyOqw
MD5:	77D136341A9572335BA56200F8EF684D
SHA1:	A81313454C7CD8CB083F6B8CB40965EA80687817
SHA-256:	3672F83BA3D30F17033BEBD4D0A0213D2856F0A3B0309D9E1DA3ACD91A4D8592
SHA-512:	B1F174C8C254DEA4F9ADC72F3205D4A08036A4538AE680CC4391255C9A5FF5BCDDBDE20F5458A587F3A8EC2AD1213C485FA0DE76A604C267D578BDADD16325E0
Malicious:	false
Preview:	........X...?y...Pj.......q.I]sF.KIfk3(...1.W.K......Y....@q-?..tp.....6.\|...p...d.)...be.G..q.wN...N`.G.r.t.n5...-.O?.A.t6D7.L...WU?.`../j...U..U.2....6..{.@&BT\..0]B...-,GD._..o).s..0.Y..P..u..iM..L.!...IJ.S..6....:.NCr.}...xa.\|:...-.`.i.3.d$.6...5.t....+..T.!$.e.0..U.`..il..1.-0&..!..gB)..j..4....Vs..:...#.K.ln..#N\....m..B.OO.%.Di.!..l.'.J.B......I...).89j+@C+.&.2N.{\|....t.O.-.k+.%.I3z?.B.7m.$....r.o..#.>$.Nf.Y.Cc.....%........M..cl..G./...m.....A.ic...E....LP.......pF.#....&@.;.aJ.Z.=9;.......e..A.h....p9.......3..[.I.$#.M.g......;.py.P@&#.4\|.....>.\F...&I.]..;.j..=Q.....bN....z...5.FP..fV.w\|-%...K...$.._...7..H....G04.F.O.0(..Mx).G....l.X.B8n..g............g.s9....5..g>...Cbb.Y...:..q^...Fq..:eX...d{....!dv....dm.....r.....4.wA...b^.m..."3.m.<]_..G.W..P.X...j,..'.Cw.).X..^.\|&iq!...b..T.%...s.8.3.F...f._.~...};..s.!h.rM..r.`4Df::'.e...)S....).#Fx.....l..3...?..d.......;.....~..Z[+..J.rI...1,....:$QU[......O.@.{.....J-.^

C:\Users\user\Documents\RAYHIWGKDI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.856183687181616
Encrypted:	false
SSDEEP:	24:ImY7efqPApbF6z4EB5eNHbJBDiLs8JhYi7vahUzoEBE4SgNqp+BfdlDyPWTspDs:IV8qPA5sEEBK7JBmLN50nUSiRyOqw
MD5:	77D136341A9572335BA56200F8EF684D
SHA1:	A81313454C7CD8CB083F6B8CB40965EA80687817
SHA-256:	3672F83BA3D30F17033BEBD4D0A0213D2856F0A3B0309D9E1DA3ACD91A4D8592
SHA-512:	B1F174C8C254DEA4F9ADC72F3205D4A08036A4538AE680CC4391255C9A5FF5BCDDBDE20F5458A587F3A8EC2AD1213C485FA0DE76A604C267D578BDADD16325E0
Malicious:	false
Preview:	........X...?y...Pj.......q.I]sF.KIfk3(...1.W.K......Y....@q-?..tp.....6.\|...p...d.)...be.G..q.wN...N`.G.r.t.n5...-.O?.A.t6D7.L...WU?.`../j...U..U.2....6..{.@&BT\..0]B...-,GD._..o).s..0.Y..P..u..iM..L.!...IJ.S..6....:.NCr.}...xa.\|:...-.`.i.3.d$.6...5.t....+..T.!$.e.0..U.`..il..1.-0&..!..gB)..j..4....Vs..:...#.K.ln..#N\....m..B.OO.%.Di.!..l.'.J.B......I...).89j+@C+.&.2N.{\|....t.O.-.k+.%.I3z?.B.7m.$....r.o..#.>$.Nf.Y.Cc.....%........M..cl..G./...m.....A.ic...E....LP.......pF.#....&@.;.aJ.Z.=9;.......e..A.h....p9.......3..[.I.$#.M.g......;.py.P@&#.4\|.....>.\F...&I.]..;.j..=Q.....bN....z...5.FP..fV.w\|-%...K...$.._...7..H....G04.F.O.0(..Mx).G....l.X.B8n..g............g.s9....5..g>...Cbb.Y...:..q^...Fq..:eX...d{....!dv....dm.....r.....4.wA...b^.m..."3.m.<]_..G.W..P.X...j,..'.Cw.).X..^.\|&iq!...b..T.%...s.8.3.F...f._.~...};..s.!h.rM..r.`4Df::'.e...)S....).#Fx.....l..3...?..d.......;.....~..Z[+..J.rI...1,....:$QU[......O.@.{.....J-.^

C:\Users\user\Documents\RAYHIWGKDI\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.890735953222033
Encrypted:	false
SSDEEP:	48:En61WveidgTICUQ8Uok24iCcm5UsV8vS2jRq0H5Hy/:EnpgTIJZrlmSsWvry/
MD5:	30D69D9787CAD7B47570CF456575CF51
SHA1:	65BEF4F7A7C7B83F177C6747E73F5C21AF0CD5E6
SHA-256:	E75870A9E4770C9693462E94F080D7AD7FED04CCDD48C0DCA7EDA675A4A55C64
SHA-512:	C27E4F5AAA91088E79287D808BAB515871722530E6751840FBA90BB65C19ADB6BF0CF996ADC360EBEE94B48315F33595B46FA20153A7E6A8E3210B2B825896DF
Malicious:	false
Preview:	-b...!.I..d.K...$.....3...S.>...Hg[.C?q..%...\|(w......2D.j"...v.&Xc...m.T.2.0.Kc....n.}.:E".Y.].2.x...!..Q=....#... .F)..o.O>._.....PN....g.j.A..V..,~....a@....ECH....+..X.jv3..m..s.J..EW/k...oKh_p/.7...-....e..D.l).H.#..Xw....0%s..d......w.b.....u.+.]...c.c...H..[#.......t..y.].w>{.....n0....u.A..Vd........_.j....4...RW..RS.K..:...../...I...a.1.fY.._....t..Gx.Ts..%....r..."........>:w...tDH.bcE..5.. .C.9.+...8Y!.b...s.'...;\_....?g...x......U....?......C5........f<9.g......nfG.v.......X&.Y^es$.P..p] .&..l.{i_.....ez..n0..>,...Z...5e...O...k:y...K..{.T3...j.b..%.....F./X.r...p5./.)f.W....]1W..o.=......A:........u...^$z9..<..i.Q.....9ap~...1....R.i9N.K+i.z$.....`O..h.h.>z..4...u.H.R. ..p..>...+W}c-g.........D/......J-...].W.2...L..\.....,..;'..,..KK;.g;..X...N}2#....P....._...)1..L<W.eH.h....p.).gQ........u6U7..u.`.M...0.}.......3H'..L.H.O.}.L..............zA...?..3.....>.'.h.....C....5R..hI;...P.2e!.......4.......nB.q......

C:\Users\user\Documents\RAYHIWGKDI\LSBIHQFDVT.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.890735953222033
Encrypted:	false
SSDEEP:	48:En61WveidgTICUQ8Uok24iCcm5UsV8vS2jRq0H5Hy/:EnpgTIJZrlmSsWvry/
MD5:	30D69D9787CAD7B47570CF456575CF51
SHA1:	65BEF4F7A7C7B83F177C6747E73F5C21AF0CD5E6
SHA-256:	E75870A9E4770C9693462E94F080D7AD7FED04CCDD48C0DCA7EDA675A4A55C64
SHA-512:	C27E4F5AAA91088E79287D808BAB515871722530E6751840FBA90BB65C19ADB6BF0CF996ADC360EBEE94B48315F33595B46FA20153A7E6A8E3210B2B825896DF
Malicious:	false
Preview:	-b...!.I..d.K...$.....3...S.>...Hg[.C?q..%...\|(w......2D.j"...v.&Xc...m.T.2.0.Kc....n.}.:E".Y.].2.x...!..Q=....#... .F)..o.O>._.....PN....g.j.A..V..,~....a@....ECH....+..X.jv3..m..s.J..EW/k...oKh_p/.7...-....e..D.l).H.#..Xw....0%s..d......w.b.....u.+.]...c.c...H..[#.......t..y.].w>{.....n0....u.A..Vd........_.j....4...RW..RS.K..:...../...I...a.1.fY.._....t..Gx.Ts..%....r..."........>:w...tDH.bcE..5.. .C.9.+...8Y!.b...s.'...;\_....?g...x......U....?......C5........f<9.g......nfG.v.......X&.Y^es$.P..p] .&..l.{i_.....ez..n0..>,...Z...5e...O...k:y...K..{.T3...j.b..%.....F./X.r...p5./.)f.W....]1W..o.=......A:........u...^$z9..<..i.Q.....9ap~...1....R.i9N.K+i.z$.....`O..h.h.>z..4...u.H.R. ..p..>...+W}c-g.........D/......J-...].W.2...L..\.....,..;'..,..KK;.g;..X...N}2#....P....._...)1..L<W.eH.h....p.).gQ........u6U7..u.`.M...0.}.......3H'..L.H.O.}.L..............zA...?..3.....>.'.h.....C....5R..hI;...P.2e!.......4.......nB.q......

C:\Users\user\Documents\RAYHIWGKDI\QNCYCDFIJJ.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.860319196135951
Encrypted:	false
SSDEEP:	48:YEwG8YZKCafvOxlQGQvkKxnwzWP7OfoAf:Y/YRivOsGwkswzgg
MD5:	BF3976F3DC9A0B4F10A99DA977AEDCC3
SHA1:	C419934405EB6E882BAB2BCA6F39E586D55BE122
SHA-256:	EBA588B2D629E6D49E2A5A1ED82C8B9EEC88024867AFE667DD0417DD2E31DB38
SHA-512:	170D038D5C3E3AF0B3DF37D6F2A82616FF1C9D3C05EB2130FAB49CE64749B156BBB3A47BA24FB2C67588053A889EE6151603F13E63D531F327EC11D8AF97232D
Malicious:	false
Preview:	.........u.9f%..7...I#..^.a..F.&.h.jV&B..#......(.v^..>.)...G...o..2.a,..L...(.@.......A.-.>X...u-$m..;.kF.\..=..z.....a..@.b.m..W.T..u.,(B.kIF..>..&..#y..3.... .$.2.b.k...DZ@..@.,....@.5....v.J........`R......5..s.J]:....R.I..=..,.........):D..+...ICS.GR..K&fb)..T.\.....OU.].z.w.r.2.~.....5+.E..z...f.+.1..B..i...2?].._\.d.Q^..]...}..t......o....B......T.Z....!..uS..f....f..J...eSM$..`.....9..%K.}FP:.Q..(.w.5....\.-.f.{...9...-.....m.oe2..r.".O.&.&.t:...@Y.:.)..C.#..)eb....RfoO...H.B.\..$....\l.^..)2.(...6....r..Y.....!.U..^..9+...v.~.)...=K.M........p...q;.....>.....6.......A.K..A#.....\|_jX.&...jq`V......#.L....h..k..}H..5.........F.......MYugq$2.zm.......X....y@.....<.....,.......{!.c:......TSa.4. ..Yu..V.0S..........g.....\|...>....B.J..&D..b.(.?...m...t.......2.:5U..}v..F^X.Ev8..cJ!j.....Q ......Y.~Uv#...8...Q...pM........]\....Ifi.N...Ke..+..kvG:....2J)M..@.@..$B...~wk.......r.....+...8.b.A.9.} J.....\|.Ak.j ...IC._..CW....7.b...

C:\Users\user\Documents\RAYHIWGKDI\QNCYCDFIJJ.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.860319196135951
Encrypted:	false
SSDEEP:	48:YEwG8YZKCafvOxlQGQvkKxnwzWP7OfoAf:Y/YRivOsGwkswzgg
MD5:	BF3976F3DC9A0B4F10A99DA977AEDCC3
SHA1:	C419934405EB6E882BAB2BCA6F39E586D55BE122
SHA-256:	EBA588B2D629E6D49E2A5A1ED82C8B9EEC88024867AFE667DD0417DD2E31DB38
SHA-512:	170D038D5C3E3AF0B3DF37D6F2A82616FF1C9D3C05EB2130FAB49CE64749B156BBB3A47BA24FB2C67588053A889EE6151603F13E63D531F327EC11D8AF97232D
Malicious:	false
Preview:	.........u.9f%..7...I#..^.a..F.&.h.jV&B..#......(.v^..>.)...G...o..2.a,..L...(.@.......A.-.>X...u-$m..;.kF.\..=..z.....a..@.b.m..W.T..u.,(B.kIF..>..&..#y..3.... .$.2.b.k...DZ@..@.,....@.5....v.J........`R......5..s.J]:....R.I..=..,.........):D..+...ICS.GR..K&fb)..T.\.....OU.].z.w.r.2.~.....5+.E..z...f.+.1..B..i...2?].._\.d.Q^..]...}..t......o....B......T.Z....!..uS..f....f..J...eSM$..`.....9..%K.}FP:.Q..(.w.5....\.-.f.{...9...-.....m.oe2..r.".O.&.&.t:...@Y.:.)..C.#..)eb....RfoO...H.B.\..$....\l.^..)2.(...6....r..Y.....!.U..^..9+...v.~.)...=K.M........p...q;.....>.....6.......A.K..A#.....\|_jX.&...jq`V......#.L....h..k..}H..5.........F.......MYugq$2.zm.......X....y@.....<.....,.......{!.c:......TSa.4. ..Yu..V.0S..........g.....\|...>....B.J..&D..b.(.?...m...t.......2.:5U..}v..F^X.Ev8..cJ!j.....Q ......Y.~Uv#...8...Q...pM........]\....Ifi.N...Ke..+..kvG:....2J)M..@.@..$B...~wk.......r.....+...8.b.A.9.} J.....\|.Ak.j ...IC._..CW....7.b...

C:\Users\user\Documents\RAYHIWGKDI\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.855705430759494
Encrypted:	false
SSDEEP:	24:KQhUNaoEj1KNz+VK6UKGUSvdxdnTtY2CW7YBERb/n5t9hkZluvM2qrBoQjkc:ThNjmN6UjPBTO2RNRb/rrZk/BoQwc
MD5:	4D5CDD635062B47B8A04D98BE41BDEF5
SHA1:	9D8DE9FDA365A1044CC6511BF42ED91A44B1A158
SHA-256:	C165F23F072427904BAEDBE75FDA6FB80A28FED1398001F87953F55AD33376E4
SHA-512:	EBEE5F5295933FDD01B204B705C73DD42E07B2EC13A5EFE57D3AAE9EE4DA3D0FD40DCFC7334B0725913E8A216BF157FED71AF99B0D1AF615DB690CFA7D7BDACF
Malicious:	false
Preview:	~q..]:`.c>=..t. ...#.g.4..c.......a./.4....\|T#../w......ery....Da2.T....4.0ni.[t.U......J>.ED.......\rc...i_{.).........$.'%..\]r.a!6..HC..kx.a........-p.Q.VgRR.?%D.z..d.,..:..........G.r.j......_...fc&.\|.9.....\|.p@..[.W.;..v..]/....kP........B....,T.x,).]....9.W.R..`...D.g..M..f.kj.2..*....J...-dn....wr.K.5<..Y.TU........8.C.G....A..{.m....y...v7./.I...+rQ....8V.c..........G..W...W....O/.t.rlr.5..^;.wx..=...J..%..q..)........B..y^M.+.p~...F......H"......L/.5..N..f4...g..oD...E....cd.`... ....Z.h.3`.k9u'v...C...],..&t._.c,.b...r...~lv.G.>..@../.#2.?...{H"U-.5a.o..V.\.....Z...S<..]..B...z.;..D.?jtC..B.mY ......~\|.).t{.am..k........z..a.N.....8.5E].....H..k"I..o.^T.q+&.a.2....W.Q:..L...7.!...#(...I.c..F...>>.h.T......#....w..Z.$x.....D..~.....D{...8.].}.k.......j.&..... w..vm..t....".U....+..e.d...AZ......l.l....#Z.Kv..!().(..~...F.....7.w.....WX.8..t..E..!..e.......qg.x...zd.\|..\|.....P...........F,Aau.g......a%...6x&...\.....J.T..G

C:\Users\user\Documents\RAYHIWGKDI\RAYHIWGKDI.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.855705430759494
Encrypted:	false
SSDEEP:	24:KQhUNaoEj1KNz+VK6UKGUSvdxdnTtY2CW7YBERb/n5t9hkZluvM2qrBoQjkc:ThNjmN6UjPBTO2RNRb/rrZk/BoQwc
MD5:	4D5CDD635062B47B8A04D98BE41BDEF5
SHA1:	9D8DE9FDA365A1044CC6511BF42ED91A44B1A158
SHA-256:	C165F23F072427904BAEDBE75FDA6FB80A28FED1398001F87953F55AD33376E4
SHA-512:	EBEE5F5295933FDD01B204B705C73DD42E07B2EC13A5EFE57D3AAE9EE4DA3D0FD40DCFC7334B0725913E8A216BF157FED71AF99B0D1AF615DB690CFA7D7BDACF
Malicious:	false
Preview:	~q..]:`.c>=..t. ...#.g.4..c.......a./.4....\|T#../w......ery....Da2.T....4.0ni.[t.U......J>.ED.......\rc...i_{.).........$.'%..\]r.a!6..HC..kx.a........-p.Q.VgRR.?%D.z..d.,..:..........G.r.j......_...fc&.\|.9.....\|.p@..[.W.;..v..]/....kP........B....,T.x,).]....9.W.R..`...D.g..M..f.kj.2..*....J...-dn....wr.K.5<..Y.TU........8.C.G....A..{.m....y...v7./.I...+rQ....8V.c..........G..W...W....O/.t.rlr.5..^;.wx..=...J..%..q..)........B..y^M.+.p~...F......H"......L/.5..N..f4...g..oD...E....cd.`... ....Z.h.3`.k9u'v...C...],..&t._.c,.b...r...~lv.G.>..@../.#2.?...{H"U-.5a.o..V.\.....Z...S<..]..B...z.;..D.?jtC..B.mY ......~\|.).t{.am..k........z..a.N.....8.5E].....H..k"I..o.^T.q+&.a.2....W.Q:..L...7.!...#(...I.c..F...>>.h.T......#....w..Z.$x.....D..~.....D{...8.].}.k.......j.&..... w..vm..t....".U....+..e.d...AZ......l.l....#Z.Kv..!().(..~...F.....7.w.....WX.8..t..E..!..e.......qg.x...zd.\|..\|.....P...........F,Aau.g......a%...6x&...\.....J.T..G

C:\Users\user\Documents\RAYHIWGKDI\SFPUSAFIOL.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8515692879021906
Encrypted:	false
SSDEEP:	24:tLjZix4T73YHAXcf7t81/0QvmX8j5FJOJd0Qo2aM8//YM0YDl0l245DFworZ:tLjxTDYHAXq7q1Ve8NQMaBYxe22tN
MD5:	B0249E344FF8678717E348A33C5FD54C
SHA1:	42B57BE6B0709C6D3DBFB0AF49EADC8F92E151F3
SHA-256:	8AB6C42C2DE3812D347425D44BCDDD40B97A81C9E45693ADADC2C12C33F47C3A
SHA-512:	9DE3654FB4B0A800AD91D1F5E6915568591EE6D193A292764C04F4AA69265E4CB2676A76820B8114C2BED47ECA3B667CE5B52F8270D33AF2C6D230A96568E128
Malicious:	false
Preview:	-..+.&.&g>...5_>....b.e..zf.S. .........B....f....?+^.....-.y..^m'1<.B4` .S...G.....R!.@...eT.4...$.F)....ho5...Y\.W..r....5^!.l.. ...B .A.&.H#....Q.....o8.n..(.z...m0..XE8...H..Jz.P..gb..`.W.....^.O..S.$..v.....U..q...S.W....7A...G.Z...%..K... T...r.......8=$.(..........I1G.<.$a[0f_qDnJx...n*...,.[..T..!..6.F.d..S..v.&d......-VL..E......Ju,-...`.DbJzxe.p.......pO..a0......I.f...l@].T.T2....V.y..+2Z=l5....nCKp...b.z._..F..n.]e.3mZb.`.k.k.X..\D...A>..m..C..V......h..c......Y...YT7-'......i..a[.f.......Z...S.P.. ..^..b..e(.;...IW...x.w.....k...>.........DK..t.f...........Z..a\kG7..L'F.b.......I.{.`9A\?..d...!..._bq..}+.8..w..aE0S.3+...H....9...soo.':c..FA..a....c..].fx...X.......T..B.JW...u.k......9..G&..6V..4e8....t...3O.f]."..'.?..........Uz......B.F.....&.q..>2Pu./.g..,.V.....h;.=./......1......).....I..g}...Z......+....m.g..S%..r.........FG.v.A..Em...j....%w.X.Y>....\pU.....!-.....W.w...C...... sVw...\...H.S._..q.B.2...OK.\...9..(zI

C:\Users\user\Documents\RAYHIWGKDI\SFPUSAFIOL.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8515692879021906
Encrypted:	false
SSDEEP:	24:tLjZix4T73YHAXcf7t81/0QvmX8j5FJOJd0Qo2aM8//YM0YDl0l245DFworZ:tLjxTDYHAXq7q1Ve8NQMaBYxe22tN
MD5:	B0249E344FF8678717E348A33C5FD54C
SHA1:	42B57BE6B0709C6D3DBFB0AF49EADC8F92E151F3
SHA-256:	8AB6C42C2DE3812D347425D44BCDDD40B97A81C9E45693ADADC2C12C33F47C3A
SHA-512:	9DE3654FB4B0A800AD91D1F5E6915568591EE6D193A292764C04F4AA69265E4CB2676A76820B8114C2BED47ECA3B667CE5B52F8270D33AF2C6D230A96568E128
Malicious:	false
Preview:	-..+.&.&g>...5_>....b.e..zf.S. .........B....f....?+^.....-.y..^m'1<.B4` .S...G.....R!.@...eT.4...$.F)....ho5...Y\.W..r....5^!.l.. ...B .A.&.H#....Q.....o8.n..(.z...m0..XE8...H..Jz.P..gb..`.W.....^.O..S.$..v.....U..q...S.W....7A...G.Z...%..K... T...r.......8=$.(..........I1G.<.$a[0f_qDnJx...n*...,.[..T..!..6.F.d..S..v.&d......-VL..E......Ju,-...`.DbJzxe.p.......pO..a0......I.f...l@].T.T2....V.y..+2Z=l5....nCKp...b.z._..F..n.]e.3mZb.`.k.k.X..\D...A>..m..C..V......h..c......Y...YT7-'......i..a[.f.......Z...S.P.. ..^..b..e(.;...IW...x.w.....k...>.........DK..t.f...........Z..a\kG7..L'F.b.......I.{.`9A\?..d...!..._bq..}+.8..w..aE0S.3+...H....9...soo.':c..FA..a....c..].fx...X.......T..B.JW...u.k......9..G&..6V..4e8....t...3O.f]."..'.?..........Uz......B.F.....&.q..>2Pu./.g..,.V.....h;.=./......1......).....I..g}...Z......+....m.g..S%..r.........FG.v.A..Em...j....%w.X.Y>....\pU.....!-.....W.w...C...... sVw...\...H.S._..q.B.2...OK.\...9..(zI

C:\Users\user\Documents\RAYHIWGKDI\SQRKHNBNYN.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.870984419895704
Encrypted:	false
SSDEEP:	24:gD6sz4RV+Bpg6cZVcec1rYDt3VOaCmFNOyKlgCd4CJB7twlJhWCrkKGhlWe:G6soV+wtV1aYDt3VtCeQ7nYlGye
MD5:	3D9D10756A27196C84B8690B87DEBA67
SHA1:	5A4AFC2BE09D5FDACF4A61B8F8C306D040E4759D
SHA-256:	7D1A7FDB54A22B58AA20C50314744F684C890AB9331CA9688F3C7FBAF4C87B9F
SHA-512:	70E853E9FCA44D26E62A9DAE16EBD0307381FDA70C3B883C64CC1BE1CF2040561724D5F2DEC4E193F56BE52582BBD94C3DD386EC23601489A7E1B265C78573F0
Malicious:	false
Preview:	{1.I`.`Y.wG,i.Y.VK.(....qTND../\|...5..~...W.AF....^...V.......\..5..Mg.H[.p.s..B...z.?.@p.-.t.T:Ch.+e.D3_u..m.{2...b.z[?JG.;.p..l.=x.`x.J..++!..S..r..ZG=P.{.CT..>IF.Jvcd.~..Ta..?....T:U5.A..7<.!../.J......q..-+...H".6Q.9_...$G&.c.,...8.n...b....X$.fD.N...{.RI..%......,..........F...d.N....c..Y.B...j........g.NY.4;bE...D1...34..$.?2;E...N <5q-+~.....M..43..4..@..7..BG.n...R......@...5.+. ..O...{/Vo./.M.y...">\..A&]....]..w...G.^5\7..A)dK..o........U..."L.@..D.!....TI.)...D...V.e.!...g....5(.....y$ \|/.V.6.<r...D..hR8.,.,..:..o.o`.sB...m.C'.t..#..\'S..qo.}...hB........#........V.....".$..z....K..Z.....K.X..;3`{...18.jODS.y.-f.z.....QJW...G...O..2.?P.a...........^#wc3L $.....C..\S........4....T...V(e..<.......D. u.7..O......6................0%........j.`._.....e!..O..L.yt.W.Z.^..o...Q'..N.Rrk...\.N.o.>6W.._..\|.`..l....e.]....W..^.\.%6.T.c..?..Z.....a..^IM.@.......r...O[.g. _7.B..y\1.......a.m. .C..o.L.$.O...*`u<..rl6..)X....h.d.z

C:\Users\user\Documents\RAYHIWGKDI\SQRKHNBNYN.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.870984419895704
Encrypted:	false
SSDEEP:	24:gD6sz4RV+Bpg6cZVcec1rYDt3VOaCmFNOyKlgCd4CJB7twlJhWCrkKGhlWe:G6soV+wtV1aYDt3VtCeQ7nYlGye
MD5:	3D9D10756A27196C84B8690B87DEBA67
SHA1:	5A4AFC2BE09D5FDACF4A61B8F8C306D040E4759D
SHA-256:	7D1A7FDB54A22B58AA20C50314744F684C890AB9331CA9688F3C7FBAF4C87B9F
SHA-512:	70E853E9FCA44D26E62A9DAE16EBD0307381FDA70C3B883C64CC1BE1CF2040561724D5F2DEC4E193F56BE52582BBD94C3DD386EC23601489A7E1B265C78573F0
Malicious:	false
Preview:	{1.I`.`Y.wG,i.Y.VK.(....qTND../\|...5..~...W.AF....^...V.......\..5..Mg.H[.p.s..B...z.?.@p.-.t.T:Ch.+e.D3_u..m.{2...b.z[?JG.;.p..l.=x.`x.J..++!..S..r..ZG=P.{.CT..>IF.Jvcd.~..Ta..?....T:U5.A..7<.!../.J......q..-+...H".6Q.9_...$G&.c.,...8.n...b....X$.fD.N...{.RI..%......,..........F...d.N....c..Y.B...j........g.NY.4;bE...D1...34..$.?2;E...N <5q-+~.....M..43..4..@..7..BG.n...R......@...5.+. ..O...{/Vo./.M.y...">\..A&]....]..w...G.^5\7..A)dK..o........U..."L.@..D.!....TI.)...D...V.e.!...g....5(.....y$ \|/.V.6.<r...D..hR8.,.,..:..o.o`.sB...m.C'.t..#..\'S..qo.}...hB........#........V.....".$..z....K..Z.....K.X..;3`{...18.jODS.y.-f.z.....QJW...G...O..2.?P.a...........^#wc3L $.....C..\S........4....T...V(e..<.......D. u.7..O......6................0%........j.`._.....e!..O..L.yt.W.Z.^..o...Q'..N.Rrk...\.N.o.>6W.._..\|.`..l....e.]....W..^.\.%6.T.c..?..Z.....a..^IM.@.......r...O[.g. _7.B..y\1.......a.m. .C..o.L.$.O...*`u<..rl6..)X....h.d.z

C:\Users\user\Documents\RAYHIWGKDI\WKXEWIOTXI.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.850970578794615
Encrypted:	false
SSDEEP:	24:ERCko+qjNbjBcGnkLo+91THK64HYvj3AhHWbB3h9D1znAJ7a+wOeDdEFdYONWLMY:KRsjNyGQXTq8beHg9hpdileJuRNhz4V
MD5:	BC1E74BF2A71F80A5CC77CE04BF45F2A
SHA1:	DAC8CC77C8AFB08C940FF9BA65FB49352DB7C654
SHA-256:	F3170E4BECCA211C9DFF16CCC4984A1D5D794FF67CC42BFDE667B78018BFE695
SHA-512:	16E9DE898400B464B5354B8AF8A238196642A3491BD433E7A62BE022606066992AE50D2D0AFAE3CA115A7C2C3F28B407EC648D0E0211D75CD5DDDAF0E9299DF3
Malicious:	false
Preview:	.."E.!K..u..d}..}.........Ze.3.$c...;Z..&....c..Q....oBBV..}....X5...@\|&.R...'H.i.uA.s.z....A\|.<U.X..0...'.u.z.B.p...#.....X.r.`.q..........+SJ...._4a.....n..P4z...y.zF.j6n..]DJF .BE...x.....H1y......J.E..y..q...3...r3.........`...8..a...t.....y......x.....N^.D..U~...e8DL.....34U.S;.X{i.s.=.0,..;...7....ec.GM'.s.bal.ylF.i..3..].^..<.6..f...&....HK......j...JT.....M.=....K......e.0.l4/...0j..F$........C..^...R..$.Q.}...7.b.t......vf...E..H...W....x6=\.....b%.A.l.L..M...5{..w......".\.~.?:_6......\|..@`.g./QO)..>./.. ...4q.$}..?$ob-6%....!Z......628.....^^..?.t.-F....gD.Y.C.E..&...d.>c.P,.V`.<!DG6...8o4G..?.v...\..)s..71.Y. ..l.....%.].o.i.5.Z....Y...w.:.{.{_O..f..Z.nH.Jg.=.]/...j+.p,.VB...O...O..s.....g....>.m#..K^{.n^. .P..[..g.].].0.. ....(..[5.....rP..6.?c.B.M....M...B.).k,.......Hg.D......-..b...{....n....b..RP.h.0...A.R.i.U.h.J..4...d....%=$\|_Mlf1..1.~. ...DyCGr6Dc.......b....#R....+%F..ip....~..'?.).~c.........

C:\Users\user\Documents\RAYHIWGKDI\WKXEWIOTXI.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.850970578794615
Encrypted:	false
SSDEEP:	24:ERCko+qjNbjBcGnkLo+91THK64HYvj3AhHWbB3h9D1znAJ7a+wOeDdEFdYONWLMY:KRsjNyGQXTq8beHg9hpdileJuRNhz4V
MD5:	BC1E74BF2A71F80A5CC77CE04BF45F2A
SHA1:	DAC8CC77C8AFB08C940FF9BA65FB49352DB7C654
SHA-256:	F3170E4BECCA211C9DFF16CCC4984A1D5D794FF67CC42BFDE667B78018BFE695
SHA-512:	16E9DE898400B464B5354B8AF8A238196642A3491BD433E7A62BE022606066992AE50D2D0AFAE3CA115A7C2C3F28B407EC648D0E0211D75CD5DDDAF0E9299DF3
Malicious:	false
Preview:	.."E.!K..u..d}..}.........Ze.3.$c...;Z..&....c..Q....oBBV..}....X5...@\|&.R...'H.i.uA.s.z....A\|.<U.X..0...'.u.z.B.p...#.....X.r.`.q..........+SJ...._4a.....n..P4z...y.zF.j6n..]DJF .BE...x.....H1y......J.E..y..q...3...r3.........`...8..a...t.....y......x.....N^.D..U~...e8DL.....34U.S;.X{i.s.=.0,..;...7....ec.GM'.s.bal.ylF.i..3..].^..<.6..f...&....HK......j...JT.....M.=....K......e.0.l4/...0j..F$........C..^...R..$.Q.}...7.b.t......vf...E..H...W....x6=\.....b%.A.l.L..M...5{..w......".\.~.?:_6......\|..@`.g./QO)..>./.. ...4q.$}..?$ob-6%....!Z......628.....^^..?.t.-F....gD.Y.C.E..&...d.>c.P,.V`.<!DG6...8o4G..?.v...\..)s..71.Y. ..l.....%.].o.i.5.Z....Y...w.:.{.{_O..f..Z.nH.Jg.=.]/...j+.p,.VB...O...O..s.....g....>.m#..K^{.n^. .P..[..g.].].0.. ....(..[5.....rP..6.?c.B.M....M...B.).k,.......Hg.D......-..b...{....n....b..RP.h.0...A.R.i.U.h.J..4...d....%=$\|_Mlf1..1.~. ...DyCGr6Dc.......b....#R....+%F..ip....~..'?.).~c.........

C:\Users\user\Documents\RAYHIWGKDI\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	true
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Documents\SFPUSAFIOL.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.86438535449327
Encrypted:	false
SSDEEP:	24:RD9a6+uUOtybDDkc7bGrftpIVgGQ2GH6wj4RerQVbTVbRAHOb16X0:ja7r7bGrftpONQXH6wjGeeV9mu16k
MD5:	8FB55AC0E7AFDB9718615C6900392DA5
SHA1:	5EBE7E290FBCD261FBC1EC92E08730D0F539C06E
SHA-256:	D1C0F823F8D47535EDB340DF852889480DDCE3E14CBE55FDF6986161223D0C4B
SHA-512:	897E4891A48D7B07D86A20F32D81A7F0D0D02917EA0436666845AF3BFFCA8CFF832445C015632EAF61E87E0CDA9AD9FD74CF2B608D9F7EB531A0B5EB2D68B27C
Malicious:	false
Preview:	..'.y.$..<.UXZ-..8.h..`<V6..$..l....<...v..@..0S..;\|J.2G.....j.T.).hem.[T.........+..p..4.'ZZ....6..r.@Y ..#H..3O^...4....g.3 ~U..!k.5ysX....:#._....K.~S..X=2.....X.x.w.2sk._ ......P..q..6...D.........~.........8...0.j.....Y.Y'5..~D..{`h...4."...A....iq^.[..Hq..u ....08...y1(.F8").......@....gk...].nD..y.M'..gnM..=.>Q.....k[.ME6\|..DG.....L..{...2........C_......v.....i...........{.pg..1RV]E.G.....v.q. ...W.X&.f....J......n%..T/...}O.0b.i. vZS.lH....-Z......[...!...c..k..U..(.hRB3..S......?.......D5..mB..zW.9y.N.+.S.K..s'....;.a......Zju.X.v........u..s..(......)....,^.XQ...@..Iww..W...=.wftK..X.a>...#.lp...P....rh.Cj'B.........q.....A...Q[.. ..\..l,.i...?.%{qCs#Y?.l..#...!.x..?VH^4.,...dE".&..u4...gW.......R$v...B}Bae.U5....G.V.q2......V......N...}..`......T..E......hy....\|......e1.t.+~%.P....?..v..I.....H...by..^fU....+fS.8.i....3......0..%N....-...H..xd..6.....K^...&F...*Z........-...;J.^...V....;..)U...X...ixO.8v..1....

C:\Users\user\Documents\SFPUSAFIOL.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.86438535449327
Encrypted:	false
SSDEEP:	24:RD9a6+uUOtybDDkc7bGrftpIVgGQ2GH6wj4RerQVbTVbRAHOb16X0:ja7r7bGrftpONQXH6wjGeeV9mu16k
MD5:	8FB55AC0E7AFDB9718615C6900392DA5
SHA1:	5EBE7E290FBCD261FBC1EC92E08730D0F539C06E
SHA-256:	D1C0F823F8D47535EDB340DF852889480DDCE3E14CBE55FDF6986161223D0C4B
SHA-512:	897E4891A48D7B07D86A20F32D81A7F0D0D02917EA0436666845AF3BFFCA8CFF832445C015632EAF61E87E0CDA9AD9FD74CF2B608D9F7EB531A0B5EB2D68B27C
Malicious:	false
Preview:	..'.y.$..<.UXZ-..8.h..`<V6..$..l....<...v..@..0S..;\|J.2G.....j.T.).hem.[T.........+..p..4.'ZZ....6..r.@Y ..#H..3O^...4....g.3 ~U..!k.5ysX....:#._....K.~S..X=2.....X.x.w.2sk._ ......P..q..6...D.........~.........8...0.j.....Y.Y'5..~D..{`h...4."...A....iq^.[..Hq..u ....08...y1(.F8").......@....gk...].nD..y.M'..gnM..=.>Q.....k[.ME6\|..DG.....L..{...2........C_......v.....i...........{.pg..1RV]E.G.....v.q. ...W.X&.f....J......n%..T/...}O.0b.i. vZS.lH....-Z......[...!...c..k..U..(.hRB3..S......?.......D5..mB..zW.9y.N.+.S.K..s'....;.a......Zju.X.v........u..s..(......)....,^.XQ...@..Iww..W...=.wftK..X.a>...#.lp...P....rh.Cj'B.........q.....A...Q[.. ..\..l,.i...?.%{qCs#Y?.l..#...!.x..?VH^4.,...dE".&..u4...gW.......R$v...B}Bae.U5....G.V.q2......V......N...}..`......T..E......hy....\|......e1.t.+~%.P....?..v..I.....H...by..^fU....+fS.8.i....3......0..%N....-...H..xd..6.....K^...&F...*Z........-...;J.^...V....;..)U...X...ixO.8v..1....

C:\Users\user\Documents\SFPUSAFIOL.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868254153492754
Encrypted:	false
SSDEEP:	24:uist7NqDPaGg4w7xmg9P+246KKAwHSgFva852xxhF/IblnmD2gAm7KyfpKi:mt7NqDPaG4P+ZwHSG2EblmD2baNfT
MD5:	26427EF1FF2B056A348B06511772E493
SHA1:	990BC6C34E0041263EE7D263F38B39166FC96ECB
SHA-256:	4D79AFCF8A48A6454E515C455B7B8F6991E97BD803FB02593DC50BB1F4FE30FB
SHA-512:	FAEC7A1706B3C40F143B5014DB6FF06BE1B46C5A021393E1B6B5D88BEA6AF7CCDF13CC97F69E517EF8842583A555B6C700BC79E65E13DC0FB1674D94EF741722
Malicious:	false
Preview:	.<fc.e....x.t".;y.?q.. .3......+?....p....s.....\|..v.6....."C.%.E@+.?.L......6.9...G$FqU..=.+...\.......r.QE...w....{.D.a.T......D..I.w}.AT......_pK..v..M....w...4.....x.#!u..j.@...<.h........?.T.\....9.p6L.7[.T...c.o._<.4..r4...tUkW@.._.;x2.$...........y.g6...f.PR/<.E...s.H.R..I..............P.!..HQ...p"...H.N.8.qK./.@........A..M..0.o.?1...?....j.-_.e.4.j.....Ss.mQ[y.V_.LZ. 5.A....d.p.!....p.#<>V5........._\.....8...I..lmx..0.....Ty........C.p5...\|C..t/!....~^Z~..Tf..N.m......B...~....0@.....,......l...;I@/.`4(Ms.2?....m.}..4.........?..uz.m..^..$[.#.Y=j.J..K...Ya.qH\|.7..iP.......T.$.3...?..q.h.7.w...W..xV.)2.M....K..Q..<.....C.."....[...gu.....D.{K.C.......O..........+d.......C.N..5.X.\|.....n.?.N .G....aP.<. ...`Eg....iI,.UBh.7....l;..Z.s..[.lu.>.....6..........wi@M...j....o..u....F..mt..s\|....0C.m..*..lA.X.k...........).A.).h...i.P.5.[qT)...p.l\|..r.!%..>.=......I.....5_kw...';Au].O..s.f..~...x....&b.KAA........:.,`}O...'y..v}..=.S...

C:\Users\user\Documents\SFPUSAFIOL.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868254153492754
Encrypted:	false
SSDEEP:	24:uist7NqDPaGg4w7xmg9P+246KKAwHSgFva852xxhF/IblnmD2gAm7KyfpKi:mt7NqDPaG4P+ZwHSG2EblmD2baNfT
MD5:	26427EF1FF2B056A348B06511772E493
SHA1:	990BC6C34E0041263EE7D263F38B39166FC96ECB
SHA-256:	4D79AFCF8A48A6454E515C455B7B8F6991E97BD803FB02593DC50BB1F4FE30FB
SHA-512:	FAEC7A1706B3C40F143B5014DB6FF06BE1B46C5A021393E1B6B5D88BEA6AF7CCDF13CC97F69E517EF8842583A555B6C700BC79E65E13DC0FB1674D94EF741722
Malicious:	false
Preview:	.<fc.e....x.t".;y.?q.. .3......+?....p....s.....\|..v.6....."C.%.E@+.?.L......6.9...G$FqU..=.+...\.......r.QE...w....{.D.a.T......D..I.w}.AT......_pK..v..M....w...4.....x.#!u..j.@...<.h........?.T.\....9.p6L.7[.T...c.o._<.4..r4...tUkW@.._.;x2.$...........y.g6...f.PR/<.E...s.H.R..I..............P.!..HQ...p"...H.N.8.qK./.@........A..M..0.o.?1...?....j.-_.e.4.j.....Ss.mQ[y.V_.LZ. 5.A....d.p.!....p.#<>V5........._\.....8...I..lmx..0.....Ty........C.p5...\|C..t/!....~^Z~..Tf..N.m......B...~....0@.....,......l...;I@/.`4(Ms.2?....m.}..4.........?..uz.m..^..$[.#.Y=j.J..K...Ya.qH\|.7..iP.......T.$.3...?..q.h.7.w...W..xV.)2.M....K..Q..<.....C.."....[...gu.....D.{K.C.......O..........+d.......C.N..5.X.\|.....n.?.N .G....aP.<. ...`Eg....iI,.UBh.7....l;..Z.s..[.lu.>.....6..........wi@M...j....o..u....F..mt..s\|....0C.m..*..lA.X.k...........).A.).h...i.P.5.[qT)...p.l\|..r.!%..>.=......I.....5_kw...';Au].O..s.f..~...x....&b.KAA........:.,`}O...'y..v}..=.S...

C:\Users\user\Documents\SQRKHNBNYN.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.884023693521131
Encrypted:	false
SSDEEP:	48:MErnbpkQZXWEnDGA9Ij4XZkwSXoM/Adijdy3sU7f:HZtmqiA96aiw+YcbGf
MD5:	8C5EED787B048325943EDCBE481F0008
SHA1:	C1CA10C83AFE706D1251D89D8CE9E3349FD9AEFF
SHA-256:	3AB68A49CAE515B12BA3EF5C2E1A08C12B93603861F27640DDD3B938EA1577D6
SHA-512:	C2133D7DF58FE8E2C38B02EACD71B6683C1ACB3903DB9C025BE84202AFE47D0ACB1C43B36026E0EABA9763F6C686F8CA93AF4566CF9E6A297BD8BF067621395F
Malicious:	false
Preview:	mq9....<...R.ftt......3.Sr.Ni>....)1......VW.c.7....2l....LL.I>.V'.^.O\|...Xzw.K.S'.t..\.N ..yGy&........ .n.O....B.T(..{F.....r/..l.......3.J.G#.x.."KS.'.>.F...H..}.K..u/...;...."7.A.p...h.A.i`...#...CV..6.n...`....N.).'.._.E:O D@BK.\|.2.[....).e..12!......M7.h...9$&.M(............#..f.1....6.l.9...6.V=.Ru....k.\|L......u....>.....!0.f...../....(..._..z..F.T.3.......AR..(#"k.......J.y.v`$.8.C@...s6....Z.O.....?....R..v....J.2.&........']..L.....E4gzd]@.k.y..@../.;3.d. ..d.j.YEs.O.0...xp.w..L<....!29:.+JxO..&.P..>.Ldl.....E.....u...}.K+..b-....=..i.m[.O...rd2"Bj...M<..'.i.m.....1:...6zU^...P0gr).....1+h...5...sg...b._BXPA..'VN..tx..d.p...\.M}...JV=.....!~.!..\..........@!8/p.S.62..#.M..og.........^.[89...@..u...<.1R&.Nn.Q..,G.ck!\..a.x.i.x...s....)..j_...h.}.@....{\...eT:......e...a..=...C.R..).............@m.ie..y...>.L..5p...U.z ?on.u..[..9.k.*...'>C..&..j..\B.6...u....5C....`iIGg......./~.GN.V7(.[d.Q.`K.5cj._.h.3c] .4.

C:\Users\user\Documents\SQRKHNBNYN.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.884023693521131
Encrypted:	false
SSDEEP:	48:MErnbpkQZXWEnDGA9Ij4XZkwSXoM/Adijdy3sU7f:HZtmqiA96aiw+YcbGf
MD5:	8C5EED787B048325943EDCBE481F0008
SHA1:	C1CA10C83AFE706D1251D89D8CE9E3349FD9AEFF
SHA-256:	3AB68A49CAE515B12BA3EF5C2E1A08C12B93603861F27640DDD3B938EA1577D6
SHA-512:	C2133D7DF58FE8E2C38B02EACD71B6683C1ACB3903DB9C025BE84202AFE47D0ACB1C43B36026E0EABA9763F6C686F8CA93AF4566CF9E6A297BD8BF067621395F
Malicious:	false
Preview:	mq9....<...R.ftt......3.Sr.Ni>....)1......VW.c.7....2l....LL.I>.V'.^.O\|...Xzw.K.S'.t..\.N ..yGy&........ .n.O....B.T(..{F.....r/..l.......3.J.G#.x.."KS.'.>.F...H..}.K..u/...;...."7.A.p...h.A.i`...#...CV..6.n...`....N.).'.._.E:O D@BK.\|.2.[....).e..12!......M7.h...9$&.M(............#..f.1....6.l.9...6.V=.Ru....k.\|L......u....>.....!0.f...../....(..._..z..F.T.3.......AR..(#"k.......J.y.v`$.8.C@...s6....Z.O.....?....R..v....J.2.&........']..L.....E4gzd]@.k.y..@../.;3.d. ..d.j.YEs.O.0...xp.w..L<....!29:.+JxO..&.P..>.Ldl.....E.....u...}.K+..b-....=..i.m[.O...rd2"Bj...M<..'.i.m.....1:...6zU^...P0gr).....1+h...5...sg...b._BXPA..'VN..tx..d.p...\.M}...JV=.....!~.!..\..........@!8/p.S.62..#.M..og.........^.[89...@..u...<.1R&.Nn.Q..,G.ck!\..a.x.i.x...s....)..j_...h.}.@....{\...eT:......e...a..=...C.R..).............@m.ie..y...>.L..5p...U.z ?on.u..[..9.k.*...'>C..&..j..\B.6...u....5C....`iIGg......./~.GN.V7(.[d.Q.`K.5cj._.h.3c] .4.

C:\Users\user\Documents\UOOJJOZIRH.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.872600647468383
Encrypted:	false
SSDEEP:	24:P+6vGRxg8sDEXgicvurY0PJcq71ZAi/uAfYwdztT2/lvf66GxnmQwYLqFVNlIIdb:GxRu8EEpcvuxPF7MbJm2vfcLqRGob
MD5:	690A2C234F79048812200EA1516B7EEF
SHA1:	5C08FECDB671CEDF1E3D52B50F872ABAB733CA8B
SHA-256:	86B3F0E3AC286498D3EACAD7DA9842BD660C82D041BBAB4604A45509CCEC6B57
SHA-512:	A4B3C165034F64D6CCE4D6E6AC6F124663B65FF34FF0CCC066E57C46FF8BF9A682B529FDCA998D9B9164D3D35DEA05AA5DC13982551AC6133A8EC0A423B8CC0E
Malicious:	false
Preview:	.........)...)G....qa.,.....b.CS.-.R1O.hk#.....a-..-E..gy....&.4..o.`...b...Z..Y.(.%.@.....X..8Ex)..M?zwW.I!%.vak..\|.q...w.3Ne@.....V.vY..s(V.L+......./.......x<..L.x.D....UFp.d..$.m.n_H.......A....#.)E3.7..g>.$c.i.......Q%.x..b.1&1...Pk.)i..!..X...d.d<.fWn......W..tu..b......* .<..0X.+ .....F..@]...A...;<.<e.x..........m..8.KH.....;.......(Rt.}..k^s...0.^z.....``s..\& ..,.~Dq8...2...`M1....OK...)...}.$.....-..i:.......p.V..0...(....5.\|...u.TrF.(.t..(R..l...9...V..[...7$....kQ..2..Cv...I..;..[H);.O.4...I!/$.r.J.;z...2..%%.....-.F..0:.n.0<...y...).w..r....l.....D9..[.GX......=...h&......y)D...@.7..m!tA..?..3.m#Q..u.....TpN...".:..Y_.....U..4?b.9N...9.."...y..WF..jy..q..r.F.....[....BF.(..P..........Cd..\Q.O....HpB.JF.....5..m.....&x.`.,.\e?..F.o VTP\$...G..y..j\|.qh.}....v...'...$.....K.....W.p..\..4x.0.N'........F2.G..sQn.D.....Nr..N$....l\|.+..4a.h...n5M..... .Hg./.j..C)*VKuj...,.z...p......7...U6s.7gG9MO.FzT.X./.%.....

C:\Users\user\Documents\UOOJJOZIRH.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.872600647468383
Encrypted:	false
SSDEEP:	24:P+6vGRxg8sDEXgicvurY0PJcq71ZAi/uAfYwdztT2/lvf66GxnmQwYLqFVNlIIdb:GxRu8EEpcvuxPF7MbJm2vfcLqRGob
MD5:	690A2C234F79048812200EA1516B7EEF
SHA1:	5C08FECDB671CEDF1E3D52B50F872ABAB733CA8B
SHA-256:	86B3F0E3AC286498D3EACAD7DA9842BD660C82D041BBAB4604A45509CCEC6B57
SHA-512:	A4B3C165034F64D6CCE4D6E6AC6F124663B65FF34FF0CCC066E57C46FF8BF9A682B529FDCA998D9B9164D3D35DEA05AA5DC13982551AC6133A8EC0A423B8CC0E
Malicious:	false
Preview:	.........)...)G....qa.,.....b.CS.-.R1O.hk#.....a-..-E..gy....&.4..o.`...b...Z..Y.(.%.@.....X..8Ex)..M?zwW.I!%.vak..\|.q...w.3Ne@.....V.vY..s(V.L+......./.......x<..L.x.D....UFp.d..$.m.n_H.......A....#.)E3.7..g>.$c.i.......Q%.x..b.1&1...Pk.)i..!..X...d.d<.fWn......W..tu..b......* .<..0X.+ .....F..@]...A...;<.<e.x..........m..8.KH.....;.......(Rt.}..k^s...0.^z.....``s..\& ..,.~Dq8...2...`M1....OK...)...}.$.....-..i:.......p.V..0...(....5.\|...u.TrF.(.t..(R..l...9...V..[...7$....kQ..2..Cv...I..;..[H);.O.4...I!/$.r.J.;z...2..%%.....-.F..0:.n.0<...y...).w..r....l.....D9..[.GX......=...h&......y)D...@.7..m!tA..?..3.m#Q..u.....TpN...".:..Y_.....U..4?b.9N...9.."...y..WF..jy..q..r.F.....[....BF.(..P..........Cd..\Q.O....HpB.JF.....5..m.....&x.`.,.\e?..F.o VTP\$...G..y..j\|.qh.}....v...'...$.....K.....W.p..\..4x.0.N'........F2.G..sQn.D.....Nr..N$....l\|.+..4a.h...n5M..... .Hg./.j..C)*VKuj...,.z...p......7...U6s.7gG9MO.FzT.X./.%.....

C:\Users\user\Documents\VAMYDFPUND.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868381735097198
Encrypted:	false
SSDEEP:	48:oLi940DQFsyFvvy0GMCod+W+kiWHX81keT0ls2oL:J9LIRvvy0GMwVWHs1RJ2w
MD5:	1C5CD2A2F54AABEAC8294FCAEFEF43A0
SHA1:	E171DBACB853C8133AE603B0F7E6CB19F0DB27C6
SHA-256:	C0F64439C7A41E909483B29653E595F82F3A279036F37AE6EADB7E3871E4576E
SHA-512:	B81D1822E8295B1AEDF760A7EBAE946D1538260917B181D761745749B7004C16B5F250E8CF98C8EE470D3477581BD93E364E634EAB14B62BCA14A16EE5A4AAAF
Malicious:	false
Preview:	..t.7.U`.....w..B....L..OU{.\|..hw'.j....8.\..j..6vP~......J..+./....F..qK.;....x...i7.J.Z.ry..s.......s1...m@...J.0.N.e=..x.<....a..f.\|"..M.C.P0.TZv.M....R.....'o.....2...+(.J...S.)......./t.b..6...b.TT..o8MU1.....A(]..o..S......qS..bH....`....m..Q.]..w..Zo...#..R.f.....4..z...yp....@}..(14@.< ......$...k...7.0.L.........U5wN....YD&A.k.).....}.....M.LUk..p.+8/W\|0ycx.."7^.X( m...&+...=.?Y./...n.Q..3.....=.)..3!.7...8.Iz...g!...X....^2}?.:..].i.0.$.v.s&.tA.s!.&Xh.....N'3....[jT!..%v..T{..;L.)..o.Cg...Q.n.....3.....5...... ^.d>G...#.y.9[...E..<.Lk.5.5....,^......J ..].j..t...3.6.p.b....t..Ry.^....I.v.....$]....P.?..2..s.e=..g.:2.K..-Ld.Y..>.r....K._..d.....Y.....gA..i....!.J..je....p=\...[.K.j..i...Z.L.d..........2..w.I........^..f.i.p...K.%..G...W39&.\|..b....+....y....{.yWq.9q.M.n....hD.].j...{n>..~l6.E...U9......T..c...w.WX.z.}...ekH..B..u"...k?...6u....s'..D.t._...r.=.k...H....N.').....(.M...F....0.j...z..d.0.(.....m..~

C:\Users\user\Documents\VAMYDFPUND.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868381735097198
Encrypted:	false
SSDEEP:	48:oLi940DQFsyFvvy0GMCod+W+kiWHX81keT0ls2oL:J9LIRvvy0GMwVWHs1RJ2w
MD5:	1C5CD2A2F54AABEAC8294FCAEFEF43A0
SHA1:	E171DBACB853C8133AE603B0F7E6CB19F0DB27C6
SHA-256:	C0F64439C7A41E909483B29653E595F82F3A279036F37AE6EADB7E3871E4576E
SHA-512:	B81D1822E8295B1AEDF760A7EBAE946D1538260917B181D761745749B7004C16B5F250E8CF98C8EE470D3477581BD93E364E634EAB14B62BCA14A16EE5A4AAAF
Malicious:	false
Preview:	..t.7.U`.....w..B....L..OU{.\|..hw'.j....8.\..j..6vP~......J..+./....F..qK.;....x...i7.J.Z.ry..s.......s1...m@...J.0.N.e=..x.<....a..f.\|"..M.C.P0.TZv.M....R.....'o.....2...+(.J...S.)......./t.b..6...b.TT..o8MU1.....A(]..o..S......qS..bH....`....m..Q.]..w..Zo...#..R.f.....4..z...yp....@}..(14@.< ......$...k...7.0.L.........U5wN....YD&A.k.).....}.....M.LUk..p.+8/W\|0ycx.."7^.X( m...&+...=.?Y./...n.Q..3.....=.)..3!.7...8.Iz...g!...X....^2}?.:..].i.0.$.v.s&.tA.s!.&Xh.....N'3....[jT!..%v..T{..;L.)..o.Cg...Q.n.....3.....5...... ^.d>G...#.y.9[...E..<.Lk.5.5....,^......J ..].j..t...3.6.p.b....t..Ry.^....I.v.....$]....P.?..2..s.e=..g.:2.K..-Ld.Y..>.r....K._..d.....Y.....gA..i....!.J..je....p=\...[.K.j..i...Z.L.d..........2..w.I........^..f.i.p...K.%..G...W39&.\|..b....+....y....{.yWq.9q.M.n....hD.].j...{n>..~l6.E...U9......T..c...w.WX.z.}...ekH..B..u"...k?...6u....s'..D.t._...r.=.k...H....N.').....(.M...F....0.j...z..d.0.(.....m..~

C:\Users\user\Documents\WKXEWIOTXI.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8712021875352285
Encrypted:	false
SSDEEP:	48:uULvswIRjl0VYKabPVPkaDOB5sWGUalwf62/rP:1vFIPqaafsWUW6mP
MD5:	4EE9348A89BAF6851EB34462D315C916
SHA1:	E7DCF0265816F5988C86AD82D3DD86F5922385E3
SHA-256:	665F55428628871A14CBD477ED05A16EBE348D70F8461FF10DC13A96B946B054
SHA-512:	232CCCAB9CBFD3C636F69335BA9D5733A1D76D4065D9C5ABD8801D6AA7D574C00A04BBD36CFFC83B48D5287F5C5B657B5CA4F0722056EF3C68B78C50CB3D4766
Malicious:	false
Preview:	v..Z..8.\|.y.m.......#....08.Y.D.K.._.s.,.C.f.Nt...b.iz..!=.JH...<..^j...&...^z.G.M.`#....~.b....L...u....a.f.P..:.o%....@..<.....k...,.... ~<.........].d.I\|..i'.7Z....}.9a.F`....@a ....+..{=...O3._..;,S.v......_.WM.%=...4.$.FBt@7..4.)..HU..$.Y?.g.N#5y.../)...."Z2..i..S..7{.x....+^..k..A..an...8..p%2......v.....MY.{/.Z..L..<.YAt..M.7>$P..4..~Z.B.9J]...7.`...L.WY..).L.w.v...d..P.z.B=..?..kWFc.c....PP......,.%..y.t...".D.O..7R.....a..4.1.......k....I..bG.b.a4+<.k._g[e.B.7U.....~.d...P.q.U'.y.v..[R.v....v\|}^.....h..uF...._m.bT\.....?.R.4ds......'\|.v.PA....f..#..W:..>.Y.Px6k..&\|..w+.....G..N/.c.D........Q...(.@."....i....t...9>."..T...Z.&.Z.....n.=...4.C...T-..3eu.........hxP...+.Z=...=.b..........Xe.L..P..!+.*.7=1..c.^.Y...`g.....n....2..y.<......k.%..H.e..eV...U...i..../.r.dE...`...s...7...Q.t.......u.T.J.._....CY...O..q.F. t.2]0?...........h....\|.c.Rg.'D{..0.Ob.....q"%.-.3.7T..%..C.8D@.. .W.....\|(2!...3Y.".2Z...K...k...,s...Ab.kw...a,.....?..

C:\Users\user\Documents\WKXEWIOTXI.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8712021875352285
Encrypted:	false
SSDEEP:	48:uULvswIRjl0VYKabPVPkaDOB5sWGUalwf62/rP:1vFIPqaafsWUW6mP
MD5:	4EE9348A89BAF6851EB34462D315C916
SHA1:	E7DCF0265816F5988C86AD82D3DD86F5922385E3
SHA-256:	665F55428628871A14CBD477ED05A16EBE348D70F8461FF10DC13A96B946B054
SHA-512:	232CCCAB9CBFD3C636F69335BA9D5733A1D76D4065D9C5ABD8801D6AA7D574C00A04BBD36CFFC83B48D5287F5C5B657B5CA4F0722056EF3C68B78C50CB3D4766
Malicious:	false
Preview:	v..Z..8.\|.y.m.......#....08.Y.D.K.._.s.,.C.f.Nt...b.iz..!=.JH...<..^j...&...^z.G.M.`#....~.b....L...u....a.f.P..:.o%....@..<.....k...,.... ~<.........].d.I\|..i'.7Z....}.9a.F`....@a ....+..{=...O3._..;,S.v......_.WM.%=...4.$.FBt@7..4.)..HU..$.Y?.g.N#5y.../)...."Z2..i..S..7{.x....+^..k..A..an...8..p%2......v.....MY.{/.Z..L..<.YAt..M.7>$P..4..~Z.B.9J]...7.`...L.WY..).L.w.v...d..P.z.B=..?..kWFc.c....PP......,.%..y.t...".D.O..7R.....a..4.1.......k....I..bG.b.a4+<.k._g[e.B.7U.....~.d...P.q.U'.y.v..[R.v....v\|}^.....h..uF...._m.bT\.....?.R.4ds......'\|.v.PA....f..#..W:..>.Y.Px6k..&\|..w+.....G..N/.c.D........Q...(.@."....i....t...9>."..T...Z.&.Z.....n.=...4.C...T-..3eu.........hxP...+.Z=...=.b..........Xe.L..P..!+.*.7=1..c.^.Y...`g.....n....2..y.<......k.%..H.e..eV...U...i..../.r.dE...`...s...7...Q.t.......u.T.J.._....CY...O..q.F. t.2]0?...........h....\|.c.Rg.'D{..0.Ob.....q"%.-.3.7T..%..C.8D@.. .W.....\|(2!...3Y.".2Z...K...k...,s...Ab.kw...a,.....?..

C:\Users\user\Documents\WKXEWIOTXI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8699557239622004
Encrypted:	false
SSDEEP:	48:N+AY1ratvs/sH+7An8uzz+VsEjqT+pGQt:45atq88KUsunD
MD5:	038E73852B058ED85A4A29E856BA6CC8
SHA1:	1C986FE944561E070140CC83F671FC369C2818AB
SHA-256:	B0411FB601C2CECA191DB6FC4DDB59C5BAADAD0DE98AB402DBD8B7EDEB987E9A
SHA-512:	9B3694CF5D56267F5D78AECA5AA00F56817E7C8F547C70CC298E105E8E16EFEF5BF28D3634FCAE1368D64B0DF9CC983F46E2DA96837ED00D15F660BAABDAA539
Malicious:	false
Preview:	.3..X9...^%s9A!.......(.O.f..e[._..:....^...D...........2cO...Cp.b0^.6<....g._T.b..AVX......b..\|e.:.t..q..lU..r...$.2.'%<..A.R..K^]6...m..\|....3.La.}...e.....5Rw.nQ..'...J....`.....d.}...6.T...+8.XM.?..7.\.A.t....l..O9K.....u.m?..6.q.E.n...3..=....T.@..7.Mf.....p...1F[.5w&..q8.yp._..\|..e:I5Y.J.Zg1...LO.!....`.....(.G.[..V.E2s ..M/.).Q._.P4..1c....5...-.Z..b..~t...~!...... ...........3..M...m..tS. .3.....p'-.T/.....L(I.u.4......Z.2S..t..1S.{....B,j.....d...J.....Jk.M.2..l....AAq./..g...z..(..k.B......oJZ..Z._V..un.2...29c...0(c..X...F.....S.p.:...g..W...Q<=.!p..A.d\..HQ.......>.R.P..(...tT.z..)TY.e.xz.C\|...Cz./#.C...p.!.......#5._H........I.G...{..%#?..%.....$.lp...........`..Z.B.......qX.y...W:...W..c[,o..k..?....DJ.?.....G.#.'/..,.o.....D..O..bZ.{ p..o..'...W.[T<B.4b.R...>Ma..;...4.sd...r............2e..A(R^\|Drh.u......!.....$.xWZg..W.VF...HtwG.a....m.'jN......Gk.S.-...;...Iz9Xi..K........6..:..4.;t_. qt-.qg...u.Z%.. ..l\|..;#.(...

C:\Users\user\Documents\WKXEWIOTXI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8699557239622004
Encrypted:	false
SSDEEP:	48:N+AY1ratvs/sH+7An8uzz+VsEjqT+pGQt:45atq88KUsunD
MD5:	038E73852B058ED85A4A29E856BA6CC8
SHA1:	1C986FE944561E070140CC83F671FC369C2818AB
SHA-256:	B0411FB601C2CECA191DB6FC4DDB59C5BAADAD0DE98AB402DBD8B7EDEB987E9A
SHA-512:	9B3694CF5D56267F5D78AECA5AA00F56817E7C8F547C70CC298E105E8E16EFEF5BF28D3634FCAE1368D64B0DF9CC983F46E2DA96837ED00D15F660BAABDAA539
Malicious:	false
Preview:	.3..X9...^%s9A!.......(.O.f..e[._..:....^...D...........2cO...Cp.b0^.6<....g._T.b..AVX......b..\|e.:.t..q..lU..r...$.2.'%<..A.R..K^]6...m..\|....3.La.}...e.....5Rw.nQ..'...J....`.....d.}...6.T...+8.XM.?..7.\.A.t....l..O9K.....u.m?..6.q.E.n...3..=....T.@..7.Mf.....p...1F[.5w&..q8.yp._..\|..e:I5Y.J.Zg1...LO.!....`.....(.G.[..V.E2s ..M/.).Q._.P4..1c....5...-.Z..b..~t...~!...... ...........3..M...m..tS. .3.....p'-.T/.....L(I.u.4......Z.2S..t..1S.{....B,j.....d...J.....Jk.M.2..l....AAq./..g...z..(..k.B......oJZ..Z._V..un.2...29c...0(c..X...F.....S.p.:...g..W...Q<=.!p..A.d\..HQ.......>.R.P..(...tT.z..)TY.e.xz.C\|...Cz./#.C...p.!.......#5._H........I.G...{..%#?..%.....$.lp...........`..Z.B.......qX.y...W:...W..c[,o..k..?....DJ.?.....G.#.'/..,.o.....D..O..bZ.{ p..o..'...W.[T<B.4b.R...>Ma..;...4.sd...r............2e..A(R^\|Drh.u......!.....$.xWZg..W.VF...HtwG.a....m.'jN......Gk.S.-...;...Iz9Xi..K........6..:..4.;t_. qt-.qg...u.Z%.. ..l\|..;#.(...

C:\Users\user\Documents\WKXEWIOTXI.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.864281093692719
Encrypted:	false
SSDEEP:	24:0Xjua+QD2+vIm96B+LumRx1E/JHKtHjDwRTBtKekHGQRfA//+9h5jnWYlTw6caO:0zuanD2+AJBsupBCqHkHGeR9D9c9
MD5:	BCB4EEBDA1D656EE6A1594BB93D84D90
SHA1:	F8AB4C3DE564442521F223F4D4195F6205FE498D
SHA-256:	601FB745894A3EF7E89149AB3C1DB94E0BF63CB92D3558C2EBB378B1ECF18454
SHA-512:	8D69BC96F87D5A1882558599610672E607EC1881E1141C5083F29AB5C4B8B38D5373C84FA8DCA0138279C2DDD2577FB462C7CCD494B48489437FC1F479E19A46
Malicious:	false
Preview:	.\|l[@_X.3....z..[.v.{..94....(6.:....;I}..$...j.7i..-W.t.\|l..7.A:..8b.T.".n..O.&.F.t.5nS...Hu .._..#. ..g.........CT<{...\|......A.s..e.....f..7u.@B..}.CW.g."...tM.SE'...e...xV......X..g..%......^z.F.N..E._...+f....A=\|\|............w.^.B(...=...=....:{8m.0(..v.X....ww.@...~aw..a.;.......%.......5..\|CKy".C.I^S..j.3.#.y.fci..G.8..I.A.'{...?....V^.p.zM...+;7ar.)....+...'./...xh.mT....`.ed.mk...\|-GY..e<..K.....P...ay.M..4...o.NU.....C.3.MS.....di........b^[z.).tvxV3&..]Zr..c&.j.=.&.'AE.%rE..Lb7..%.{..`..#.....aw.J.29).".c...j[.f...{....S...O..W....i..`....K_..[O.....-.UO...Y'.bj.z..\q..s..hW..x.H........S...U.......H...S..c.F........b&.q.,.$&n8...3L5tF.....V...i.:.A.;..d&h...[i.c..V.-oa.t'`~oGF..CU.....,.W*b..N..Q....}.K.....S..k.@....:.....z.//);y.Y.vu9....._,..b....LtG...#`..X.d"..+p ....m..u..M.5...l....8..^....[/...l).0.........a@G....T..j....[......F+x..n.../?..u...~{.\|fX...........)...D.`...Z.g.4'..S..+E8g9.6.Actg.K.d...N.ED.

C:\Users\user\Documents\WKXEWIOTXI.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.864281093692719
Encrypted:	false
SSDEEP:	24:0Xjua+QD2+vIm96B+LumRx1E/JHKtHjDwRTBtKekHGQRfA//+9h5jnWYlTw6caO:0zuanD2+AJBsupBCqHkHGeR9D9c9
MD5:	BCB4EEBDA1D656EE6A1594BB93D84D90
SHA1:	F8AB4C3DE564442521F223F4D4195F6205FE498D
SHA-256:	601FB745894A3EF7E89149AB3C1DB94E0BF63CB92D3558C2EBB378B1ECF18454
SHA-512:	8D69BC96F87D5A1882558599610672E607EC1881E1141C5083F29AB5C4B8B38D5373C84FA8DCA0138279C2DDD2577FB462C7CCD494B48489437FC1F479E19A46
Malicious:	false
Preview:	.\|l[@_X.3....z..[.v.{..94....(6.:....;I}..$...j.7i..-W.t.\|l..7.A:..8b.T.".n..O.&.F.t.5nS...Hu .._..#. ..g.........CT<{...\|......A.s..e.....f..7u.@B..}.CW.g."...tM.SE'...e...xV......X..g..%......^z.F.N..E._...+f....A=\|\|............w.^.B(...=...=....:{8m.0(..v.X....ww.@...~aw..a.;.......%.......5..\|CKy".C.I^S..j.3.#.y.fci..G.8..I.A.'{...?....V^.p.zM...+;7ar.)....+...'./...xh.mT....`.ed.mk...\|-GY..e<..K.....P...ay.M..4...o.NU.....C.3.MS.....di........b^[z.).tvxV3&..]Zr..c&.j.=.&.'AE.%rE..Lb7..%.{..`..#.....aw.J.29).".c...j[.f...{....S...O..W....i..`....K_..[O.....-.UO...Y'.bj.z..\q..s..hW..x.H........S...U.......H...S..c.F........b&.q.,.$&n8...3L5tF.....V...i.:.A.;..d&h...[i.c..V.-oa.t'`~oGF..CU.....,.W*b..N..Q....}.K.....S..k.@....:.....z.//);y.Y.vu9....._,..b....LtG...#`..X.d"..+p ....m..u..M.5...l....8..^....[/...l).0.........a@G....T..j....[......F+x..n.../?..u...~{.\|fX...........)...D.`...Z.g.4'..S..+E8g9.6.Actg.K.d...N.ED.

C:\Users\user\Documents\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Downloads\BPMLNOBVSB.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.872226703357141
Encrypted:	false
SSDEEP:	24:UBsxiqF7f18dFvyAP1ci7CiOk5jfIrS3nTEmqqo5YLBSOWTamTxOhtY4yaS:UBsxXF7KjKtwOGIrS3TEpWLnTmo/ry9
MD5:	A9C91EFDA3AB2EC727B60F6D5F88864A
SHA1:	65CB7F85D51FC5B2B0008B054AC3408B099F1A3A
SHA-256:	3E09FC5B98D445E57BBABF63CDCFC3D81FB6A2B9884C4DD7E0A764C2757875FF
SHA-512:	D75208ACF6D4F87288F615B7F623943235D3DD43BB8340CC142BA0A758252838B5EBABEE19350A9ECDE3113B0E2ACC11970EF9ED0C3272446DA22F432BA48377
Malicious:	false
Preview:	.r?...?....vZ4.4\N........)i5....2U!.q....k....M.T6..M:..yn...Q...o...JIi..CJk..'H..a'..-.,.....K.j~.4....r...C._...g..9%B.T.....%. \|Z..7.`u."oQ.6..'J......H..d.EXOo...W..<..<.@\|.@T.!...)...V..1....`.....J3u..>.8....h..xi.^....C..A.D~yr.....W.<....J.b.a;....m...x...x..s.X.:$m.b...~..Q...._.:..........^6\|.7.<}%k..tly%.a..'...oA.e.x<....pc......m.....f...!.f+....0.../r.Gg..M.o....2.'...?;7.}...I...-...f1.S...[.8WR.;:.7F3.@.M....~...b..............A....2.g.s.#h....BGZ...Q.1......^=.:73..5;.x.R.....v.;.a..D...v,K.F.R...80..r.Cn>.d7.C....aZ+v..m.(...s.=.8...a...^.$2..GC.S..k.".DZ....rj.Z..J...J..kV\$..}..^.(..b._...Y..,...xq..>.C.Q..(<p...Xnc,...7.1......}q.c..]S...H...T.w1....?....L...3_3z..[...U...?=.....6......R......M........B.V.....c.=s6gd.M...c..R..V...~`C..<\....t.%{...1..l.t....'L6..-.`.(..tfV...G.X>..Ya......H...Fr.[..j7.....-..#....b...v...11....u...........T._.u.....H...`4.c8.1...u.(...x<.,F....>K.J.my}<.....\|+I.i...M;

C:\Users\user\Downloads\BPMLNOBVSB.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.872226703357141
Encrypted:	false
SSDEEP:	24:UBsxiqF7f18dFvyAP1ci7CiOk5jfIrS3nTEmqqo5YLBSOWTamTxOhtY4yaS:UBsxXF7KjKtwOGIrS3TEpWLnTmo/ry9
MD5:	A9C91EFDA3AB2EC727B60F6D5F88864A
SHA1:	65CB7F85D51FC5B2B0008B054AC3408B099F1A3A
SHA-256:	3E09FC5B98D445E57BBABF63CDCFC3D81FB6A2B9884C4DD7E0A764C2757875FF
SHA-512:	D75208ACF6D4F87288F615B7F623943235D3DD43BB8340CC142BA0A758252838B5EBABEE19350A9ECDE3113B0E2ACC11970EF9ED0C3272446DA22F432BA48377
Malicious:	false
Preview:	.r?...?....vZ4.4\N........)i5....2U!.q....k....M.T6..M:..yn...Q...o...JIi..CJk..'H..a'..-.,.....K.j~.4....r...C._...g..9%B.T.....%. \|Z..7.`u."oQ.6..'J......H..d.EXOo...W..<..<.@\|.@T.!...)...V..1....`.....J3u..>.8....h..xi.^....C..A.D~yr.....W.<....J.b.a;....m...x...x..s.X.:$m.b...~..Q...._.:..........^6\|.7.<}%k..tly%.a..'...oA.e.x<....pc......m.....f...!.f+....0.../r.Gg..M.o....2.'...?;7.}...I...-...f1.S...[.8WR.;:.7F3.@.M....~...b..............A....2.g.s.#h....BGZ...Q.1......^=.:73..5;.x.R.....v.;.a..D...v,K.F.R...80..r.Cn>.d7.C....aZ+v..m.(...s.=.8...a...^.$2..GC.S..k.".DZ....rj.Z..J...J..kV\$..}..^.(..b._...Y..,...xq..>.C.Q..(<p...Xnc,...7.1......}q.c..]S...H...T.w1....?....L...3_3z..[...U...?=.....6......R......M........B.V.....c.=s6gd.M...c..R..V...~`C..<\....t.%{...1..l.t....'L6..-.`.(..tfV...G.X>..Ya......H...Fr.[..j7.....-..#....b...v...11....u...........T._.u.....H...`4.c8.1...u.(...x<.,F....>K.J.my}<.....\|+I.i...M;

C:\Users\user\Downloads\BPMLNOBVSB.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.880151934428492
Encrypted:	false
SSDEEP:	48:jN4kjOYrfVrcKNHi4mt+HLAb+SqqvPEJEH4IDftckZ:jN4Mzrr++rAb+nqnEJA46Z
MD5:	7E056FA69D1B22A3DE2E5DCD336475E0
SHA1:	B1EEA26EBBD9BC8B89A519D1E507585BB8EA981B
SHA-256:	2429A0579AF64107D1AD85BB58C9C432C00472F0B85BFE2A37214146F9FEDE31
SHA-512:	D6E6CA10F415506F070127738D3D4EAFA3D3FE3DF91567226692F75DFDAF223FD72AB975C96A762192C300D1CC4EBE3770DC8A9F45261C366AEF584B5BAB722A
Malicious:	false
Preview:	.;T.?...I^.y+.lv.6yf.B...i...M........Bk}.\|/.mJ8...N~.`.]E.th..Y....c.Q......'...4.g..>.._........j..y...v.9..^..E...7.9..@..Y..k.....k-.M3#!.P.S...F..s...C6.alG......Z.y..R.kvc9......Q l.,q.......U.71....B.k.....P.b`1...x.....a=.$%h.b..Ue."..3.t...Y...]U............I:8[.v.._...0..p...Q.......x.t...\|.9.o....+...\|....h0.......F.g...[...M..9....S#(.D.~.%...%.Z}...E7.v[.C.n.m.o&.!....x....M}..n.?./Va#Z..0. ....~.....mW...^..[ .7..;a..p\|WB.....E......a..Bi.jTm.4./....$3..&......@.`A.."/.....M.] ...#.DB.3.Z.e...p..k)+.\.K&.....y.N4.....G...R..SJr.FE'.........,.k....{.\q...r. ...2.7:_/......um;)A\|e.Mr.Z..x........S...O...\|..........N....h..!.,."...a..7_=F.....7.f..=..r,.x..nhnSv..8.Z..Mw..........1..gv.J....~..C.L~k...E..2.JWb.....n.+.. .....T..c.TR.c.W.G9:~Q`J'$...).....x.6W...:..}6(..}>...x...i......w......W.S..X.m... .?e...5......Kx].......sO.k7.9./N....z.A.W)..... .fM../.6...U.\.....L.%.7#..G.&gR{.....o.p.Y)n.q>SIO@..Q...w%....H

C:\Users\user\Downloads\BPMLNOBVSB.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.880151934428492
Encrypted:	false
SSDEEP:	48:jN4kjOYrfVrcKNHi4mt+HLAb+SqqvPEJEH4IDftckZ:jN4Mzrr++rAb+nqnEJA46Z
MD5:	7E056FA69D1B22A3DE2E5DCD336475E0
SHA1:	B1EEA26EBBD9BC8B89A519D1E507585BB8EA981B
SHA-256:	2429A0579AF64107D1AD85BB58C9C432C00472F0B85BFE2A37214146F9FEDE31
SHA-512:	D6E6CA10F415506F070127738D3D4EAFA3D3FE3DF91567226692F75DFDAF223FD72AB975C96A762192C300D1CC4EBE3770DC8A9F45261C366AEF584B5BAB722A
Malicious:	false
Preview:	.;T.?...I^.y+.lv.6yf.B...i...M........Bk}.\|/.mJ8...N~.`.]E.th..Y....c.Q......'...4.g..>.._........j..y...v.9..^..E...7.9..@..Y..k.....k-.M3#!.P.S...F..s...C6.alG......Z.y..R.kvc9......Q l.,q.......U.71....B.k.....P.b`1...x.....a=.$%h.b..Ue."..3.t...Y...]U............I:8[.v.._...0..p...Q.......x.t...\|.9.o....+...\|....h0.......F.g...[...M..9....S#(.D.~.%...%.Z}...E7.v[.C.n.m.o&.!....x....M}..n.?./Va#Z..0. ....~.....mW...^..[ .7..;a..p\|WB.....E......a..Bi.jTm.4./....$3..&......@.`A.."/.....M.] ...#.DB.3.Z.e...p..k)+.\.K&.....y.N4.....G...R..SJr.FE'.........,.k....{.\q...r. ...2.7:_/......um;)A\|e.Mr.Z..x........S...O...\|..........N....h..!.,."...a..7_=F.....7.f..=..r,.x..nhnSv..8.Z..Mw..........1..gv.J....~..C.L~k...E..2.JWb.....n.+.. .....T..c.TR.c.W.G9:~Q`J'$...).....x.6W...:..}6(..}>...x...i......w......W.S..X.m... .?e...5......Kx].......sO.k7.9./N....z.A.W)..... .fM../.6...U.\.....L.%.7#..G.&gR{.....o.p.Y)n.q>SIO@..Q...w%....H

C:\Users\user\Downloads\CURQNKVOIX.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.856537932671989
Encrypted:	false
SSDEEP:	24:AZ4hHpJRo5Nk0ueq2P+P+yf8dPKH8PQ5mz7PqOPDdmVFv8v4ZzZm:DhH0kN/2ef85KH8p/Lm0Otm
MD5:	8E7D2015803B9BC026FF9B9D80F90927
SHA1:	DCDF71CA4D919DE33A449F727702D4885848E7A5
SHA-256:	A0C86543F64A80CB1CD066612BF9566AD66825AF329151F55DF60834ECFCD972
SHA-512:	A246C091AA66E6B784E4275D5524DA588CDE5D9F1C1C2B288A22EE8CDB1952CCCF08DDE79FB54DE8E31C7BDCBD690C34052BD1FCC7EC80238503B66B1628BCD5
Malicious:	false
Preview:	....wJ..........#.4N.~.]....".e.el.h...ru.2."...pe..#%.<>=c..LG$D..... .VG8.b....<c.0c....c..9...%.p.t.H.qDh..ux.x..Ih-.k. ..c....UK$....W....F..Q...S'...f...t.....w..^0.C..e`.C@h..N.....\|.,.C.9........f..^.1.C..u...B}B..Z...4...rbI...._HMc.3C....g.U.v........8.............4.(...3).9sy.\|7nF.c.#<.5..`J .?.>.zZ(^. .W......w..."@y..=.W'.[.0........<[.h."...A..c_...B..x#N. ..w.0....[I1.A.,...'j..+..2.dY..gG..t......c.K....'..#.Vv.>Cl...#f(W...`..u..1~....r..bg..{....%b2a....r....m......../.Hs.g...=K.N.(d.kn....."..i....X...8l.....A=0\|C."H.....8....+..v....B.m..ZC/.X..H....<..p.az..7p..._....2.K#Lo...bxP.w.[.3O..D.GWf.....3.b.....+..^..."!...F..r1..w......q......d...--.d//-<wB]Q.........{..[.o..s...Q.zT.._..l............X.d...!....<.....vb.:?.u...3... ......(.z..\.z..>.../.....6...&.R.U.t..M~o.....z...`.X....5}).Z..t..#..5....DAUsE(..Z....-....I....f@.s$.o...z.Y...N..8^l...W...!..S.`...B.\|i..e.,?..{u/5...e....w.3./.p@...;g.s.."^..#nO

C:\Users\user\Downloads\CURQNKVOIX.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.856537932671989
Encrypted:	false
SSDEEP:	24:AZ4hHpJRo5Nk0ueq2P+P+yf8dPKH8PQ5mz7PqOPDdmVFv8v4ZzZm:DhH0kN/2ef85KH8p/Lm0Otm
MD5:	8E7D2015803B9BC026FF9B9D80F90927
SHA1:	DCDF71CA4D919DE33A449F727702D4885848E7A5
SHA-256:	A0C86543F64A80CB1CD066612BF9566AD66825AF329151F55DF60834ECFCD972
SHA-512:	A246C091AA66E6B784E4275D5524DA588CDE5D9F1C1C2B288A22EE8CDB1952CCCF08DDE79FB54DE8E31C7BDCBD690C34052BD1FCC7EC80238503B66B1628BCD5
Malicious:	false
Preview:	....wJ..........#.4N.~.]....".e.el.h...ru.2."...pe..#%.<>=c..LG$D..... .VG8.b....<c.0c....c..9...%.p.t.H.qDh..ux.x..Ih-.k. ..c....UK$....W....F..Q...S'...f...t.....w..^0.C..e`.C@h..N.....\|.,.C.9........f..^.1.C..u...B}B..Z...4...rbI...._HMc.3C....g.U.v........8.............4.(...3).9sy.\|7nF.c.#<.5..`J .?.>.zZ(^. .W......w..."@y..=.W'.[.0........<[.h."...A..c_...B..x#N. ..w.0....[I1.A.,...'j..+..2.dY..gG..t......c.K....'..#.Vv.>Cl...#f(W...`..u..1~....r..bg..{....%b2a....r....m......../.Hs.g...=K.N.(d.kn....."..i....X...8l.....A=0\|C."H.....8....+..v....B.m..ZC/.X..H....<..p.az..7p..._....2.K#Lo...bxP.w.[.3O..D.GWf.....3.b.....+..^..."!...F..r1..w......q......d...--.d//-<wB]Q.........{..[.o..s...Q.zT.._..l............X.d...!....<.....vb.:?.u...3... ......(.z..\.z..>.../.....6...&.R.U.t..M~o.....z...`.X....5}).Z..t..#..5....DAUsE(..Z....-....I....f@.s$.o...z.Y...N..8^l...W...!..S.`...B.\|i..e.,?..{u/5...e....w.3./.p@...;g.s.."^..#nO

C:\Users\user\Downloads\FENIVHOIKN.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868527470289574
Encrypted:	false
SSDEEP:	48:fiHWaqUmvB5eCzHyi+65lSyio9RaPRoHJ+i4:LXUmv9g65lSyiMRgIJH4
MD5:	2AE375F5F1A43AB3551641F9695559C6
SHA1:	44B22E249C3A9F04EAEE80D9A62798CB3EDC2FDE
SHA-256:	5E9E506BB3224FCE3EDDDB63FC731D7A185DDE6C60EF4FCBF4AE7B6096211002
SHA-512:	D85EA15EC0CF6CDCEDDF9C34460D5C40698EF1DC30C4534E138AB95E03ABED1953266E94EFECE75B493885B26D507BCA26A981E3762BF5E4756DDA34D9985C77
Malicious:	false
Preview:	.-..u.Q.Jx..P.,.0'.........N%.C.,I<{..E..=...../.7......(.....FV}..!.O.{.O.E.......b.g...E..8...%!.Q50R.N.w.Re.l....;G.XL:...t}.>...8.R4n#m{..{."....-..`G..hS...#..zu...S\|:..6.?.)...i.~1.{......!.,.G.$.Q...=...99.`K4c..w.NT..(F<1.'...n9j..^hwq.\.i.....\P...6T...y...Q9..>=07....9)iH^f6.A.......R.l..MC.i...s.....&. ....)....5.hi.z.....b....B.&b.....P..T..Z7+..O...X......]t.........zE^...s...u'Z.i..i..v.8]2$~.!.vv.$38....E....WI\X.o....n....4.^....?_...S<.\J.......5...".....z=......kUmS\|]..?D......n..d...P&4..N)W1n.ahL.......>.M.3&r..O&..h..+..[......d...o.C9........`\|..9...q...cZu......g..s[.-O.....2l..>9J../X..#5B..5.\f,U....0.A.<.^!.......Y."8..}?.6[.6....p..W....~FDi._=./...g.L>..h.*Q_D..AP....5Q4...]..Q!T..6..Z...h..}o.L.U...3.[.#.i..x\.<.V..u^.W.d.t.^RoJ....r...B...lZ..4..._x...4..p~.[.;.M...cbJh...f..^..4...I%.U....M.^.A...`....f...By.9.dK....!e.M...a.u1j.bH8G......H.R....fC... `.b..e.xF...PU.rW.......f...)X5.........$...BX..v-x....

C:\Users\user\Downloads\FENIVHOIKN.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.868527470289574
Encrypted:	false
SSDEEP:	48:fiHWaqUmvB5eCzHyi+65lSyio9RaPRoHJ+i4:LXUmv9g65lSyiMRgIJH4
MD5:	2AE375F5F1A43AB3551641F9695559C6
SHA1:	44B22E249C3A9F04EAEE80D9A62798CB3EDC2FDE
SHA-256:	5E9E506BB3224FCE3EDDDB63FC731D7A185DDE6C60EF4FCBF4AE7B6096211002
SHA-512:	D85EA15EC0CF6CDCEDDF9C34460D5C40698EF1DC30C4534E138AB95E03ABED1953266E94EFECE75B493885B26D507BCA26A981E3762BF5E4756DDA34D9985C77
Malicious:	false
Preview:	.-..u.Q.Jx..P.,.0'.........N%.C.,I<{..E..=...../.7......(.....FV}..!.O.{.O.E.......b.g...E..8...%!.Q50R.N.w.Re.l....;G.XL:...t}.>...8.R4n#m{..{."....-..`G..hS...#..zu...S\|:..6.?.)...i.~1.{......!.,.G.$.Q...=...99.`K4c..w.NT..(F<1.'...n9j..^hwq.\.i.....\P...6T...y...Q9..>=07....9)iH^f6.A.......R.l..MC.i...s.....&. ....)....5.hi.z.....b....B.&b.....P..T..Z7+..O...X......]t.........zE^...s...u'Z.i..i..v.8]2$~.!.vv.$38....E....WI\X.o....n....4.^....?_...S<.\J.......5...".....z=......kUmS\|]..?D......n..d...P&4..N)W1n.ahL.......>.M.3&r..O&..h..+..[......d...o.C9........`\|..9...q...cZu......g..s[.-O.....2l..>9J../X..#5B..5.\f,U....0.A.<.^!.......Y."8..}?.6[.6....p..W....~FDi._=./...g.L>..h.*Q_D..AP....5Q4...]..Q!T..6..Z...h..}o.L.U...3.[.#.i..x\.<.V..u^.W.d.t.^RoJ....r...B...lZ..4..._x...4..p~.[.;.M...cbJh...f..^..4...I%.U....M.^.A...`....f...By.9.dK....!e.M...a.u1j.bH8G......H.R....fC... `.b..e.xF...PU.rW.......f...)X5.........$...BX..v-x....

C:\Users\user\Downloads\FENIVHOIKN.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.865004428472304
Encrypted:	false
SSDEEP:	24:ND5OVZnA7rP3w4X2LuGoyJvUOn60yRDLc87Ybxork9NgojAVdOVdJroVYnv+06wr:BUjAQ4wubO6XfY594dYL8A6w/I0
MD5:	369467F6203840B8380059E9C0F3A4FC
SHA1:	E347385DEB31271DB2200B45AFE9AD7EE0A6D2D2
SHA-256:	D26A3CCD703FC0BEFA458D517FE0D8FBA3355367419657C1C73CC61F961AAE8C
SHA-512:	B31B48B84BBC3FCB8935B3EBAD5ECBC0D76D4C6E807CB58CE88E712341D6664D7CCDC63DBFE177139174370535BFF009AEA8700DD2579BC3748475618E4D046A
Malicious:	false
Preview:	..}.=....J2..)\|Fg ...M.+.8...ciI.....i?.a...1.'_...E@.#....5A..i.....g/....;.2D...^O.#"...&G.z1.......6........+L..!R.....{f.8N.C.;N\|.u..K.f.x-.ud>.....t...VN.Z.".ddzw\|Ze.v\|..cd.zVw%.?..qf....;./fZ...j........Zl2.....h.b{gn....d.....l.u...,.........O.,...h..,..Pe..A]v..Y..$.....N..&.....FE5.._L."......W.@........7....<.....".m.(.X.<ph..e.....`CMQP....V...`2.mk...lg-..n0.:.1.q..[p.AR...(!.....2.........Nc...:.,..B...h..H....l.....^,.B....;@*.....Sh...n=dG....{P......V.2....D..S...........}....o..3x$..1 ......{.....\.=^..!.{..=HB.nd..e.^U.wP......89..~..n.4 W.....`.S..YAo..z..f.ju..Uu.&F....:9..Sp..`......D....3.......i.i...7..E3.?.Y%;h.=..m.....X.....@S..)g.&..yM... k...6....Rj...G1Pk].d<..V...~L...\E..I.'=X........_.iX&.9.\|........8l.Y9v...Q........YV_.....y...n).,.i...??W..9..7...?.dNH7..V.0.\|Bh4.d..7Q..I.a....4..1........('....o...'...Q.e...>...R.(.....a.~...".{=D....^....._l..V/<0n.....f.........)^..a)gN/...x?.!.[..=..n.B.i....$aA.

C:\Users\user\Downloads\FENIVHOIKN.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.865004428472304
Encrypted:	false
SSDEEP:	24:ND5OVZnA7rP3w4X2LuGoyJvUOn60yRDLc87Ybxork9NgojAVdOVdJroVYnv+06wr:BUjAQ4wubO6XfY594dYL8A6w/I0
MD5:	369467F6203840B8380059E9C0F3A4FC
SHA1:	E347385DEB31271DB2200B45AFE9AD7EE0A6D2D2
SHA-256:	D26A3CCD703FC0BEFA458D517FE0D8FBA3355367419657C1C73CC61F961AAE8C
SHA-512:	B31B48B84BBC3FCB8935B3EBAD5ECBC0D76D4C6E807CB58CE88E712341D6664D7CCDC63DBFE177139174370535BFF009AEA8700DD2579BC3748475618E4D046A
Malicious:	false
Preview:	..}.=....J2..)\|Fg ...M.+.8...ciI.....i?.a...1.'_...E@.#....5A..i.....g/....;.2D...^O.#"...&G.z1.......6........+L..!R.....{f.8N.C.;N\|.u..K.f.x-.ud>.....t...VN.Z.".ddzw\|Ze.v\|..cd.zVw%.?..qf....;./fZ...j........Zl2.....h.b{gn....d.....l.u...,.........O.,...h..,..Pe..A]v..Y..$.....N..&.....FE5.._L."......W.@........7....<.....".m.(.X.<ph..e.....`CMQP....V...`2.mk...lg-..n0.:.1.q..[p.AR...(!.....2.........Nc...:.,..B...h..H....l.....^,.B....;@*.....Sh...n=dG....{P......V.2....D..S...........}....o..3x$..1 ......{.....\.=^..!.{..=HB.nd..e.^U.wP......89..~..n.4 W.....`.S..YAo..z..f.ju..Uu.&F....:9..Sp..`......D....3.......i.i...7..E3.?.Y%;h.=..m.....X.....@S..)g.&..yM... k...6....Rj...G1Pk].d<..V...~L...\E..I.'=X........_.iX&.9.\|........8l.Y9v...Q........YV_.....y...n).,.i...??W..9..7...?.dNH7..V.0.\|Bh4.d..7Q..I.a....4..1........('....o...'...Q.e...>...R.(.....a.~...".{=D....^....._l..V/<0n.....f.........)^..a)gN/...x?.!.[..=..n.B.i....$aA.

C:\Users\user\Downloads\LSBIHQFDVT.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.858614138131857
Encrypted:	false
SSDEEP:	48:G4yVm0hs78G6AKduzFFJ38qfOQIS7ah2iC:LyNhsOAPRFJ38Z8ah7C
MD5:	69CD38D6C5D5F877F4A079C1B2D19658
SHA1:	F9680037D262170A25E7319D1E71AA9FBF687E2B
SHA-256:	B6B1565936CBC6A55ECF2E977C3E27A8558FAE1523D6199650A31AFD7932099B
SHA-512:	8DB92E18497D21CEDC2955106FBDF5EC91BCA179FD8A1D7204BCB209E1C66AA56400FCBE5C849C10E96E58E704922E20D5C091F223388FAB332510736F57E232
Malicious:	false
Preview:	.j..m...I.N.[....d.>Q\|{uB. .:X.....<.%.....-P..iHR.A.5..L)..?...o.f.....65?L.....5\.....r.t...[-.37j.7..Ba.=j_..i.G.............V.#I.@;...:.q.....k....1.H.W...\..m.\s..{.k~.....i.6.m7..ImL'..V.c.[.Q.L..poV..?.\|+.....'......9d.[{.... L..$`...@..cI.?0...EQ.90.e.O.o.8@._v.l\.\|:..x.....Pz.cW3.:N.i..eVE0K.Sx70wS.......x.!.v..{{...1(...8...b....8.....-....z.....t.w..l..>E.}i..wZ.&.?..7..N.ei...8j$...<d.9.-~4..-I\L>....S.h.r.s..a+.&1..&..6....z..;..p3(.....1.>X.b.WRgn......8...;[5;.!..Y......T.\.g.~.r.zFT....K9.]w......w..5...@>..R.....A..9I....'.W....b}...0.I.q.xz....Vd.DW;...i..0....C.!yZwn..A......s..qQ..B.V.....IE.h.v.j..@8...Y..c..vp..bG._..w.~.)........~...-..d....._..3.(.(...L...K.E>..*...I(.o...'...4[I8{....r..".x.%.>.(...a....Ia(IH.a.......D...MK\r..h..0.R.6.......{..2=s\|...o.....(...QXx..5.$...(..NIr.'..........r...a.u..Y.0... dZ.b.!.S.&+$.U:kI.^.....N'h.0"..M...Yx. ....yO......4v..#..@...9.go./.@:f.d.c[W....i.h..d..;...&Y...'

C:\Users\user\Downloads\LSBIHQFDVT.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.858614138131857
Encrypted:	false
SSDEEP:	48:G4yVm0hs78G6AKduzFFJ38qfOQIS7ah2iC:LyNhsOAPRFJ38Z8ah7C
MD5:	69CD38D6C5D5F877F4A079C1B2D19658
SHA1:	F9680037D262170A25E7319D1E71AA9FBF687E2B
SHA-256:	B6B1565936CBC6A55ECF2E977C3E27A8558FAE1523D6199650A31AFD7932099B
SHA-512:	8DB92E18497D21CEDC2955106FBDF5EC91BCA179FD8A1D7204BCB209E1C66AA56400FCBE5C849C10E96E58E704922E20D5C091F223388FAB332510736F57E232
Malicious:	false
Preview:	.j..m...I.N.[....d.>Q\|{uB. .:X.....<.%.....-P..iHR.A.5..L)..?...o.f.....65?L.....5\.....r.t...[-.37j.7..Ba.=j_..i.G.............V.#I.@;...:.q.....k....1.H.W...\..m.\s..{.k~.....i.6.m7..ImL'..V.c.[.Q.L..poV..?.\|+.....'......9d.[{.... L..$`...@..cI.?0...EQ.90.e.O.o.8@._v.l\.\|:..x.....Pz.cW3.:N.i..eVE0K.Sx70wS.......x.!.v..{{...1(...8...b....8.....-....z.....t.w..l..>E.}i..wZ.&.?..7..N.ei...8j$...<d.9.-~4..-I\L>....S.h.r.s..a+.&1..&..6....z..;..p3(.....1.>X.b.WRgn......8...;[5;.!..Y......T.\.g.~.r.zFT....K9.]w......w..5...@>..R.....A..9I....'.W....b}...0.I.q.xz....Vd.DW;...i..0....C.!yZwn..A......s..qQ..B.V.....IE.h.v.j..@8...Y..c..vp..bG._..w.~.)........~...-..d....._..3.(.(...L...K.E>..*...I(.o...'...4[I8{....r..".x.%.>.(...a....Ia(IH.a.......D...MK\r..h..0.R.6.......{..2=s\|...o.....(...QXx..5.$...(..NIr.'..........r...a.u..Y.0... dZ.b.!.S.&+$.U:kI.^.....N'h.0"..M...Yx. ....yO......4v..#..@...9.go./.@:f.d.c[W....i.h..d..;...&Y...'

C:\Users\user\Downloads\NIKHQAIQAU.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.882910216223467
Encrypted:	false
SSDEEP:	24:OkLX2bj4opKuvhC62mtnGuo2diGOCeNZMfauvSqz/D3zkaRPvS3x/ekhKeK:OkLXCguvhC6xtG5jSm6ZvSijrOceK
MD5:	54764435B50D871D7F651DB5B4FB261A
SHA1:	DB94CB6DE46E6058DEDC2B038BA8E1A6873507C6
SHA-256:	54ABC05CA20F060C2024FE181EC9F331018AC71BFC23C0DBE71F800C95AF7142
SHA-512:	F6E14906D2DDD033ABF65CBB4551BC4259E16BD06EBFCDDB0205318334D774240EF4B032C54A2292BCD4BDF4D25164EF6777EF8CDFF42D76EE0B91C18AA7F4B9
Malicious:	false
Preview:	X2.xFA..............}M..yR./.4.5.A...z..p...-....s......A.V..Jf1...^P9...H...v.Z...s.....j...m..\.zc.,bS..[.N..B.U.jS.m.....2;...3.i\......X_.)M...WM.>.).&.gy.... +....X.4.......j,....}..o2..t..W...D)....H-.....P.R.......x....u.^..].<............9..^......".nQ..9A76G...L.D_!.r.Q.9../r.I.eJ...q.&....}m..h...b.W...)......aL.....K..Q..0...,....v.b.....9...U?.y..QA....k.......'.xu..?~{..V.......dh......y?_.Py........9..1.y.W.E{.;N.../.O..aSI..=3..o.....Q..qw(N$.....VQ..(.g..Wn...1$.X!.yn........R[[RQWS^5.2AY....q...8.JS.x...i.'..+#.......:Q?[AF\|....ED8....O..._u.N..nn.....{K...3:..$wX.QG.{....:....../$.............(&... ....PQ?...x..."9.....ek.BP.u=....h.......p..<..{.Y"...q...Z.(...,....@.B..:...4..;......\OC..T<....V.%.x..7...7t.......~.y:E....O.A......Eeh..9nK.....+.X......{0K.dV.ik..?}VT.F..<..7....e......;7![.;...v.1...B.M.[..U...X!`.h.%.*\2e.......N.;..yIi..k_(.......;.7..!.........%..Z...C.Ki....j"g.:>....u1...8.:s=.0.l.pg....S..ck....

C:\Users\user\Downloads\NIKHQAIQAU.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.882910216223467
Encrypted:	false
SSDEEP:	24:OkLX2bj4opKuvhC62mtnGuo2diGOCeNZMfauvSqz/D3zkaRPvS3x/ekhKeK:OkLXCguvhC6xtG5jSm6ZvSijrOceK
MD5:	54764435B50D871D7F651DB5B4FB261A
SHA1:	DB94CB6DE46E6058DEDC2B038BA8E1A6873507C6
SHA-256:	54ABC05CA20F060C2024FE181EC9F331018AC71BFC23C0DBE71F800C95AF7142
SHA-512:	F6E14906D2DDD033ABF65CBB4551BC4259E16BD06EBFCDDB0205318334D774240EF4B032C54A2292BCD4BDF4D25164EF6777EF8CDFF42D76EE0B91C18AA7F4B9
Malicious:	false
Preview:	X2.xFA..............}M..yR./.4.5.A...z..p...-....s......A.V..Jf1...^P9...H...v.Z...s.....j...m..\.zc.,bS..[.N..B.U.jS.m.....2;...3.i\......X_.)M...WM.>.).&.gy.... +....X.4.......j,....}..o2..t..W...D)....H-.....P.R.......x....u.^..].<............9..^......".nQ..9A76G...L.D_!.r.Q.9../r.I.eJ...q.&....}m..h...b.W...)......aL.....K..Q..0...,....v.b.....9...U?.y..QA....k.......'.xu..?~{..V.......dh......y?_.Py........9..1.y.W.E{.;N.../.O..aSI..=3..o.....Q..qw(N$.....VQ..(.g..Wn...1$.X!.yn........R[[RQWS^5.2AY....q...8.JS.x...i.'..+#.......:Q?[AF\|....ED8....O..._u.N..nn.....{K...3:..$wX.QG.{....:....../$.............(&... ....PQ?...x..."9.....ek.BP.u=....h.......p..<..{.Y"...q...Z.(...,....@.B..:...4..;......\OC..T<....V.%.x..7...7t.......~.y:E....O.A......Eeh..9nK.....+.X......{0K.dV.ik..?}VT.F..<..7....e......;7![.;...v.1...B.M.[..U...X!`.h.%.*\2e.......N.;..yIi..k_(.......;.7..!.........%..Z...C.Ki....j"g.:>....u1...8.:s=.0.l.pg....S..ck....

C:\Users\user\Downloads\QNCYCDFIJJ.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.874069096776201
Encrypted:	false
SSDEEP:	48:T5O70N85ihu/f2vnwxhyM2vOeZe6hV4pu5hABFh3mz7bZ0L5W:T542ZAhyM2fjABFBmC8
MD5:	4379800BA9E658427E4FB963AB960527
SHA1:	A6657424F4ED53B4044CEC53098A14FA35EEFBFB
SHA-256:	EEFF8C7747C1018D68732773A936240CA7B2D74F226DF9E085AC41C6CD721D2B
SHA-512:	752560A3C2406103DA146FDCCE664801775D470B405A3B244A785082CB95368D1CE0E1E74649734974B9139FD108F9E968D70E9D93DB4A296F80FCF1F6E462DF
Malicious:	false
Preview:	.M\|.x )@Q..&(.Z.."..I...-.......3...~.Jr..%@.. ........w5..tK."a5.....@p....I&l....IA...%k@:s.(.wCwk..>@hE.H..~,.):t...E....i.$ie..$'p.IB...k.%.....ya......{.]...(.5...K.9_.U8X..I..<e.......l....P.:..E...>).N..........>..0..g....sC..dS..wJx&..s...Z..ps>O{.V.K.zbO<7.H.\|'_.R..{L..o..A....F./v......spQ.O......s+....?....'"..!.;..6.B...,..]S\..k..2.&....e..O..}.F ..!=?Z.y..d{l..... .\|..,..\:..jj.H1I/...F...[...l..yb.R....)..j.Y.....`..[b.B...)L...~...^N.>....~..<........EU.8..A.A..z....V.uS...?DP...........W..F.d[.....B..W.T.......Fj.R..48......m..0...!..w..lY.........!.PE,1C.8s....-!..........D... 6....=4c..C..;\|..%....%j:..E..:.E......x+...kr...$.l.n....x.sN.]#[.....w...:.g.d.N:.<.U...DE....A`qX.G.....f....1[m!.^...RuE..!.r.<......!_...A@.F..\|o.!"_i)..z.~......"..*.H.t.A/4.... .7s.o._...\8N....4.5...e"..+aC........a.Y..O..(oP>+".q..e....YD.L6..8.AW.e....L..Uy#.~...oB..ng.......z4.(.._"}..2.f2.x..`..GJ..X ........,w..........._{.S

C:\Users\user\Downloads\QNCYCDFIJJ.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.874069096776201
Encrypted:	false
SSDEEP:	48:T5O70N85ihu/f2vnwxhyM2vOeZe6hV4pu5hABFh3mz7bZ0L5W:T542ZAhyM2fjABFBmC8
MD5:	4379800BA9E658427E4FB963AB960527
SHA1:	A6657424F4ED53B4044CEC53098A14FA35EEFBFB
SHA-256:	EEFF8C7747C1018D68732773A936240CA7B2D74F226DF9E085AC41C6CD721D2B
SHA-512:	752560A3C2406103DA146FDCCE664801775D470B405A3B244A785082CB95368D1CE0E1E74649734974B9139FD108F9E968D70E9D93DB4A296F80FCF1F6E462DF
Malicious:	false
Preview:	.M\|.x )@Q..&(.Z.."..I...-.......3...~.Jr..%@.. ........w5..tK."a5.....@p....I&l....IA...%k@:s.(.wCwk..>@hE.H..~,.):t...E....i.$ie..$'p.IB...k.%.....ya......{.]...(.5...K.9_.U8X..I..<e.......l....P.:..E...>).N..........>..0..g....sC..dS..wJx&..s...Z..ps>O{.V.K.zbO<7.H.\|'_.R..{L..o..A....F./v......spQ.O......s+....?....'"..!.;..6.B...,..]S\..k..2.&....e..O..}.F ..!=?Z.y..d{l..... .\|..,..\:..jj.H1I/...F...[...l..yb.R....)..j.Y.....`..[b.B...)L...~...^N.>....~..<........EU.8..A.A..z....V.uS...?DP...........W..F.d[.....B..W.T.......Fj.R..48......m..0...!..w..lY.........!.PE,1C.8s....-!..........D... 6....=4c..C..;\|..%....%j:..E..:.E......x+...kr...$.l.n....x.sN.]#[.....w...:.g.d.N:.<.U...DE....A`qX.G.....f....1[m!.^...RuE..!.r.<......!_...A@.F..\|o.!"_i)..z.~......"..*.H.t.A/4.... .7s.o._...\8N....4.5...e"..+aC........a.Y..O..(oP>+".q..e....YD.L6..8.AW.e....L..Uy#.~...oB..ng.......z4.(.._"}..2.f2.x..`..GJ..X ........,w..........._{.S

C:\Users\user\Downloads\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.859946260496522
Encrypted:	false
SSDEEP:	48:Yrrq0IMCIZlPinOk+f/WMM/pUNTsJEmz3lzVslChiBLx6:Yrrz/fPi5+fpMxUNTsJEmz7slChiBLx6
MD5:	482A48EC7456112B2CC4FA98FC228933
SHA1:	C92C1A84BB69D0F82F392122ED648991FED88BAE
SHA-256:	7BD56A231D9A2C0F50D4F102802DBEFA40790DAECE793E496CBE147B3168855A
SHA-512:	11E076CC9CB0B64AD9DCCF871DC3A980F223C8DFF624A5F2810FC1971DA256F5B03CE34E497CD9EFFCA946722D097643B139D3D6C9C5FCC0F2930DBDB8024470
Malicious:	false
Preview:	m..d.9...S.N.df.......6.......#.5.....)D.{..........Z....$N`..jC.Te&..A..W.4.GI.99r....xw/G..'4..fgn.`k+..x.o.....1...Wx#.....Hm.b.@xD.l.....C..B..z.9.......k).....C.]t2..d.$F............uM.8-........V./l..YD.w5.X..t.7.... C.m....8]..Z.)j..;.c\.....h.. ..........B}\l_.(.].~....[v.-.......l,..r.........B[4..c.....B'...#........o...N..PB..+.u+......2...7}:.$.x._....o...ps.u@........?..@D}.jj..[.M...W?.....C5.k...<.k..76.....H..R.......B....)..........-..B...+.C.+U.6.w.....Y)..............Si.b...>'..z.7..f...r.6(F..R..e..S...l.....J...)&..S:n.pP\|[.......LR...'....^..MT...M..6P...cQ.!.J....J&.y.n.1i..z....Z.2..b.V..?y9.7.p...$..t%......>e...O.xI....h)34.i..R.....>q...\C.f..B...........y..v.V...q.N.........`.....soV..6l<.K.5.]_.Uyd2..4.^.{-.........!8....@eGg..<.....E@f.C[d.A..lB.?l......,.0.h~..x..IP...!...d....V..Q.B.............[..[X.;..).K.m.%.B.z<g...6.!.^.gCI`.5\|...M.[..6%.....n.p+..).x..%..NBI.......(MN ......&.....L..#.vtnZ.p]P.

C:\Users\user\Downloads\RAYHIWGKDI.docx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.859946260496522
Encrypted:	false
SSDEEP:	48:Yrrq0IMCIZlPinOk+f/WMM/pUNTsJEmz3lzVslChiBLx6:Yrrz/fPi5+fpMxUNTsJEmz7slChiBLx6
MD5:	482A48EC7456112B2CC4FA98FC228933
SHA1:	C92C1A84BB69D0F82F392122ED648991FED88BAE
SHA-256:	7BD56A231D9A2C0F50D4F102802DBEFA40790DAECE793E496CBE147B3168855A
SHA-512:	11E076CC9CB0B64AD9DCCF871DC3A980F223C8DFF624A5F2810FC1971DA256F5B03CE34E497CD9EFFCA946722D097643B139D3D6C9C5FCC0F2930DBDB8024470
Malicious:	false
Preview:	m..d.9...S.N.df.......6.......#.5.....)D.{..........Z....$N`..jC.Te&..A..W.4.GI.99r....xw/G..'4..fgn.`k+..x.o.....1...Wx#.....Hm.b.@xD.l.....C..B..z.9.......k).....C.]t2..d.$F............uM.8-........V./l..YD.w5.X..t.7.... C.m....8]..Z.)j..;.c\.....h.. ..........B}\l_.(.].~....[v.-.......l,..r.........B[4..c.....B'...#........o...N..PB..+.u+......2...7}:.$.x._....o...ps.u@........?..@D}.jj..[.M...W?.....C5.k...<.k..76.....H..R.......B....)..........-..B...+.C.+U.6.w.....Y)..............Si.b...>'..z.7..f...r.6(F..R..e..S...l.....J...)&..S:n.pP\|[.......LR...'....^..MT...M..6P...cQ.!.J....J&.y.n.1i..z....Z.2..b.V..?y9.7.p...$..t%......>e...O.xI....h)34.i..R.....>q...\C.f..B...........y..v.V...q.N.........`.....soV..6l<.K.5.]_.Uyd2..4.^.{-.........!8....@eGg..<.....E@f.C[d.A..lB.?l......,.0.h~..x..IP...!...d....V..Q.B.............[..[X.;..).K.m.%.B.z<g...6.!.^.gCI`.5\|...M.[..6%.....n.p+..).x..%..NBI.......(MN ......&.....L..#.vtnZ.p]P.

C:\Users\user\Downloads\RAYHIWGKDI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.877153270519418
Encrypted:	false
SSDEEP:	24:0BuHi9CZkrBs5ASZKP+O/NHT+fFbkvc+c5zSxHSkVcI026kcm5KtI8W0RSgRoFaW:0BuHiwQB2u+fi3cxSzuyKthhmgW
MD5:	EEC9D87B0BE0DD6689E6C9FCD48620ED
SHA1:	AF9BE09ED70E7141A4A0F4DE96A793F95FDA3E64
SHA-256:	AA86C37C119E179B2C1B20F3E12FECC8E045CE0C6426A051A03A9499FA79FBB9
SHA-512:	12EFC38A6C3E71A21D309577D966BA162CAC9697FD3C37D4863CE8A8BF125E38D7A808659922BBE9F4F91C4EA71472B089B2B46FCF623A733D9477A75DC60201
Malicious:	false
Preview:	..~M.......W.K.mB.}%.T{.E`....k.q..x...g.-0..2..Q]T..$...4AD.1.._...i.Z....e..7...uW..2....[....:.&....d`:.BJ8....>.;M...Tq...q.j.3b.3....Ho...Y..1-.......e..p.$...d....nc....5...5;......,..E...}$....l..._6.ar......O....z@.G%H.w...}.4...M.....r}..[U....u...S.......p...r......l>.m.t.i.oc[6...BR...a.....x.....#.....-Shl.Bc8.....-.,..S..7`[S..=.W...).P...m.Y..4.&\|....`b...?.P.#.;.:.4.9~.U.{.{..!.m..7f....N].....1....>.5......>../.....?7.KN......."......y..x%J..T+mM.....^...\|.I)R..1.......,".\|..Y._..B.;c.7w..:.?;.x.^...2.&..9._.YOi!.~L.c..#:..{D.L..w'..<...q..~..3.8..{...D1.i.....k..gfrB.vh.v......L...v..4...^..%.qi.(......xR.....t.R......M..p.....\|.........`.B^.A....Gy_.TD.........D.i$.V..l...2.....T...dNCfO5.wF..JoE.,..\|....Z...}G...[...~\.bc.:G.^....T{JF.tY....*..p&~...4..].)...=..].c....3.Ud...J.0..I.....,)J.WJ....:..K4qy.E.O.........A.(..!#.y.2.3.".X.C....,.^y.#.w........:9.q.eIk.md...X..#..r._.2...../&......?..O..)..5..7T%.t.Qh....l.

C:\Users\user\Downloads\RAYHIWGKDI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.877153270519418
Encrypted:	false
SSDEEP:	24:0BuHi9CZkrBs5ASZKP+O/NHT+fFbkvc+c5zSxHSkVcI026kcm5KtI8W0RSgRoFaW:0BuHiwQB2u+fi3cxSzuyKthhmgW
MD5:	EEC9D87B0BE0DD6689E6C9FCD48620ED
SHA1:	AF9BE09ED70E7141A4A0F4DE96A793F95FDA3E64
SHA-256:	AA86C37C119E179B2C1B20F3E12FECC8E045CE0C6426A051A03A9499FA79FBB9
SHA-512:	12EFC38A6C3E71A21D309577D966BA162CAC9697FD3C37D4863CE8A8BF125E38D7A808659922BBE9F4F91C4EA71472B089B2B46FCF623A733D9477A75DC60201
Malicious:	false
Preview:	..~M.......W.K.mB.}%.T{.E`....k.q..x...g.-0..2..Q]T..$...4AD.1.._...i.Z....e..7...uW..2....[....:.&....d`:.BJ8....>.;M...Tq...q.j.3b.3....Ho...Y..1-.......e..p.$...d....nc....5...5;......,..E...}$....l..._6.ar......O....z@.G%H.w...}.4...M.....r}..[U....u...S.......p...r......l>.m.t.i.oc[6...BR...a.....x.....#.....-Shl.Bc8.....-.,..S..7`[S..=.W...).P...m.Y..4.&\|....`b...?.P.#.;.:.4.9~.U.{.{..!.m..7f....N].....1....>.5......>../.....?7.KN......."......y..x%J..T+mM.....^...\|.I)R..1.......,".\|..Y._..B.;c.7w..:.?;.x.^...2.&..9._.YOi!.~L.c..#:..{D.L..w'..<...q..~..3.8..{...D1.i.....k..gfrB.vh.v......L...v..4...^..%.qi.(......xR.....t.R......M..p.....\|.........`.B^.A....Gy_.TD.........D.i$.V..l...2.....T...dNCfO5.wF..JoE.,..\|....Z...}G...[...~\.bc.:G.^....T{JF.tY....*..p&~...4..].)...=..].c....3.Ud...J.0..I.....,)J.WJ....:..K4qy.E.O.........A.(..!#.y.2.3.".X.C....,.^y.#.w........:9.q.eIk.md...X..#..r._.2...../&......?..O..)..5..7T%.t.Qh....l.

C:\Users\user\Downloads\SFPUSAFIOL.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8672822800135185
Encrypted:	false
SSDEEP:	24:8EyyavOToR+Hp8tzDixI6GenGEZBSbrQRlGgcud6TtzgsHzcgll2H:Fybv68zC8ePZB6rQPGgcRgZgll2H
MD5:	92F44F42F0C6428B3F1FF4D37E6509D1
SHA1:	F153F9C4F9298422E2DD73B73E0AC1A69D6B774B
SHA-256:	DE2B8CD6A856B04413A8D40AA2FF8B8E803B4E8296247AB40528A506684F88CC
SHA-512:	8CB50C7C806BE7C52C9396C0B539D28FD4BDC42B163862D73FFE9FF08BD82A0DEA9456C5D06E0D77FC6CAB9D5A59EAF3566C7184607F3834CBA6313813D00774
Malicious:	false
Preview:	OV....D6.7`l.T..k..\|'..6/...y..Pl_..u....... .....5........0.............{~.&Qo\ir....M.v.E3O.....<.D.,..k...x\|..^.....Or$..@..4XS..R....1<.V..i..a..?...q.Jk8...Q...v9.;.{.v+...5..#.L.,-IZ+.?....0h#m$...N..Z.-.[D1.............z.kmE.J.....Fl^..N?.Sj...]V.RT..p.....h.E..f;....V.)..U..U..Q.k..A.J.0...)....[...l..wq.....n.RU...6\|......t1...e.......?..dgD....CyeQ.\|h.+...!...=.P._q.[.%.X,....=...S..F3..S...8.Y.M.%....0.05...s3.z.Y....w)......hk...\..f.....I.51.....pW.q...G..a..E.=...fj..."..6.K;{c...z....h...'.w...7.q.P...V....$....X...!...f......X.v.<..R..+.X...z).o........^....}6...E}.)..m.G..9..Ln.g]Nf.......2E=$J\|(m..cb.v.R.....+.l.A......4.J.6.y\|..P9b{R.{...p..K.O{...........Hlc....f...2@.~..........g..B.@.p$..Rg.R..z":...Rm.J.T5.....h......J./...q..s.ft..R.I'..O,H5.?...S..8...g.....S..r~V.!.<S..@i.I3.c......W.~o....y.{...d.?...#.a.wtA.{d.8...Y.^g.!..,..m........4~K{...Z.H....;..w.[`0..f>...'..Y.9@v-.......$.mLU.....D.r.p......i

C:\Users\user\Downloads\SFPUSAFIOL.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8672822800135185
Encrypted:	false
SSDEEP:	24:8EyyavOToR+Hp8tzDixI6GenGEZBSbrQRlGgcud6TtzgsHzcgll2H:Fybv68zC8ePZB6rQPGgcRgZgll2H
MD5:	92F44F42F0C6428B3F1FF4D37E6509D1
SHA1:	F153F9C4F9298422E2DD73B73E0AC1A69D6B774B
SHA-256:	DE2B8CD6A856B04413A8D40AA2FF8B8E803B4E8296247AB40528A506684F88CC
SHA-512:	8CB50C7C806BE7C52C9396C0B539D28FD4BDC42B163862D73FFE9FF08BD82A0DEA9456C5D06E0D77FC6CAB9D5A59EAF3566C7184607F3834CBA6313813D00774
Malicious:	false
Preview:	OV....D6.7`l.T..k..\|'..6/...y..Pl_..u....... .....5........0.............{~.&Qo\ir....M.v.E3O.....<.D.,..k...x\|..^.....Or$..@..4XS..R....1<.V..i..a..?...q.Jk8...Q...v9.;.{.v+...5..#.L.,-IZ+.?....0h#m$...N..Z.-.[D1.............z.kmE.J.....Fl^..N?.Sj...]V.RT..p.....h.E..f;....V.)..U..U..Q.k..A.J.0...)....[...l..wq.....n.RU...6\|......t1...e.......?..dgD....CyeQ.\|h.+...!...=.P._q.[.%.X,....=...S..F3..S...8.Y.M.%....0.05...s3.z.Y....w)......hk...\..f.....I.51.....pW.q...G..a..E.=...fj..."..6.K;{c...z....h...'.w...7.q.P...V....$....X...!...f......X.v.<..R..+.X...z).o........^....}6...E}.)..m.G..9..Ln.g]Nf.......2E=$J\|(m..cb.v.R.....+.l.A......4.J.6.y\|..P9b{R.{...p..K.O{...........Hlc....f...2@.~..........g..B.@.p$..Rg.R..z":...Rm.J.T5.....h......J./...q..s.ft..R.I'..O,H5.?...S..8...g.....S..r~V.!.<S..@i.I3.c......W.~o....y.{...d.?...#.a.wtA.{d.8...Y.^g.!..,..m........4~K{...Z.H....;..w.[`0..f>...'..Y.9@v-.......$.mLU.....D.r.p......i

C:\Users\user\Downloads\SFPUSAFIOL.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.854254097391669
Encrypted:	false
SSDEEP:	48:tOO32TUbnzAceHqPYRkUmd0FwREZDe8nb:tOORnzAck0fjyZDes
MD5:	C68FEE6813A534A95914A5C365ECB7FF
SHA1:	40B569EC2E67F166D913F6EF22FA28EF9A7877AD
SHA-256:	2AAE4189601B88F22519EF5383AA9A523940688F852A312D9A9B399BD07A0532
SHA-512:	8DB3335209B8D5D91928D13B188941B2C33B7BFE9F639D52A7DC7EAA2875E1DB39DD79DD5A6395B9BD29E37AA73F0FD1660B89403DBD888B4DD3B849D8AF619D
Malicious:	false
Preview:	..T.Vx.0(v...83.QTp..n;...&r...D...I....uD^W...V.vh.#qZ...,..?.._.V.g..D....D\+.1..\..6?.l.t~h..........)..I.;M.....f.......d.m.76...z.A.6Yt_....4....8'..Y......'!3.0..r....Q..Z.1...ioPd..t.\|x=....2.&..4W.....CWc...'..nA......S....:.M......g}.N....]R.X.3...........=...5uI.oHu..U...{..U....H.....+....5u. .....Kd......x....x.H...#..6.gL.S.i...9..S...i....B..!E....E..q.....?Rc..$9'.yM.a.?...)Q..."h.......G........O.z.D..s..1(e.]....."..d...9..;>....\|.%. .7.b)..k........a.]....2E./........j.SG.t.{...{..G..z......2...... M.....:.....H;5B}............... .P3.t.`......F,...*g. ....;a./\8P.N..-}C.y\.l.G.c!......}^.[C.B-..]......(../.B&.0.<..+.RO.8.;..N.F1zw>Oz./a._.....l.n.&\AT.F..F..N. w.F....3.z.$...a..rq..\|,.t.b..dd..W..g.:z^..(z{.BO..]cD.=.]\|.5............:...\./i...gy.~!.i@o$e.G.xt....W.....C.P7........x..X...0.......X..}.......Q......n.H.f.....-h\|..] .:.cu.-.1g.,...qg...$...6Us:R.J..h.)..b..lo.....9.?....?..9{..E\|..V\|..#.Y.U.E?.

C:\Users\user\Downloads\SFPUSAFIOL.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.854254097391669
Encrypted:	false
SSDEEP:	48:tOO32TUbnzAceHqPYRkUmd0FwREZDe8nb:tOORnzAck0fjyZDes
MD5:	C68FEE6813A534A95914A5C365ECB7FF
SHA1:	40B569EC2E67F166D913F6EF22FA28EF9A7877AD
SHA-256:	2AAE4189601B88F22519EF5383AA9A523940688F852A312D9A9B399BD07A0532
SHA-512:	8DB3335209B8D5D91928D13B188941B2C33B7BFE9F639D52A7DC7EAA2875E1DB39DD79DD5A6395B9BD29E37AA73F0FD1660B89403DBD888B4DD3B849D8AF619D
Malicious:	false
Preview:	..T.Vx.0(v...83.QTp..n;...&r...D...I....uD^W...V.vh.#qZ...,..?.._.V.g..D....D\+.1..\..6?.l.t~h..........)..I.;M.....f.......d.m.76...z.A.6Yt_....4....8'..Y......'!3.0..r....Q..Z.1...ioPd..t.\|x=....2.&..4W.....CWc...'..nA......S....:.M......g}.N....]R.X.3...........=...5uI.oHu..U...{..U....H.....+....5u. .....Kd......x....x.H...#..6.gL.S.i...9..S...i....B..!E....E..q.....?Rc..$9'.yM.a.?...)Q..."h.......G........O.z.D..s..1(e.]....."..d...9..;>....\|.%. .7.b)..k........a.]....2E./........j.SG.t.{...{..G..z......2...... M.....:.....H;5B}............... .P3.t.`......F,...*g. ....;a./\8P.N..-}C.y\.l.G.c!......}^.[C.B-..]......(../.B&.0.<..+.RO.8.;..N.F1zw>Oz./a._.....l.n.&\AT.F..F..N. w.F....3.z.$...a..rq..\|,.t.b..dd..W..g.:z^..(z{.BO..]cD.=.]\|.5............:...\./i...gy.~!.i@o$e.G.xt....W.....C.P7........x..X...0.......X..}.......Q......n.H.f.....-h\|..] .:.cu.-.1g.,...qg...$...6Us:R.J..h.)..b..lo.....9.?....?..9{..E\|..V\|..#.Y.U.E?.

C:\Users\user\Downloads\SQRKHNBNYN.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8698209277003155
Encrypted:	false
SSDEEP:	48:WC8KjT2yfADKOYE9dM5TwgnDCKnENND5H:WC8KuDKOYKMZCQmVH
MD5:	41D1D2B4914189CA55AA858130989BB0
SHA1:	B250A403B17D71CE8F94672BE72BFD4A441631E4
SHA-256:	2314C8A47C01153033F6D1D76AC937D00FF818DC8BDC3842F7894F8823D3B206
SHA-512:	F91886A6FB815D79E1641608CEB883B60A18813F24B5E287C409891A9024FD680409E1F196BE9C2D3328BF2C7D5ABD6F35B1A100D3545B7F09A6B84F907829C2
Malicious:	false
Preview:	...AT..!d;...Q..`..U...F./L.#.S.........Ey.......d.......m.'&.g......Og.{..+..D.=S..y..sL..].Kk..i.n.6..YB.s...>4...................A.B....a...\z.O....(.!p.-n..).19.E......9.N._..z.N.Y...~)...exc.T..-...6.~.$y....)..Z...w{./).Q....k.V..$....w..}..<..1.../..2......kW$...E..W...:_....-..9...(.g.1..}B.o..S..U..r(g...2...a...<0[...[u.....@.....'.5L.a............a..T...S.>..X;$.... e.!hm...e.t).&..\.....a[...u...M...)nyV.;L."d.x....s..4...,..~._3x.f.Fz_O.-53...bW.:^...-..E...t.6.}hk5.Q#..7e...{.1...:.o.%.1....0O<.'.6...t..f..b.....7"..]L\...m....7.R9..2,n........C.e.@?.&.N{.@<......m...;...#......a.....j...p.........T....#..E1...h.@...pA...'.4.I.`.CTs..m]SA.ghm^/\.i...Z..t..."..J....]e.CT.iw....,.:.......V.0...{C.=..ux.....H.[(.B.q ..d.F..&t.o....9.-Z.6.5.i.A-.T.TR......q...F...a.n..kha...`....%\|k.+#&QL+r@..".}H]...@f.SM.`....Y.5@.\....B....#..;....)..)s..eO........y..m.y\|dl.W./.b[T..D6.c.w!...ry....8.\|..R..L......wK.....ZP!........t...

C:\Users\user\Downloads\SQRKHNBNYN.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8698209277003155
Encrypted:	false
SSDEEP:	48:WC8KjT2yfADKOYE9dM5TwgnDCKnENND5H:WC8KuDKOYKMZCQmVH
MD5:	41D1D2B4914189CA55AA858130989BB0
SHA1:	B250A403B17D71CE8F94672BE72BFD4A441631E4
SHA-256:	2314C8A47C01153033F6D1D76AC937D00FF818DC8BDC3842F7894F8823D3B206
SHA-512:	F91886A6FB815D79E1641608CEB883B60A18813F24B5E287C409891A9024FD680409E1F196BE9C2D3328BF2C7D5ABD6F35B1A100D3545B7F09A6B84F907829C2
Malicious:	false
Preview:	...AT..!d;...Q..`..U...F./L.#.S.........Ey.......d.......m.'&.g......Og.{..+..D.=S..y..sL..].Kk..i.n.6..YB.s...>4...................A.B....a...\z.O....(.!p.-n..).19.E......9.N._..z.N.Y...~)...exc.T..-...6.~.$y....)..Z...w{./).Q....k.V..$....w..}..<..1.../..2......kW$...E..W...:_....-..9...(.g.1..}B.o..S..U..r(g...2...a...<0[...[u.....@.....'.5L.a............a..T...S.>..X;$.... e.!hm...e.t).&..\.....a[...u...M...)nyV.;L."d.x....s..4...,..~._3x.f.Fz_O.-53...bW.:^...-..E...t.6.}hk5.Q#..7e...{.1...:.o.%.1....0O<.'.6...t..f..b.....7"..]L\...m....7.R9..2,n........C.e.@?.&.N{.@<......m...;...#......a.....j...p.........T....#..E1...h.@...pA...'.4.I.`.CTs..m]SA.ghm^/\.i...Z..t..."..J....]e.CT.iw....,.:.......V.0...{C.=..ux.....H.[(.B.q ..d.F..&t.o....9.-Z.6.5.i.A-.T.TR......q...F...a.n..kha...`....%\|k.+#&QL+r@..".}H]...@f.SM.`....Y.5@.\....B....#..;....)..)s..eO........y..m.y\|dl.W./.b[T..D6.c.w!...ry....8.\|..R..L......wK.....ZP!........t...

C:\Users\user\Downloads\UOOJJOZIRH.png

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.880160688298876
Encrypted:	false
SSDEEP:	48:5AQ7cvTj0Y2xNx8LPDWD/zUubVGQ4nIbnusbduqjRCFa:uQ7cblQ6fbub74nIbnXY8RSa
MD5:	8E5C2997D7743D6513C2DB2E05550185
SHA1:	E3F5F22159FF8E5591DC40BAF160509EE8AFE719
SHA-256:	1D7B62AD22AF47C5F98293086D97029FE896E4AE1BEFF8A7D84B06189D0EB42C
SHA-512:	788D55E8106DEBCBB8166F2C3EE1B7A5EE7A4C1662DFE6C30C81C68E7AC52CC4E12F8E13D4D3475A83E0F9FFEEEDDDF306AA168030B8AD8C02902214011E1990
Malicious:	false
Preview:	.c....g.wJ.".XNjG[4R.....x....>...fksA..R..M..)WT.{.........k.l.8..Z...i.....Tl.n.bpO#'~.c..i.^O.N.IF....u..#....S.E..F..a;D.....1D....x=>..Ua4.o..6P..O...E-...w...p...u...\..sC.{.......9..~..(..t....0..:.).4S...Gi4{.;...>)q3.T....S..5.22.?.......$.'y]..Hw..@.j...s"#...{...m6X..K Z.........\F./.<.c=.y.....i.0...U...Q.. 0.&`._.kM4->...-...4......R7;6.G...T.'~bR...P[...d...vs.....hs.j.._.?.^z:L.....).......1@k.^{....].......A..O{\|...&........aMnv9..s5SYn..Y..L..&.}".q[I..8N.Pb:y....N.:p@..N...'...x.....2pw..T ...Zy...zk!......7...I.J..g.'.9...Rt./f....zj.........Q.a_.....W5{@LQ....+b...P.....Y...w.....7..........B.(..4.....=...(....8..h..z.[.....e..-.....I.jD.y....BI. Z...z..g...6~....K}...]......2.....]...t(v~.R.C..>.H......y......~s.k..h,3....J...8O..`.q.~..1,R=e..._=.8O....o....Tim.K.c.<..c....F`...2..B.).=.'=.@...y...-D....).j.C..Y...\%1.,.(b~&b.x"$..m4KC.*.j1.f.E.9....Q..L.9..4.0....+..Qv..kr..w.l5..G2.......CS....U.......w..6+

C:\Users\user\Downloads\UOOJJOZIRH.png.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.880160688298876
Encrypted:	false
SSDEEP:	48:5AQ7cvTj0Y2xNx8LPDWD/zUubVGQ4nIbnusbduqjRCFa:uQ7cblQ6fbub74nIbnXY8RSa
MD5:	8E5C2997D7743D6513C2DB2E05550185
SHA1:	E3F5F22159FF8E5591DC40BAF160509EE8AFE719
SHA-256:	1D7B62AD22AF47C5F98293086D97029FE896E4AE1BEFF8A7D84B06189D0EB42C
SHA-512:	788D55E8106DEBCBB8166F2C3EE1B7A5EE7A4C1662DFE6C30C81C68E7AC52CC4E12F8E13D4D3475A83E0F9FFEEEDDDF306AA168030B8AD8C02902214011E1990
Malicious:	false
Preview:	.c....g.wJ.".XNjG[4R.....x....>...fksA..R..M..)WT.{.........k.l.8..Z...i.....Tl.n.bpO#'~.c..i.^O.N.IF....u..#....S.E..F..a;D.....1D....x=>..Ua4.o..6P..O...E-...w...p...u...\..sC.{.......9..~..(..t....0..:.).4S...Gi4{.;...>)q3.T....S..5.22.?.......$.'y]..Hw..@.j...s"#...{...m6X..K Z.........\F./.<.c=.y.....i.0...U...Q.. 0.&`._.kM4->...-...4......R7;6.G...T.'~bR...P[...d...vs.....hs.j.._.?.^z:L.....).......1@k.^{....].......A..O{\|...&........aMnv9..s5SYn..Y..L..&.}".q[I..8N.Pb:y....N.:p@..N...'...x.....2pw..T ...Zy...zk!......7...I.J..g.'.9...Rt./f....zj.........Q.a_.....W5{@LQ....+b...P.....Y...w.....7..........B.(..4.....=...(....8..h..z.[.....e..-.....I.jD.y....BI. Z...z..g...6~....K}...]......2.....]...t(v~.R.C..>.H......y......~s.k..h,3....J...8O..`.q.~..1,R=e..._=.8O....o....Tim.K.c.<..c....F`...2..B.).=.'=.@...y...-D....).j.C..Y...\%1.,.(b~&b.x"$..m4KC.*.j1.f.E.9....Q..L.9..4.0....+..Qv..kr..w.l5..G2.......CS....U.......w..6+

C:\Users\user\Downloads\VAMYDFPUND.jpg

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.886517588147407
Encrypted:	false
SSDEEP:	48:ceG7PQfUYKV0tse6g/ra7R6XgBGQFD8gFlTyjwUL:ceGLQfUVV0jGIwcID8Qtyjwo
MD5:	AC6AD85C6E01CF95040CBBB6B8BE297C
SHA1:	B439F4A8BB3A427536AE5CEA72BC5F2BA5FA75C5
SHA-256:	ED297771AEDFC467BD311CFF430FAE0710DE12C9F4C297B7B4ABE1E0693CED65
SHA-512:	8BE862BAFF76AA1E975FC4EE75A535EEB77ED9543EBE6F383F7D7779413FDCD86A9BB3AC92BE643E7B16A487AEAB17F9564357CC0634D1EA8E24011B98BE9D5B
Malicious:	false
Preview:	M.....J..>.f.SZ..^7.b.p..q..V8......!..V.F..+.20..PW>.k...PM.$.X.....X.Ae..n..%....V..m......8..R...5.R...5P..M_'l....g..lKyl....:...?:...#..~..-h.......h.<..M.P...ft.D-.....o....x....G...Mo3.9.EE..7.....K..:.#...4UL.9..A]..@[.T'.W5...<.V.W....8..O.L.1....W..\..."+.!.\|...q.Uji.=E.}Sb.`@.r.......9.....9..!...77iqUX.[..)....3w.."<UI.....:.].V..._...V..z..R..s.E.D....Y..8...]..<t..s.C.....(..F../...\"..=..M..K .?.l.._4.......4...\F}.........,...g$3W......5."F...J=.... .Q.xh2.D\|..Ex.NjY.G....#\|.~)...NU..~......R(.<>..?^bgJ.1.#...J...c`.O&...e.....qI.....<..)....T.........h..-v3.W/......+..,x...-........m....lp..n/..&.......]...`P....\|...'..D\|.9.^..SXQ...dC.....]H..Y..e&.BI...S..:. ..d.-....J.@..S........z.y.....Y..fNd9.y6=...3a.-*........D./.......).d..a1Y.w.k...Kv.c...N..q>.U@.X...><.W#...D.ghC.^#.?C...p.........c.U.z.8..4..........b........Q...Y..>IY.[...)..n}.....<..<......d,;.b.\|...E.e.T......._....I1..+.3wH.\|F.{S...

C:\Users\user\Downloads\VAMYDFPUND.jpg.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.886517588147407
Encrypted:	false
SSDEEP:	48:ceG7PQfUYKV0tse6g/ra7R6XgBGQFD8gFlTyjwUL:ceGLQfUVV0jGIwcID8Qtyjwo
MD5:	AC6AD85C6E01CF95040CBBB6B8BE297C
SHA1:	B439F4A8BB3A427536AE5CEA72BC5F2BA5FA75C5
SHA-256:	ED297771AEDFC467BD311CFF430FAE0710DE12C9F4C297B7B4ABE1E0693CED65
SHA-512:	8BE862BAFF76AA1E975FC4EE75A535EEB77ED9543EBE6F383F7D7779413FDCD86A9BB3AC92BE643E7B16A487AEAB17F9564357CC0634D1EA8E24011B98BE9D5B
Malicious:	false
Preview:	M.....J..>.f.SZ..^7.b.p..q..V8......!..V.F..+.20..PW>.k...PM.$.X.....X.Ae..n..%....V..m......8..R...5.R...5P..M_'l....g..lKyl....:...?:...#..~..-h.......h.<..M.P...ft.D-.....o....x....G...Mo3.9.EE..7.....K..:.#...4UL.9..A]..@[.T'.W5...<.V.W....8..O.L.1....W..\..."+.!.\|...q.Uji.=E.}Sb.`@.r.......9.....9..!...77iqUX.[..)....3w.."<UI.....:.].V..._...V..z..R..s.E.D....Y..8...]..<t..s.C.....(..F../...\"..=..M..K .?.l.._4.......4...\F}.........,...g$3W......5."F...J=.... .Q.xh2.D\|..Ex.NjY.G....#\|.~)...NU..~......R(.<>..?^bgJ.1.#...J...c`.O&...e.....qI.....<..)....T.........h..-v3.W/......+..,x...-........m....lp..n/..&.......]...`P....\|...'..D\|.9.^..SXQ...dC.....]H..Y..e&.BI...S..:. ..d.-....J.@..S........z.y.....Y..fNd9.y6=...3a.-*........D./.......).d..a1Y.w.k...Kv.c...N..q>.U@.X...><.W#...D.ghC.^#.?C...p.........c.U.z.8..4..........b........Q...Y..>IY.[...)..n}.....<..<......d,;.b.\|...E.e.T......._....I1..+.3wH.\|F.{S...

C:\Users\user\Downloads\WKXEWIOTXI.mp3

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8650871835808855
Encrypted:	false
SSDEEP:	48:mk2+5jbCArNuQioAYRG4L6xng/a/tUCL8c:J5LrETIrif/F8c
MD5:	5C2CAB01AF7DAC5D04947368846F2796
SHA1:	A452CC67D837B59B8CBA4FF1104A3D9B0ABDA5A5
SHA-256:	5D1B304E7AA43776038F57726A6F5EE08CDF115BA793CACF386415CE9D785E06
SHA-512:	C003AD015164ACDD420FCBBF6521F28082907085219F3FE88B3CE58CA9E6351F3256962CEB59C1CB0245BA56C933FDB793167DCFA6C45CD6719548258D27BA6B
Malicious:	false
Preview:	.vd..5..1b.:...7...$.'....<.....i.....8P...>=J..#."..w.%...nd...gs...F6$_..xy.../S.S....q..K.Fk..x8Ei.P....3.....s..g.K.uOq...D..n..M\|...+P..d.u.q..N%\.P .@.0.....:........s.........c..(...$..Hs...b.e./V.E=......FC....k.f...A<)..<..W+.9......)b.!'r.k.Q..',.x....'..zb.\|......m.;x.!....zBY!......w..?...$.&.v. .7.#....Bq...[x.._V.p.n>............;\..#....&....V.@..R%'"/.(>.&.6.G.<_...@.b;O.i..F,..Zi#.\d\|.sIH5&2..<.....t...C.-...s....wr....)........k..A..<...N....\h....B:.Q...#.dT....E..mv).n.G.g5Ss...31.M.>..{..J..4e.6...'..`a....u.Qh`...Q.:....9o'()"..p..=uPw.\|:. #...Q.}.......H...G..!:Ko1.d..v.pk..z...ll\|1.0....L.fP.W...\wW......%}.\(v...kfs.M.a..........^..]....32.....T$.(j=........W&.......\|.^J......k...0.}..U..p....#JxI<.:.!.IA...yjS.HB.FqJ.U.w..r..AOA$...Y.Z..'m.,[.5..p..."..^..Ka..........~......[$....&....DNf.r=.....AH/.Uu.....M...)0yRg.>...x..?L............. s..D#....H.tB=7^......l...!EF...C..'.........L.6...z/e..,?au.l....

C:\Users\user\Downloads\WKXEWIOTXI.mp3.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.8650871835808855
Encrypted:	false
SSDEEP:	48:mk2+5jbCArNuQioAYRG4L6xng/a/tUCL8c:J5LrETIrif/F8c
MD5:	5C2CAB01AF7DAC5D04947368846F2796
SHA1:	A452CC67D837B59B8CBA4FF1104A3D9B0ABDA5A5
SHA-256:	5D1B304E7AA43776038F57726A6F5EE08CDF115BA793CACF386415CE9D785E06
SHA-512:	C003AD015164ACDD420FCBBF6521F28082907085219F3FE88B3CE58CA9E6351F3256962CEB59C1CB0245BA56C933FDB793167DCFA6C45CD6719548258D27BA6B
Malicious:	false
Preview:	.vd..5..1b.:...7...$.'....<.....i.....8P...>=J..#."..w.%...nd...gs...F6$_..xy.../S.S....q..K.Fk..x8Ei.P....3.....s..g.K.uOq...D..n..M\|...+P..d.u.q..N%\.P .@.0.....:........s.........c..(...$..Hs...b.e./V.E=......FC....k.f...A<)..<..W+.9......)b.!'r.k.Q..',.x....'..zb.\|......m.;x.!....zBY!......w..?...$.&.v. .7.#....Bq...[x.._V.p.n>............;\..#....&....V.@..R%'"/.(>.&.6.G.<_...@.b;O.i..F,..Zi#.\d\|.sIH5&2..<.....t...C.-...s....wr....)........k..A..<...N....\h....B:.Q...#.dT....E..mv).n.G.g5Ss...31.M.>..{..J..4e.6...'..`a....u.Qh`...Q.:....9o'()"..p..=uPw.\|:. #...Q.}.......H...G..!:Ko1.d..v.pk..z...ll\|1.0....L.fP.W...\wW......%}.\(v...kfs.M.a..........^..]....32.....T$.(j=........W&.......\|.^J......k...0.}..U..p....#JxI<.:.!.IA...yjS.HB.FqJ.U.w..r..AOA$...Y.Z..'m.,[.5..p..."..^..Ka..........~......[$....&....DNf.r=.....AH/.Uu.....M...)0yRg.>...x..?L............. s..D#....H.tB=7^......l...!EF...C..'.........L.6...z/e..,?au.l....

C:\Users\user\Downloads\WKXEWIOTXI.pdf

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.846366685463147
Encrypted:	false
SSDEEP:	48:cCyguqYRUIoPhJI/EH2DQeIIY7eKTj/a5ySeE6Xqx:cCyguqBfWsgHIreM/KrDoS
MD5:	28857D82D15EEC2C057F71957CDEF23D
SHA1:	35629EC1407A691666B497A61CDF96DB1BD42097
SHA-256:	6C6FB5B7F4E15A1D9E5E73B356AC7F6EE6FC60A5BB0701C61F85F21BC65185BE
SHA-512:	BD9F199D2BC8329F32D671F9CEA34FEFCE4A8FEE927A8CC1F5A24ACD04053046F0EB360231647EAD18BEFC3BFED92A79529CF81349292F376195CE0374139DB5
Malicious:	false
Preview:	....%....l.t...e).\=.........20..!..1.I........c............&.M..k.T^.7k...!....K...Y.pi.w.r...G4\|..o....`D......o......a;..}.qtB'.<]3m32`..d@.`.j.n:..1..1Kk90.U....QE.\|GY..q..^$O@.....B..1M.....g.K\|....../+.....Z.>..gX.4.1.&....Q}mdO...eF~m...x...5HI..K=G#..B..[tZ........#`.;.q..&.=.Z..oQ....P9..(L....D...,rdJ.}Y.E....wIl-..s.$....:.<U..5j..[E.....OH...]...........FN........,.f.4?$V.g...6..0[....z....n..1>.]..&J4#C.......v.../S.P..q......m`......5.. ..<..^~....;`6..m..x;...GV..-/./.h.u..].j6n?I...pl.Zr..;-)'.OB.f.-y6..6.V......jS.N&g6........;+a0).. ^.....L...C..P..I...i2L.....lP.. ...>?~@.1:.D...9.......a......JW.B..k.'.W..O#S...q.b.D..w...m...B;4......L.zt...$A4..`5F...=[.iG#.ub........u.(".P........2..s...Fb.F..;....MR.]..qXQ.F......R/..hjg..k. -...\..v.m..N.}"."w.......1..M..-...I.l.6.sb/s.\|..lD....[..^....~e..7j.;.c..1Q...PBp..3[.Pg$.p1.....7..kA.E.....d..l........a..)...g,V.....~.!..-..2....).l.F..g6q;)t....vH2...\........$...<..

C:\Users\user\Downloads\WKXEWIOTXI.pdf.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.846366685463147
Encrypted:	false
SSDEEP:	48:cCyguqYRUIoPhJI/EH2DQeIIY7eKTj/a5ySeE6Xqx:cCyguqBfWsgHIreM/KrDoS
MD5:	28857D82D15EEC2C057F71957CDEF23D
SHA1:	35629EC1407A691666B497A61CDF96DB1BD42097
SHA-256:	6C6FB5B7F4E15A1D9E5E73B356AC7F6EE6FC60A5BB0701C61F85F21BC65185BE
SHA-512:	BD9F199D2BC8329F32D671F9CEA34FEFCE4A8FEE927A8CC1F5A24ACD04053046F0EB360231647EAD18BEFC3BFED92A79529CF81349292F376195CE0374139DB5
Malicious:	false
Preview:	....%....l.t...e).\=.........20..!..1.I........c............&.M..k.T^.7k...!....K...Y.pi.w.r...G4\|..o....`D......o......a;..}.qtB'.<]3m32`..d@.`.j.n:..1..1Kk90.U....QE.\|GY..q..^$O@.....B..1M.....g.K\|....../+.....Z.>..gX.4.1.&....Q}mdO...eF~m...x...5HI..K=G#..B..[tZ........#`.;.q..&.=.Z..oQ....P9..(L....D...,rdJ.}Y.E....wIl-..s.$....:.<U..5j..[E.....OH...]...........FN........,.f.4?$V.g...6..0[....z....n..1>.]..&J4#C.......v.../S.P..q......m`......5.. ..<..^~....;`6..m..x;...GV..-/./.h.u..].j6n?I...pl.Zr..;-)'.OB.f.-y6..6.V......jS.N&g6........;+a0).. ^.....L...C..P..I...i2L.....lP.. ...>?~@.1:.D...9.......a......JW.B..k.'.W..O#S...q.b.D..w...m...B;4......L.zt...$A4..`5F...=[.iG#.ub........u.(".P........2..s...Fb.F..;....MR.]..qXQ.F......R/..hjg..k. -...\..v.m..N.}"."w.......1..M..-...I.l.6.sb/s.\|..lD....[..^....~e..7j.;.c..1Q...PBp..3[.Pg$.p1.....7..kA.E.....d..l........a..)...g,V.....~.!..-..2....).l.F..g6q;)t....vH2...\........$...<..

C:\Users\user\Downloads\WKXEWIOTXI.xlsx

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.850834601363833
Encrypted:	false
SSDEEP:	24:X3yCrhinscmQDj3UNfyk9Y9DyLV3MITmhEC+n4zDpdHi4oyXzivQa8GNPh3BdAWg:nyCr4ns81kbLRyWCdDzsyAn8GX3/O
MD5:	1E992099EFFF6C430E63D478AC05B199
SHA1:	0585F6F200938B04E382298321DFD2C15DD10B1D
SHA-256:	3375F7481B7E634717EF65BBCCEB6418A6EA0CB02120FD195D2AD2E2892571C6
SHA-512:	6DC5554936AA180B7FDFEADB50789D8B5A80C2880F6E3AA7988D890B7B2556B2F3209AA9CBF62AF32E2FB876462F7964E4741236C846648586FD7066F369C16D
Malicious:	false
Preview:	..ziH.C.R...J..IJ...b!...YzK.D.a..m.....5..r.mYA..a.....)\|......Y.$.p....~4.l>}0+XW..UT..2.P.dI.O..../G......2...+.kWm=[.,}...."..Ti... ...\..n...5...0..DN...n...Q.....B.}.m5.....]j..eO..Q..B?..(N. ...Y.."2iReR_I.Z....AW),P.....e(.L.1...Yd....p...._.y.4,5....[1m...3o..5.%.....yB.fZ`D....F.@..GX[}.P]....F...>vx.e..;3....X1.>.~-.i..aQ..t.."1.?Tr..4.:..Z.)...E...&x..;.7.......!Y.........D.Bd...<),b....vkXVH..D+...}...e5.3...P...0;..HB.h..}]m.. ?.D....q...Sb\A..U8+...:Cvd:.a%L.....3.&.$.N..bWBJN_..-6Uq..P@P:.1..,...m.. .@k.j`..P0P....-..N.~..d...5J...}:...._.{H.D0.vQ.._.-z\|..&.F..f.`a.-....c.f...=....e.pX.M+.HE.....G..^)...(8..aT7a..$W+j...2..... .....=O..3...U(...OqGb-oOA+..v...\|.;.W.T.........n......Y..UTW.....r..}...x..5.BUz{..:$.{..._...?.....1K*.Ju.t.#.{.........r.............U...k'y....5....?s./).....6.4...'5.7.Q.M6i\.\|.....LZ...s.9...(.y....-.... 6..M.-H.5..y..Y...0\|M..g.w.. ......}...-....Yf...%....T..L....J../L%.....\|2&YD.M..$.

C:\Users\user\Downloads\WKXEWIOTXI.xlsx.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1562
Entropy (8bit):	7.850834601363833
Encrypted:	false
SSDEEP:	24:X3yCrhinscmQDj3UNfyk9Y9DyLV3MITmhEC+n4zDpdHi4oyXzivQa8GNPh3BdAWg:nyCr4ns81kbLRyWCdDzsyAn8GX3/O
MD5:	1E992099EFFF6C430E63D478AC05B199
SHA1:	0585F6F200938B04E382298321DFD2C15DD10B1D
SHA-256:	3375F7481B7E634717EF65BBCCEB6418A6EA0CB02120FD195D2AD2E2892571C6
SHA-512:	6DC5554936AA180B7FDFEADB50789D8B5A80C2880F6E3AA7988D890B7B2556B2F3209AA9CBF62AF32E2FB876462F7964E4741236C846648586FD7066F369C16D
Malicious:	false
Preview:	..ziH.C.R...J..IJ...b!...YzK.D.a..m.....5..r.mYA..a.....)\|......Y.$.p....~4.l>}0+XW..UT..2.P.dI.O..../G......2...+.kWm=[.,}...."..Ti... ...\..n...5...0..DN...n...Q.....B.}.m5.....]j..eO..Q..B?..(N. ...Y.."2iReR_I.Z....AW),P.....e(.L.1...Yd....p...._.y.4,5....[1m...3o..5.%.....yB.fZ`D....F.@..GX[}.P]....F...>vx.e..;3....X1.>.~-.i..aQ..t.."1.?Tr..4.:..Z.)...E...&x..;.7.......!Y.........D.Bd...<),b....vkXVH..D+...}...e5.3...P...0;..HB.h..}]m.. ?.D....q...Sb\A..U8+...:Cvd:.a%L.....3.&.$.N..bWBJN_..-6Uq..P@P:.1..,...m.. .@k.j`..P0P....-..N.~..d...5J...}:...._.{H.D0.vQ.._.-z\|..&.F..f.`a.-....c.f...=....e.pX.M+.HE.....G..^)...(8..aT7a..$W+j...2..... .....=O..3...U(...OqGb-oOA+..v...\|.;.W.T.........n......Y..UTW.....r..}...x..5.BUz{..:$.{..._...?.....1K*.Ju.t.#.{.........r.............U...k'y....5....?s./).....6.4...'5.7.Q.M6i\.\|.....LZ...s.9...(.y....-.... 6..M.-H.5..y..Y...0\|M..g.w.. ......}...-....Yf...%....T..L....J../L%.....\|2&YD.M..$.

C:\Users\user\Downloads\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	647
Entropy (8bit):	7.646756461981222
Encrypted:	false
SSDEEP:	12:WekAmR5JOVhW6PjcZpQDUkea8GTXKjDaOsM+zfUbaj4pDBrmY3ZUOVpx0/:Wekb5JOV86r4p9wx6jDaqba8np3COVz0
MD5:	FBF81723213E3324E59F57730D30CE1E
SHA1:	206372B8F07B4DA4D456463AEDAA046CCC2AB771
SHA-256:	46EB91545ADE31A29EA58185133846D375BB3793B27E7871227C689E0C613BB7
SHA-512:	A2E58792E9E7330121F6B0B2835DA6416C282F2A0DA3B9545F683EEA9CDE23F60E97126BF9835A505E09B6131734E07049356280EE5A92D0AE273112A161153C
Malicious:	false
Preview:	>..o....('r...._.....a..I.6.F.&...{..\|.....eRa...8....!.5Q.......q...$....l.5. .un4w].<..s....+...q2.?e..a.'3.....9 R...H.q./..z...l...#.E?.rs..]...../..`U.^.-............X.r....W....V..qs./.(.....G..t\|..U..$dj3...:..l,....M....Ahr.N^TM4G.RT/.4.)...\|c.@k..}.;..5..S`.#.S..e......v=.mA..).}...#nB...B/......G$.?..2....`7~.7s..C.l><..F^...K;$..P.'..jv.p.&....`7..l.zN..7F...n.C...&.-j.i.8~V..z.&...:(.......<.`...N...Rf..........F..Y....Bn.N...V.g....Cb..}v..E=.y....o?.i.7......[....I...l.....@..f!N.w..U..%s[.{....5..kU....gE......O.Jj\.T./.B..9./,.K.c.g.n....N.dN.i...b/...p...i._e6(t^..\|o......................

C:\Users\user\Favorites\Amazon.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	647
Entropy (8bit):	7.646756461981222
Encrypted:	false
SSDEEP:	12:WekAmR5JOVhW6PjcZpQDUkea8GTXKjDaOsM+zfUbaj4pDBrmY3ZUOVpx0/:Wekb5JOV86r4p9wx6jDaqba8np3COVz0
MD5:	FBF81723213E3324E59F57730D30CE1E
SHA1:	206372B8F07B4DA4D456463AEDAA046CCC2AB771
SHA-256:	46EB91545ADE31A29EA58185133846D375BB3793B27E7871227C689E0C613BB7
SHA-512:	A2E58792E9E7330121F6B0B2835DA6416C282F2A0DA3B9545F683EEA9CDE23F60E97126BF9835A505E09B6131734E07049356280EE5A92D0AE273112A161153C
Malicious:	false
Preview:	>..o....('r...._.....a..I.6.F.&...{..\|.....eRa...8....!.5Q.......q...$....l.5. .un4w].<..s....+...q2.?e..a.'3.....9 R...H.q./..z...l...#.E?.rs..]...../..`U.^.-............X.r....W....V..qs./.(.....G..t\|..U..$dj3...:..l,....M....Ahr.N^TM4G.RT/.4.)...\|c.@k..}.;..5..S`.#.S..e......v=.mA..).}...#nB...B/......G$.?..2....`7~.7s..C.l><..F^...K;$..P.'..jv.p.&....`7..l.zN..7F...n.C...&.-j.i.8~V..z.&...:(.......<.`...N...Rf..........F..Y....Bn.N...V.g....Cb..}v..E=.y....o?.i.7......[....I...l.....@..f!N.w..U..%s[.{....5..kU....gE......O.Jj\.T./.B..9./,.K.c.g.n....N.dN.i...b/...p...i._e6(t^..\|o......................

C:\Users\user\Favorites\Bing.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.67277082338265
Encrypted:	false
SSDEEP:	12:/JnZothJmFwEpz5XPOrYL/WBQF+KJrQ6rhkZNnmLpf0eww9JvZg2aYo/sU0o3O/:BWt+FwEpzt5+KJrQ9ZVm+e/9JvZ6UU0h
MD5:	0DCDB83B73375EAEF11BAFFF728566DB
SHA1:	68DBCCB31FC1D6DB6F18EC472B8BF9C952BD189F
SHA-256:	A827DAB8AF6D9216397A3077FCF66958B94A231E90E4DB1D4E41C0A7DB7E9D2A
SHA-512:	D1A910434906298C6615F75FFEC7F52F3A03C89E1102D2B2B57FAB9E6F707FFB77008668EE42FD66E05589C51C0D4747BCECA43A4D50CDDF3EC30699383D8BD0
Malicious:	false
Preview:	..S..9i..6T.....2.......O..K.f._uK...........B..[Z.4.'.. $..^#.J.".s...b.6x.....u.{.-...O6..@bly.e...Hf .n3>....=...o..6V..x..q...._x......}.+...@}...~c......<Do7`.....=...g+.B.s..[&M.'...I.V3q.....6....b.+.7h ..]..X...u.....R...f}aV...&....RbY.M..}...._..&\6f.'..."..!G..,...=7.C...\|xK....a.?..".y...........MO.=...7.....^...+.+;C.l-1.o.$..l/:....83......!=.....tQMZ...2..0..W.].].........g.[...].....7[n...t......W.d.b"..:.m..{6a.N...G.....k.A..uj&.s...!..(sx]...0@.wj. ..T..+,=.....~...=z&......W.d.r..l.9\.8]L&../l..y.W...X..6......+2.T.L."."t{VK......p..b..u.*.ak...YU.....@T..\o..`.B........T.N....e.hP].....H..~)j...7.p...z.i.y.p..f.o...^......`..v........n.[V..0.U.....x.A.wyj!T,.......................

C:\Users\user\Favorites\Bing.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	DOS executable (COM, 0x8C-variant)
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.67277082338265
Encrypted:	false
SSDEEP:	12:/JnZothJmFwEpz5XPOrYL/WBQF+KJrQ6rhkZNnmLpf0eww9JvZg2aYo/sU0o3O/:BWt+FwEpzt5+KJrQ9ZVm+e/9JvZ6UU0h
MD5:	0DCDB83B73375EAEF11BAFFF728566DB
SHA1:	68DBCCB31FC1D6DB6F18EC472B8BF9C952BD189F
SHA-256:	A827DAB8AF6D9216397A3077FCF66958B94A231E90E4DB1D4E41C0A7DB7E9D2A
SHA-512:	D1A910434906298C6615F75FFEC7F52F3A03C89E1102D2B2B57FAB9E6F707FFB77008668EE42FD66E05589C51C0D4747BCECA43A4D50CDDF3EC30699383D8BD0
Malicious:	false
Preview:	..S..9i..6T.....2.......O..K.f._uK...........B..[Z.4.'.. $..^#.J.".s...b.6x.....u.{.-...O6..@bly.e...Hf .n3>....=...o..6V..x..q...._x......}.+...@}...~c......<Do7`.....=...g+.B.s..[&M.'...I.V3q.....6....b.+.7h ..]..X...u.....R...f}aV...&....RbY.M..}...._..&\6f.'..."..!G..,...=7.C...\|xK....a.?..".y...........MO.=...7.....^...+.+;C.l-1.o.$..l/:....83......!=.....tQMZ...2..0..W.].].........g.[...].....7[n...t......W.d.b"..:.m..{6a.N...G.....k.A..uj&.s...!..(sx]...0@.wj. ..T..+,=.....~...=z&......W.d.r..l.9\.8]L&../l..y.W...X..6......+2.T.L."."t{VK......p..b..u.*.ak...YU.....@T..\o..`.B........T.N....e.hP].....H..~)j...7.p...z.i.y.p..f.o...^......`..v........n.[V..0.U.....x.A.wyj!T,.......................

C:\Users\user\Favorites\Facebook.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	649
Entropy (8bit):	7.613307464845597
Encrypted:	false
SSDEEP:	12:WuRiyfLBJWU7vHFj1gFw9jOl9nUYTPOoq1P0zS9P6nBlR/Q56Ee/:WuRRfSUrlj1gK5UrPOoq1P0zSIu56Eu
MD5:	0684F18D938F84E659315E19E0A682A7
SHA1:	CD199B2921DC4D28F53719A2D35D3D913EE9B5FB
SHA-256:	07D19D175E195C195F8E01883B493199F2887A3EF9B980B94E579DCD36B64733
SHA-512:	E8050D9192960ABCAE6372FF440A853FBB7A83FFE958E8388C729F33A74C3C2A9164EBD6EBFD09C87E5B9C8AE51218B61A54B5BF01F509DA595CEC4D936546F2
Malicious:	false
Preview:	%a..T...........U.m.5x.......b.Q..(>.........y...d.Y.p...9...^.o.....Km0..?C!v....%!....\.....:.cb....+.0.#..[+}.EC..:...,.........l.#.. ..4s._......>...r"..n...#.h.M...c.B.D..@...p..Kt...35.N.8n.....Z2.x...Ox.......6..Wn...4...U&..K.U.Q.,kHN......8g..3C8.(R..+.)....#.S<lL..i:.1Y..NQ+(..#:.:\L..x..N...........U... ...Xk;}P.C...~..oR..K.i...9. .an.........i.t."%...d~.x...`....&~}K.;r..'N.CK.8n..J...}.....q.....o)5j..w........E..)U8.A!%5G..@...S...........6Vm....M.........j.q....V.F..<..R....-......Z...S..B..84]5.H.d0Q.).\|...E..l.....j..`r..?S.SN...%_._O..Z.0..6...a...z%.p...o>I(q......................

C:\Users\user\Favorites\Facebook.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	649
Entropy (8bit):	7.613307464845597
Encrypted:	false
SSDEEP:	12:WuRiyfLBJWU7vHFj1gFw9jOl9nUYTPOoq1P0zS9P6nBlR/Q56Ee/:WuRRfSUrlj1gK5UrPOoq1P0zSIu56Eu
MD5:	0684F18D938F84E659315E19E0A682A7
SHA1:	CD199B2921DC4D28F53719A2D35D3D913EE9B5FB
SHA-256:	07D19D175E195C195F8E01883B493199F2887A3EF9B980B94E579DCD36B64733
SHA-512:	E8050D9192960ABCAE6372FF440A853FBB7A83FFE958E8388C729F33A74C3C2A9164EBD6EBFD09C87E5B9C8AE51218B61A54B5BF01F509DA595CEC4D936546F2
Malicious:	false
Preview:	%a..T...........U.m.5x.......b.Q..(>.........y...d.Y.p...9...^.o.....Km0..?C!v....%!....\.....:.cb....+.0.#..[+}.EC..:...,.........l.#.. ..4s._......>...r"..n...#.h.M...c.B.D..@...p..Kt...35.N.8n.....Z2.x...Ox.......6..Wn...4...U&..K.U.Q.,kHN......8g..3C8.(R..+.)....#.S<lL..i:.1Y..NQ+(..#:.:\L..x..N...........U... ...Xk;}P.C...~..oR..K.i...9. .an.........i.t."%...d~.x...`....&~}K.;r..'N.CK.8n..J...}.....q.....o)5j..w........E..)U8.A!%5G..@...S...........6Vm....M.........j.q....V.F..<..R....-......Z...S..B..84]5.H.d0Q.).\|...E..l.....j..`r..?S.SN...%_._O..Z.0..6...a...z%.p...o>I(q......................

C:\Users\user\Favorites\Live.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	645
Entropy (8bit):	7.631879624962254
Encrypted:	false
SSDEEP:	12:58PKuPdQTi/xHccjEuMM/diWqWYhTww6BAfWFflLvxgYJjJWXj8F/:5c/VlElMFPqR68glLvaYx
MD5:	F2627632B8CCEEAA9F63E49EC74A368E
SHA1:	286AD7F07F078E08F91E919D7B948794C44E3E77
SHA-256:	59104D85C56F648D368D26D4B78349124F6CB3C7A419719F24B23E3CE0049D3C
SHA-512:	5A93FD49D08F303A88778455E6B729FBE7AA7459180636379066B5BFA08A64363FA8097AE1D5915182D4228FAA3A4794AB401B163BDC828E45FE6861E674F1B2
Malicious:	false
Preview:	....&.X..RKG_W..u.....}...<.PEG-.<\|.\|.BB....aw....hN......i.t....D...o..,..6.h...l...g.._KA ..ID(U.@aU.y.]e...%..k...~..i..9~p..+,x....( .=&v.:.gJ..H..z.[..{.W.".C...'...d!.?.......>..E..&...............'....B.;...H....N."..cI)..E>.a)..J..3.e...H.z...H.5.....b.L.5;.............m.3...,@..N.....s..p/.Kj.?4.W^....p..!V.k...Al.0.H..w .... L..".......D.s......a.d.;vvA.q.......\|.....7.1..".~.1...2....`j(..{..A4o.............x6".(.u%..^3....83%[.....wM....9.....a0....a.x"..ZT.xE...:4....Y"........r..<J.I.HIpB....n.4..wh4.S.....m.p`.eC.w.5..!..:....'o'...S.....o...)R.s....5.z..QM.>..m......................

C:\Users\user\Favorites\Live.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	645
Entropy (8bit):	7.631879624962254
Encrypted:	false
SSDEEP:	12:58PKuPdQTi/xHccjEuMM/diWqWYhTww6BAfWFflLvxgYJjJWXj8F/:5c/VlElMFPqR68glLvaYx
MD5:	F2627632B8CCEEAA9F63E49EC74A368E
SHA1:	286AD7F07F078E08F91E919D7B948794C44E3E77
SHA-256:	59104D85C56F648D368D26D4B78349124F6CB3C7A419719F24B23E3CE0049D3C
SHA-512:	5A93FD49D08F303A88778455E6B729FBE7AA7459180636379066B5BFA08A64363FA8097AE1D5915182D4228FAA3A4794AB401B163BDC828E45FE6861E674F1B2
Malicious:	false
Preview:	....&.X..RKG_W..u.....}...<.PEG-.<\|.\|.BB....aw....hN......i.t....D...o..,..6.h...l...g.._KA ..ID(U.@aU.y.]e...%..k...~..i..9~p..+,x....( .=&v.:.gJ..H..z.[..{.W.".C...'...d!.?.......>..E..&...............'....B.;...H....N."..cI)..E>.a)..J..3.e...H.z...H.5.....b.L.5;.............m.3...,@..N.....s..p/.Kj.?4.W^....p..!V.k...Al.0.H..w .... L..".......D.s......a.d.;vvA.q.......\|.....7.1..".~.1...2....`j(..{..A4o.............x6".(.u%..^3....83%[.....wM....9.....a0....a.x"..ZT.xE...:4....Y"........r..<J.I.HIpB....n.4..wh4.S.....m.p`.eC.w.5..!..:....'o'...S.....o...)R.s....5.z..QM.>..m......................

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.624388241004426
Encrypted:	false
SSDEEP:	12:NdHfNVaPIH8UVaykPW5cD13tlJoHLSVAHVa7OfR1/:XHfNVaQrVajF3tlJMOycOfr
MD5:	BB7258E8C3D0C8F969BEE81C589598FC
SHA1:	07D96ADF85DF5DD770CD16DE88177683C6007896
SHA-256:	CFB4BB6159B1D6048B03CDEEA79C1E3D1080D01995FEC53F67F86379288A0835
SHA-512:	BE8FFF0ABC5B1BB5455FF19DFF4DF5376CE0F9F654F10391C5B8E47FCAF4A2A31C564030CED8E896ACABFB8BAE7630CCC5CF1133F5C00A0EA92686FB896DB413
Malicious:	false
Preview:	...b...(..J..t.av"..i.y9E..(.s.\|Q.o...t..A.....[;..`.HPR.U.G.5...K@(.Dp.{..'.M.q.M.8.D...Z..;6.......4s...%9.5!....m..bO.L0..\..9..hAY-r]Z.l..M%@N.u..m..i.UD(.V-o.aq.xw..U.[..*.._..;O.X...%......8.DFs.<T......(..n>...b8......Y../]..F....;...^-....6....1W..?#kJo....p....)0...k..c.../].........G.Fn..U.4.."...-.L..+..IX+U...38Q.\...Wv....~..}..Ga..7.0........ .vk"....vr....7J.........w...`o+.....K....8m..?&{c........0. ..H......6.aV..$F.....Y...E~!2.{.....IRNk.[w......f-."...T.>....{......F...n.)54...L9_..g.:.Y..L....t\`..!.lab..\..Z.w....`.<D...x......}.\|5...I[..x..y...9..f.....%.U.j.pVp......................

C:\Users\user\Favorites\NYTimes.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.624388241004426
Encrypted:	false
SSDEEP:	12:NdHfNVaPIH8UVaykPW5cD13tlJoHLSVAHVa7OfR1/:XHfNVaQrVajF3tlJMOycOfr
MD5:	BB7258E8C3D0C8F969BEE81C589598FC
SHA1:	07D96ADF85DF5DD770CD16DE88177683C6007896
SHA-256:	CFB4BB6159B1D6048B03CDEEA79C1E3D1080D01995FEC53F67F86379288A0835
SHA-512:	BE8FFF0ABC5B1BB5455FF19DFF4DF5376CE0F9F654F10391C5B8E47FCAF4A2A31C564030CED8E896ACABFB8BAE7630CCC5CF1133F5C00A0EA92686FB896DB413
Malicious:	false
Preview:	...b...(..J..t.av"..i.y9E..(.s.\|Q.o...t..A.....[;..`.HPR.U.G.5...K@(.Dp.{..'.M.q.M.8.D...Z..;6.......4s...%9.5!....m..bO.L0..\..9..hAY-r]Z.l..M%@N.u..m..i.UD(.V-o.aq.xw..U.[..*.._..;O.X...%......8.DFs.<T......(..n>...b8......Y../]..F....;...^-....6....1W..?#kJo....p....)0...k..c.../].........G.Fn..U.4.."...-.L..+..IX+U...38Q.\...Wv....~..}..Ga..7.0........ .vk"....vr....7J.........w...`o+.....K....8m..?&{c........0. ..H......6.aV..$F.....Y...E~!2.{.....IRNk.[w......f-."...T.>....{......F...n.)54...L9_..g.:.Y..L....t\`..!.lab..\..Z.w....`.<D...x......}.\|5...I[..x..y...9..f.....%.U.j.pVp......................

C:\Users\user\Favorites\Reddit.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	647
Entropy (8bit):	7.637229999888347
Encrypted:	false
SSDEEP:	12:mBMWNGsLEHTCoqlfE+dk6yFdStjK3IefpGBuTaKnZKujFlXAKqgEIUccbo/:BWNGrCRlRFyFdM7TBDGZ7zQKXEIb
MD5:	4D2CF74277F899E73F6D1268EF72E8A6
SHA1:	8237D5D392673196DC82B09BEA767F58278ED752
SHA-256:	0AB9A64003B934F18A02AD0538949D4B6E84FFDE7A22B1B86326BA586C221494
SHA-512:	366847D766BF47755F1872376631286E03BB2DFAC9119EA6002849E8D32437B15BCAEE0B07E1D4A4DF7AA988222F4E28296F657A5C11182C2F26C19722292449
Malicious:	false
Preview:	o..f.........J<..........\Qo..c....A..P./s.?t...(.e_..2.).e.v.u.:.J.k..'.iW..X.`..P..xLy."/.K..l.m..~{..t...T2./rf.N.V...U..y-...&C.0z.Q....(...{I.>z.l.R.p>....z......d.y...~.G)a.O+%`$..1..*i.....x.....TV.-..3b....E.S..h..:......h.&.&..../...B=...-V..0....[=.,-]1....@v...Lr".....\|.M...A..ol...\|N...C..W..iY.{o.......D.F<~..d.q#.......V.`i ..n..{.,.9U.7#..^..Ju........>`_..}..-&.').te......TgO:B%.......Ja.d.g.........2<+77./K.....e..,.........0.<..).1e...#.....f%a....4.~Py...U.aH.$..&.... P.n.x.....x..c..N..P#....w.5.D.....;~...B..B....6..N]....P....%.&.2..........X...F..A\|o......................

C:\Users\user\Favorites\Reddit.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	647
Entropy (8bit):	7.637229999888347
Encrypted:	false
SSDEEP:	12:mBMWNGsLEHTCoqlfE+dk6yFdStjK3IefpGBuTaKnZKujFlXAKqgEIUccbo/:BWNGrCRlRFyFdM7TBDGZ7zQKXEIb
MD5:	4D2CF74277F899E73F6D1268EF72E8A6
SHA1:	8237D5D392673196DC82B09BEA767F58278ED752
SHA-256:	0AB9A64003B934F18A02AD0538949D4B6E84FFDE7A22B1B86326BA586C221494
SHA-512:	366847D766BF47755F1872376631286E03BB2DFAC9119EA6002849E8D32437B15BCAEE0B07E1D4A4DF7AA988222F4E28296F657A5C11182C2F26C19722292449
Malicious:	false
Preview:	o..f.........J<..........\Qo..c....A..P./s.?t...(.e_..2.).e.v.u.:.J.k..'.iW..X.`..P..xLy."/.K..l.m..~{..t...T2./rf.N.V...U..y-...&C.0z.Q....(...{I.>z.l.R.p>....z......d.y...~.G)a.O+%`$..1..*i.....x.....TV.-..3b....E.S..h..:......h.&.&..../...B=...-V..0....[=.,-]1....@v...Lr".....\|.M...A..ol...\|N...C..W..iY.{o.......D.F<~..d.q#.......V.`i ..n..{.,.9U.7#..^..Ju........>`_..}..-&.').te......TgO:B%.......Ja.d.g.........2<+77./K.....e..,.........0.<..).1e...#.....f%a....4.~Py...U.aH.$..&.... P.n.x.....x..c..N..P#....w.5.D.....;~...B..B....6..N]....P....%.&.2..........X...F..A\|o......................

C:\Users\user\Favorites\Twitter.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.567145310679389
Encrypted:	false
SSDEEP:	12:ciAEDb3ksA/IjEqxFe0Uq9ERCR8r6DOL9DL+itIlC/:QiUsgepxErq9ERCR3SL9DLN
MD5:	D475B37042ACEF60BA72AB3661A95A4A
SHA1:	2F1CC120840435B73C5A72AC1F808227024D1913
SHA-256:	AB8FDAE065811079463CC7B21D0B38B85003552401B6749B870C094C11E88D51
SHA-512:	5E96000ED1CD15DCBBE7492EEB31432050CB87519C8149EE95C181D081F645AD85E12B8CB968B14682F106F68182857889C883D04D17E6298DE190A962F5F89B
Malicious:	false
Preview:	8X.M..1.3x.........F..].."n..>..I...A{,.FYj...m.m.#!..8..Z..i.....z.a.&0.7.gJv.......x-....hw......P"J0.l.u..c.F......A....k.cc...........+.....I.<X5 .!...k.Y.hm.h.CpR....{-.o....g..EV]....Q.o.yt6.a.G1.!...-8..s........F.....v.......6........!&..]8..m6...,B.g.9y9%...$".=....I..O....^......J...O...[..3........o6.!RR....j..&."!..?...-N0x..H..w....P'..&.(.\|.............)1.m.....T.\|.K._.....G.........!^*.p..t..`}..\.`.eY.%.o.L8..PI.fp.v......C..:.nO.+....v..\.....e).#...+........Nv]f.....Z......F.\|...-q.".)f.\pAW.;... ..e......zKvt...1f...i.xdE....P"t..T..U.\|...}.Q..=..{..[k.......m...p......................

C:\Users\user\Favorites\Twitter.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.567145310679389
Encrypted:	false
SSDEEP:	12:ciAEDb3ksA/IjEqxFe0Uq9ERCR8r6DOL9DL+itIlC/:QiUsgepxErq9ERCR3SL9DLN
MD5:	D475B37042ACEF60BA72AB3661A95A4A
SHA1:	2F1CC120840435B73C5A72AC1F808227024D1913
SHA-256:	AB8FDAE065811079463CC7B21D0B38B85003552401B6749B870C094C11E88D51
SHA-512:	5E96000ED1CD15DCBBE7492EEB31432050CB87519C8149EE95C181D081F645AD85E12B8CB968B14682F106F68182857889C883D04D17E6298DE190A962F5F89B
Malicious:	false
Preview:	8X.M..1.3x.........F..].."n..>..I...A{,.FYj...m.m.#!..8..Z..i.....z.a.&0.7.gJv.......x-....hw......P"J0.l.u..c.F......A....k.cc...........+.....I.<X5 .!...k.Y.hm.h.CpR....{-.o....g..EV]....Q.o.yt6.a.G1.!...-8..s........F.....v.......6........!&..]8..m6...,B.g.9y9%...$".=....I..O....^......J...O...[..3........o6.!RR....j..&."!..?...-N0x..H..w....P'..&.(.\|.............)1.m.....T.\|.K._.....G.........!^*.p..t..`}..\.`.eY.%.o.L8..PI.fp.v......C..:.nO.+....v..\.....e).#...+........Nv]f.....Z......F.\|...-q.".)f.\pAW.;... ..e......zKvt...1f...i.xdE....P"t..T..U.\|...}.Q..=..{..[k.......m...p......................

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	650
Entropy (8bit):	7.685915070956703
Encrypted:	false
SSDEEP:	12:EbrtH2NgqlMenafrpeK8NBfWhbqpOOx9woUP0W10QCr/:Eb5H3SiQ5BfWhbqDOoUVS7
MD5:	DD1D49F27A631BCC6C9C0D38E39DADCC
SHA1:	B155BE150FFAB332863F883CB89DE32F5E33BC75
SHA-256:	C62A66E56151B987FCD8C12B484C4B994038D8A2F2206835A23FDC10ADE1D37F
SHA-512:	1DC9C085886F424C32E4352BE329685DA01640B266A5BE05ECDC78CCCA34049D93791A29695F76FB550AF6A6679184F851DCC31702276A78D3CBD8AF1FB6CDC5
Malicious:	false
Preview:	.`..H1..!..........UHk.."F.Q..{....[.....\..TA...]x.N.)..9'._v.y-.e......h..x&.C.....=..){..Y...JP;..5.L=~`..S...Ct..2o.....q.a.........._....../....E..?.-+H(.k.....X .D...(.1n .k...D.R..F.]Wa.."..}..Tl.9...K..i......C..t.....b....xR.$.X.'....CGF.. ...(Ks..6..4....p,.YO.T...X..E0..^K..i..@.d....*-K.#..e.....6.[...fj..iT.g.....t5...:.....hd..&2Q...JI..7T......<B+G..........;.M....x.Z}O.t..j.,;....P..A..8...!..y.S.h.....m....h s.Gh..'...4u.......057.....(.....b...4KL..R,.....l...^.&.2..L....b..S..7....,#..1.8..(..&...SG..FQ...R..4.`..&.......,.f.][.q..O....p......K2..w.yma4....X~.%5.8..JkO...^.(.r......................

C:\Users\user\Favorites\Wikipedia.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	650
Entropy (8bit):	7.685915070956703
Encrypted:	false
SSDEEP:	12:EbrtH2NgqlMenafrpeK8NBfWhbqpOOx9woUP0W10QCr/:Eb5H3SiQ5BfWhbqDOoUVS7
MD5:	DD1D49F27A631BCC6C9C0D38E39DADCC
SHA1:	B155BE150FFAB332863F883CB89DE32F5E33BC75
SHA-256:	C62A66E56151B987FCD8C12B484C4B994038D8A2F2206835A23FDC10ADE1D37F
SHA-512:	1DC9C085886F424C32E4352BE329685DA01640B266A5BE05ECDC78CCCA34049D93791A29695F76FB550AF6A6679184F851DCC31702276A78D3CBD8AF1FB6CDC5
Malicious:	false
Preview:	.`..H1..!..........UHk.."F.Q..{....[.....\..TA...]x.N.)..9'._v.y-.e......h..x&.C.....=..){..Y...JP;..5.L=~`..S...Ct..2o.....q.a.........._....../....E..?.-+H(.k.....X .D...(.1n .k...D.R..F.]Wa.."..}..Tl.9...K..i......C..t.....b....xR.$.X.'....CGF.. ...(Ks..6..4....p,.YO.T...X..E0..^K..i..@.d....*-K.#..e.....6.[...fj..iT.g.....t5...:.....hd..&2Q...JI..7T......<B+G..........;.M....x.Z}O.t..j.,;....P..A..8...!..y.S.h.....m....h s.Gh..'...4u.......057.....(.....b...4KL..R,.....l...^.&.2..L....b..S..7....,#..1.8..(..&...SG..FQ...R..4.`..&.......,.f.][.q..O....p......K2..w.yma4....X~.%5.8..JkO...^.(.r......................

C:\Users\user\Favorites\Youtube.url

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.620093902154669
Encrypted:	false
SSDEEP:	12:VUDlQU5wBeiUSsnrzdHqW93bk8lChTYvk490mlJXSKjj81/c/:KJFwvURn5IaCCvQmnXSKfr
MD5:	628105D11E0818B32E543F4A1E80CFCA
SHA1:	D267846A4148B8F774218855A3C47BA65587BA4E
SHA-256:	68BD4867141760787C0ABA879C04757FC7C735129483A8724DF7F6252D45466B
SHA-512:	051D2F0A791E0809FA01ECF5AA2C9C737156B7DC69D8541C9E6738BCEC60F09040E5281A504DC712813650DDB1AF27CB3506E27434A6547DD46784C57AE3F52F
Malicious:	false
Preview:	..A...TU..P.._....Z...B! pp...~.:1.R....?..s...Hoq...e..EV8'1..\|~.......g".{.21Df ......^....x..)+x?+.>q.(..%..d.....\|..)A..[..~r(W..C..D..7p.&.....A.Y...t.w.......U.c...1..@....(..6...C.F .'1.fC..;..l.......7......cQ..iJE$......5.k.h.........[..G.....qbW>XV...7Q....^..........6.3'9+..8..qP...........Y2.@...G..\...X.YV'F.G..k.3....Y......:.m.X].8.....e#P(...u.90...no..v^.S'=.....*.[...T...\|....9....._r.^f..<..MT.@..^.,=;.R.....D..z.y2>........v6.WS.....S~..7....H(....g....t...\|....Z..R7. ..x._..H$D......H4>......l..`..4....5e...A..J...Z..<.T...>.@.h...D......\+..b.3..:.....:~}...Z..p......................

C:\Users\user\Favorites\Youtube.url.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	648
Entropy (8bit):	7.620093902154669
Encrypted:	false
SSDEEP:	12:VUDlQU5wBeiUSsnrzdHqW93bk8lChTYvk490mlJXSKjj81/c/:KJFwvURn5IaCCvQmnXSKfr
MD5:	628105D11E0818B32E543F4A1E80CFCA
SHA1:	D267846A4148B8F774218855A3C47BA65587BA4E
SHA-256:	68BD4867141760787C0ABA879C04757FC7C735129483A8724DF7F6252D45466B
SHA-512:	051D2F0A791E0809FA01ECF5AA2C9C737156B7DC69D8541C9E6738BCEC60F09040E5281A504DC712813650DDB1AF27CB3506E27434A6547DD46784C57AE3F52F
Malicious:	false
Preview:	..A...TU..P.._....Z...B! pp...~.:1.R....?..s...Hoq...e..EV8'1..\|~.......g".{.21Df ......^....x..)+x?+.>q.(..%..d.....\|..)A..[..~r(W..C..D..7p.&.....A.Y...t.w.......U.c...1..@....(..6...C.F .'1.fC..;..l.......7......cQ..iJE$......5.k.h.........[..G.....qbW>XV...7Q....^..........6.3'9+..8..qP...........Y2.@...G..\...X.YV'F.G..k.3....Y......:.m.X].8.....e#P(...u.90...no..v^.S'=.....*.[...T...\|....9....._r.^f..<..MT.@..^.,=;.R.....D..z.y2>........v6.WS.....S~..7....H(....g....t...\|....Z..R7. ..x._..H$D......H4>......l..`..4....5e...A..J...Z..<.T...>.@.h...D......\+..b.3..:.....:~}...Z..p......................

C:\Users\user\Favorites\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\Links\Desktop.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.792657217619365
Encrypted:	false
SSDEEP:	24:X0/QP+DcDCgf/j6dAg1TJBIdAkXlxubnwGy6WS7YAwagF:mQP+gOg32dAg1TPYXH5GiS73gF
MD5:	6B3AAF96C6605710E20419CEE8561CF4
SHA1:	5AF1B0EC24420687A211C8218220BCF8DE45E7E3
SHA-256:	081723773CB83B10675187EB8DABDBA94D6D70158174EEF7D34C8DEE52C41D9A
SHA-512:	929B093DA599F8B0CF6868E22F5CBBF9D7222BCBD2F54DCD94A152BD5F2B1B30E6841885E677D4F6E8935C62B2BE37CBFDB297DA3B9BA73F75C90B2CEA0D2CFE
Malicious:	false
Preview:	0..]..k.Z...~..x..............`g........\`.G..7d..V....?LbB.R...C.!C@..i..e..o:B...<.C.,.....F.m.@P`.5.&9..4z.N....^.5....Z..p..+.e.....1..y3#.....\T..a....Pu.~.....Q..........}..X5..i...=.`.n...M..<.y.b..Kw.o..yI.5....@?.Zo...K.W....7..m+..@.c.g..ba...w.=R..Z...wo.O.)<../....Dz.p.]..j.E...I..#...p...8@.`..W...........i..I....+w1(.}7.{.rN....2t...X..._.7..R...P+..&8.Q.$.VN.......G....\|d..#..X...Q..XFV...D..)L!.o;.Z..j..u.z.H$...jU.S................\|.A..(.wJ.O^...&..U....na......x_.v.....o.....^&z.Zi....Z..B'.x.K..e.Vo......b..V..[Y_F..C.v.8...1`..V...#x.....Su.3.-LV.!v.Ce....!.92\|L).N.n......!..l.....g.0..ow.m..,}y.N%.....G.}_.!^.5......i..t.B....J5I.....5E.v..S..6....6e/.3.........s.....%.....Rw?..<...D..u...h..Z#\....b...>..r..#^.Q....0.Fc._.Sd)......Tv...M.....J..P8...Z.sS...P...$.e..02;....8mj..%..9&....$w.j...V...?......S%....#..tW.C....q..Z.L.,.].B2JM.+.{..OH.....^<..1..E....2......xn.p.&.R....z<.._....!C.T.+:9....4....,<

C:\Users\user\Links\Desktop.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.792657217619365
Encrypted:	false
SSDEEP:	24:X0/QP+DcDCgf/j6dAg1TJBIdAkXlxubnwGy6WS7YAwagF:mQP+gOg32dAg1TPYXH5GiS73gF
MD5:	6B3AAF96C6605710E20419CEE8561CF4
SHA1:	5AF1B0EC24420687A211C8218220BCF8DE45E7E3
SHA-256:	081723773CB83B10675187EB8DABDBA94D6D70158174EEF7D34C8DEE52C41D9A
SHA-512:	929B093DA599F8B0CF6868E22F5CBBF9D7222BCBD2F54DCD94A152BD5F2B1B30E6841885E677D4F6E8935C62B2BE37CBFDB297DA3B9BA73F75C90B2CEA0D2CFE
Malicious:	false
Preview:	0..]..k.Z...~..x..............`g........\`.G..7d..V....?LbB.R...C.!C@..i..e..o:B...<.C.,.....F.m.@P`.5.&9..4z.N....^.5....Z..p..+.e.....1..y3#.....\T..a....Pu.~.....Q..........}..X5..i...=.`.n...M..<.y.b..Kw.o..yI.5....@?.Zo...K.W....7..m+..@.c.g..ba...w.=R..Z...wo.O.)<../....Dz.p.]..j.E...I..#...p...8@.`..W...........i..I....+w1(.}7.{.rN....2t...X..._.7..R...P+..&8.Q.$.VN.......G....\|d..#..X...Q..XFV...D..)L!.o;.Z..j..u.z.H$...jU.S................\|.A..(.wJ.O^...&..U....na......x_.v.....o.....^&z.Zi....Z..B'.x.K..e.Vo......b..V..[Y_F..C.v.8...1`..V...#x.....Su.3.-LV.!v.Ce....!.92\|L).N.n......!..l.....g.0..ow.m..,}y.N%.....G.}_.!^.5......i..t.B....J5I.....5E.v..S..6....6e/.3.........s.....%.....Rw?..<...D..u...h..Z#\....b...>..r..#^.Q....0.Fc._.Sd)......Tv...M.....J..P8...Z.sS...P...$.e..02;....8mj..%..9&....$w.j...V...?......S%....#..tW.C....q..Z.L.,.].B2JM.+.{..OH.....^<..1..E....2......xn.p.&.R....z<.._....!C.T.+:9....4....,<

C:\Users\user\Links\Downloads.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1476
Entropy (8bit):	7.871793259605792
Encrypted:	false
SSDEEP:	24:VZeZl8kkIHgXku+Cj8hTN3rgDenjsHd9jLRERBW5rJl6NPsXJNR0:Xen5c/8h57gDen47jLgBWR6NkrO
MD5:	DDE95FC9B580E25C6C38478F0393952D
SHA1:	E83101F9BE0694D9AD633F87A087FE329D5AD49B
SHA-256:	8C7728F2F50946F58B85152A3D2417C1B9F62E2F4C57D18F0BCCCCE59D6676F3
SHA-512:	E144F8624E17994D708BC3493880BD5371FFD78C22FAC53BDA169D7EAD22C1DC1177C816AB6C72A526F9770986BA14843A8FA7F3D6732F8BDEEFBD720AE63D66
Malicious:	false
Preview:	%f...D.1+.....d..5.......7Z~2.......-p..mUK.t...eH.....U...Y{.....2O@..7..}............mh....u#.P..q......q1u9A6.N...oa.g..>=....Q....L..m...4...L...1Cc..z....->.`.....b......_....jnz'..^n1O{."a.A.nEZ...L.ZH..}o.......^Gw .B..`.<.~...t.W5..~K.k.F. .L... !.g...M.rK$i.VJ{..n.l..{./+...2..U.Aeh7.s.$..(...f=vD..\|7.l. ..j.....v.q...\|...4 ..S...`q..il;.].......!..P..\|..=..8#\|..b..b?...;..E._Dg{...G..B."a.d..Z...]/d.Pw.......kF...;..+.-..V.B.....vES....)...M.6.{..c..0F.[A..5.w.....f....../-.Y.+.JaW.~@.v.....U....r.B....M.C]..W..Bl_......R..B...G.w.i...-\^Q.c.5.3^.{...A.....;.'.....a-,.".v#L.D......T..}..P .....t...'_V.M....&.m... .......).....o..\|...<-.y.....?.$...9.D[sD..jszo*x.2=.!.~Cpw.3.u..c..%.!/.A.....x.....#8.P....c..)....)b.Y;.y\O...EV.R:z.\(g........;>....vQ.....2qh....x.M. ....oX..r...M...J....N...... .\|.....0D.......:.......(.A..].F..CZ..w..(..q........R...'..R.iEC.S...,........X..61.D.$....up}}t.m....BZ.f.8.)..O..IN.....

C:\Users\user\Links\Downloads.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1476
Entropy (8bit):	7.871793259605792
Encrypted:	false
SSDEEP:	24:VZeZl8kkIHgXku+Cj8hTN3rgDenjsHd9jLRERBW5rJl6NPsXJNR0:Xen5c/8h57gDen47jLgBWR6NkrO
MD5:	DDE95FC9B580E25C6C38478F0393952D
SHA1:	E83101F9BE0694D9AD633F87A087FE329D5AD49B
SHA-256:	8C7728F2F50946F58B85152A3D2417C1B9F62E2F4C57D18F0BCCCCE59D6676F3
SHA-512:	E144F8624E17994D708BC3493880BD5371FFD78C22FAC53BDA169D7EAD22C1DC1177C816AB6C72A526F9770986BA14843A8FA7F3D6732F8BDEEFBD720AE63D66
Malicious:	false
Preview:	%f...D.1+.....d..5.......7Z~2.......-p..mUK.t...eH.....U...Y{.....2O@..7..}............mh....u#.P..q......q1u9A6.N...oa.g..>=....Q....L..m...4...L...1Cc..z....->.`.....b......_....jnz'..^n1O{."a.A.nEZ...L.ZH..}o.......^Gw .B..`.<.~...t.W5..~K.k.F. .L... !.g...M.rK$i.VJ{..n.l..{./+...2..U.Aeh7.s.$..(...f=vD..\|7.l. ..j.....v.q...\|...4 ..S...`q..il;.].......!..P..\|..=..8#\|..b..b?...;..E._Dg{...G..B."a.d..Z...]/d.Pw.......kF...;..+.-..V.B.....vES....)...M.6.{..c..0F.[A..5.w.....f....../-.Y.+.JaW.~@.v.....U....r.B....M.C]..W..Bl_......R..B...G.w.i...-\^Q.c.5.3^.{...A.....;.'.....a-,.".v#L.D......T..}..P .....t...'_V.M....&.m... .......).....o..\|...<-.y.....?.$...9.D[sD..jszo*x.2=.!.~Cpw.3.u..c..%.!/.A.....x.....#8.P....c..)....)b.Y;.y\O...EV.R:z.\(g........;>....vQ.....2qh....x.M. ....oX..r...M...J....N...... .\|.....0D.......:.......(.A..].F..CZ..w..(..q........R...'..R.iEC.S...,........X..61.D.$....up}}t.m....BZ.f.8.)..O..IN.....

C:\Users\user\Links\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\SciTE.session

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	831
Entropy (8bit):	7.722896240852844
Encrypted:	false
SSDEEP:	24:buYY2B0FZQ+fKhVnejYjX2+s79f2TiS+joDIz9sRRgla:qA0FZQ9GF9f2V+joS9kRg0
MD5:	F3F6C8AB70B163C336A5A475786BD9AD
SHA1:	8817E42633EC949FD3CAE1B4A4DBFEA3939A86EE
SHA-256:	6F3762771EB94DFF14673AB712F2A94E79FC94EAF37CCB5E7C50BCD7FF8291A2
SHA-512:	2C586B7E085AED111F23E8502B2AE9CD47246C9F89355CF4B09C573686B27737A7588CA71564A3AB1933E6A167203AC00DEC441EDD96B62F5AB1DEF99904670F
Malicious:	false
Preview:	..Z..1..-....L&t;.0....X.i....... I+.i..BP.........N.h.Vk.s..CbJ0..]....a.J.f/...{u.O.pKe....V...0<.Z../....K...Ou...T..I..%_\..;-...q4_^.{.^(4...Y\|..n...I..\|."zI...Y...}3.C.}...#......-.S.N..=..W.k>...n./....L.'U..d.QR...uZ...3..~.............N=$..........V.Z.6.Z16-s...K.R.#.UG7...!.3.4m$.(.~...w.~.....Ua.6zhT..C.....L.{......#Hy...?..q...C<......g..&.^.....\|r.-v46#1../p.~.....#..p.v.&..L.@Ob........z..,.5=`.......S.....8._...C.h....Wl..W.]..3......=.'.0.t.....q3.H..x...=S.t/.zE.so..{.$d..C..5..U....h.N.im5...C..V......(m%D..5..Na\.\|.d.V.b.....+.....{6.5T0K..f...i.,Mh...+T...Cp>....)..?._.$.....MD....y...z.2{h...n1.X.`>P;..{x........P.Uv8C].*.H..Y...<'..Ua..J\..A.aAs..(....Z/."j..a...MvE.40J .w.vI.rMvx....q.k.....]2.....0.....'..$.."..X$B..N:....'......................

C:\Users\user\SciTE.session.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	831
Entropy (8bit):	7.722896240852844
Encrypted:	false
SSDEEP:	24:buYY2B0FZQ+fKhVnejYjX2+s79f2TiS+joDIz9sRRgla:qA0FZQ9GF9f2V+joS9kRg0
MD5:	F3F6C8AB70B163C336A5A475786BD9AD
SHA1:	8817E42633EC949FD3CAE1B4A4DBFEA3939A86EE
SHA-256:	6F3762771EB94DFF14673AB712F2A94E79FC94EAF37CCB5E7C50BCD7FF8291A2
SHA-512:	2C586B7E085AED111F23E8502B2AE9CD47246C9F89355CF4B09C573686B27737A7588CA71564A3AB1933E6A167203AC00DEC441EDD96B62F5AB1DEF99904670F
Malicious:	false
Preview:	..Z..1..-....L&t;.0....X.i....... I+.i..BP.........N.h.Vk.s..CbJ0..]....a.J.f/...{u.O.pKe....V...0<.Z../....K...Ou...T..I..%_\..;-...q4_^.{.^(4...Y\|..n...I..\|."zI...Y...}3.C.}...#......-.S.N..=..W.k>...n./....L.'U..d.QR...uZ...3..~.............N=$..........V.Z.6.Z16-s...K.R.#.UG7...!.3.4m$.(.~...w.~.....Ua.6zhT..C.....L.{......#Hy...?..q...C<......g..&.^.....\|r.-v46#1../p.~.....#..p.v.&..L.@Ob........z..,.5=`.......S.....8._...C.h....Wl..W.]..3......=.'.0.t.....q3.H..x...=S.t/.zE.so..{.$d..C..5..U....h.N.im5...C..V......(m%D..5..Na\.\|.d.V.b.....+.....{6.5T0K..f...i.,Mh...+T...Cp>....)..?._.$.....MD....y...z.2{h...n1.X.`>P;..{x........P.Uv8C].*.H..Y...<'..Ua..J\..A.aAs..(....Z/."j..a...MvE.40J .w.vI.rMvx....q.k.....]2.....0.....'..$.."..X$B..N:....'......................

C:\Users\user\Searches\Everywhere.search-ms

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.695617783195711
Encrypted:	false
SSDEEP:	12:SQpsjq6r0uRfP3clHa8+G9Lk/4VTWdvw53sMedv4+sDy283Gh2VRIs+J3wN0m/:R80MfcZalGdyFw5teyjyv02ipk0W
MD5:	CEEF1A517F7F7BE5001E41EE8BE41C7F
SHA1:	7455B3EC6EADA24D444B6111B411E248438A6EE6
SHA-256:	ABED3B492CE8DFE1ACC629729B019F866C9D9DAF134D6276A161908A5327BF3D
SHA-512:	74C78EB98DE0E26F28EC956AFA260787CFDF6A70C20DA67EF092D8DD83E399AC69E60DB40F02F74BEA6242B914D03E13E3139362909F9717F0B6C66925D471BB
Malicious:	false
Preview:	.uW.I\.d... .4...~K....tz._..V.l..x....~+>...\....$..@k. _!-..F...../...1,...M>.=p.(:..:...b..9,.K.>9.g.8V.S...L...Hkq._.Dr.j...T....n..d].Y1^...~F..w).._\......"y.6(N."1...k.l.k.k.6..YM.'.i....3.O.`..J.P....2eY..A..N....E...S...y.......x.y%.6.....uj@.6"i.f!.. .I..]../'...j...A`...&.....a..._.un..1..z....).;...`....1S..1.}....5.'.j..#?....8..LB..<..P??....%].a...2...."..]0pg....\...U.. .c.Z. ...j...#........+i.....^./.N...6.u...,.$.&w.V%`...7c..D.~.4.W..n...E.=....<.(.N,..N..D./j...q..{.....K.Y..A.........x..UC.y6..o...w..`.k.P...9H%.......d.4....8.B...4....m0J..M"....Mz.)$.$Y.h.m.-J?E...=.%..j...\.HI.r..;E...t&.l.$.u.....HD-...*B.]...[...h..,$).U.......E..w.......C.....&.&m../........v.S`.).=.,..6p.>........................

C:\Users\user\Searches\Everywhere.search-ms.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.695617783195711
Encrypted:	false
SSDEEP:	12:SQpsjq6r0uRfP3clHa8+G9Lk/4VTWdvw53sMedv4+sDy283Gh2VRIs+J3wN0m/:R80MfcZalGdyFw5teyjyv02ipk0W
MD5:	CEEF1A517F7F7BE5001E41EE8BE41C7F
SHA1:	7455B3EC6EADA24D444B6111B411E248438A6EE6
SHA-256:	ABED3B492CE8DFE1ACC629729B019F866C9D9DAF134D6276A161908A5327BF3D
SHA-512:	74C78EB98DE0E26F28EC956AFA260787CFDF6A70C20DA67EF092D8DD83E399AC69E60DB40F02F74BEA6242B914D03E13E3139362909F9717F0B6C66925D471BB
Malicious:	false
Preview:	.uW.I\.d... .4...~K....tz._..V.l..x....~+>...\....$..@k. _!-..F...../...1,...M>.=p.(:..:...b..9,.K.>9.g.8V.S...L...Hkq._.Dr.j...T....n..d].Y1^...~F..w).._\......"y.6(N."1...k.l.k.k.6..YM.'.i....3.O.`..J.P....2eY..A..N....E...S...y.......x.y%.6.....uj@.6"i.f!.. .I..]../'...j...A`...&.....a..._.un..1..z....).;...`....1S..1.}....5.'.j..#?....8..LB..<..P??....%].a...2...."..]0pg....\...U.. .c.Z. ...j...#........+i.....^./.N...6.u...,.$.&w.V%`...7c..D.~.4.W..n...E.=....<.(.N,..N..D./j...q..{.....K.Y..A.........x..UC.y6..o...w..`.k.P...9H%.......d.4....8.B...4....m0J..M"....Mz.)$.$Y.h.m.-J?E...=.%..j...\.HI.r..;E...t&.l.$.u.....HD-...*B.]...[...h..,$).U.......E..w.......C.....&.&m../........v.S`.).=.,..6p.>........................

C:\Users\user\Searches\Indexed Locations.search-ms

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.720694309262759
Encrypted:	false
SSDEEP:	24:hWsfE+JRAHBYW81EhU1Gen0t9Y8hfLLnmFCXoVrA:AX+JnWINN0TYofLLnmmQrA
MD5:	6C1B670ADD33FAA310FA7218B25DD608
SHA1:	626C187946603B6754AFA2552579C62B3532FA4C
SHA-256:	91E8BEBB66BB8F9219996CB99259ED3A669064029DDB1A5CAB84546592A268F4
SHA-512:	AA79A29355B6D79737DBD641DF07694A5F078AC6E5DD160B527D515603362E6A1D42ECE9E4951DA0F02B06C7B8BAF48C8B6175F72B3A3DBC8F4411A9EA26E63C
Malicious:	false
Preview:	+.3F.i...p...Yh..e..F=C.W..VExd'kw.R.^..;...v.n.H.."..'QE\|0.5...8.... ..@.....B...H.w.a1......%.......^........@.. ....=....2...@.Hw.^.1.g(..,...n6..=.k....:pT.15}.....(..YH2..z...~R....%....(BG1.:.`4!y.../...l.G.V`^?.2....u..~.)}.".!9.&.'i.U...Ja5.i>......s"Od.{.N&..,d.n.I'.4...#...p... pT...r.E.s.Wm.'vj...dG...2........Ke.+.Z.f.....T..~.....$.o.`..%.>.....Dx .gx.(...A.(.4..UP..=......J$..Z>.P....:..H%3.....i;j.4........~.......Y.O.=.;.....Rm..g.V......&`.4....u.[..A.....I...c?9..MR..3.ty.C.`m=.D7..7~...%.>...8...P=f4,..4&H......6..sD<5.E....:I9A.'U........A..a......NOJ-...V..2....w..y]...J-.!g.}......./.....L.).....".....g=^/3...T.P.6+....B..=.=p$L..&3;.d1(..z. /.\|J2i.._U........Fj3~...8.O......(#.....bx.DH.......................

C:\Users\user\Searches\Indexed Locations.search-ms.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	784
Entropy (8bit):	7.720694309262759
Encrypted:	false
SSDEEP:	24:hWsfE+JRAHBYW81EhU1Gen0t9Y8hfLLnmFCXoVrA:AX+JnWINN0TYofLLnmmQrA
MD5:	6C1B670ADD33FAA310FA7218B25DD608
SHA1:	626C187946603B6754AFA2552579C62B3532FA4C
SHA-256:	91E8BEBB66BB8F9219996CB99259ED3A669064029DDB1A5CAB84546592A268F4
SHA-512:	AA79A29355B6D79737DBD641DF07694A5F078AC6E5DD160B527D515603362E6A1D42ECE9E4951DA0F02B06C7B8BAF48C8B6175F72B3A3DBC8F4411A9EA26E63C
Malicious:	false
Preview:	+.3F.i...p...Yh..e..F=C.W..VExd'kw.R.^..;...v.n.H.."..'QE\|0.5...8.... ..@.....B...H.w.a1......%.......^........@.. ....=....2...@.Hw.^.1.g(..,...n6..=.k....:pT.15}.....(..YH2..z...~R....%....(BG1.:.`4!y.../...l.G.V`^?.2....u..~.)}.".!9.&.'i.U...Ja5.i>......s"Od.{.N&..,d.n.I'.4...#...p... pT...r.E.s.Wm.'vj...dG...2........Ke.+.Z.f.....T..~.....$.o.`..%.>.....Dx .gx.(...A.(.4..UP..=......J$..Z>.P....:..H%3.....i;j.4........~.......Y.O.=.;.....Rm..g.V......&`.4....u.[..A.....I...c?9..MR..3.ty.C.`m=.D7..7~...%.>...8...P=f4,..4&H......6..sD<5.E....:I9A.'U........A..a......NOJ-...V..2....w..y]...J-.!g.}......./.....L.).....".....g=^/3...T.P.6+....B..=.=p$L..&3;.d1(..z. /.\|J2i.._U........Fj3~...8.O......(#.....bx.DH.......................

C:\Users\user\Searches\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\user\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\Public\Desktop\Acrobat Reader.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2660
Entropy (8bit):	7.926490644495107
Encrypted:	false
SSDEEP:	48:Rvru1rpbBx8V8u7gi0HuJkmtm117NMiHl7yH8dm+Mq5hL3CK:RvafbBx8V8u7gi0OCmtGUilOHRAb3CK
MD5:	F69E6F9139169DA7645F15844F7580E8
SHA1:	A0D47A59BD5235E25138B78EBC8038B5615EBDA7
SHA-256:	A1B9CC2088C8D5A3229DB961F550634CA7F2F82B3F8D5E3D68C7F262F3B3AAF0
SHA-512:	50937D5CE6641EBE29F2C66A219CCB4FE22A60A42BBB84A3CFA88912219A99C077C644D0369E9808E5A5E6E85CE410A1E513D6A3888B0FE066B8BE4C38CE36E0
Malicious:	false
Preview:	..)..8..!`c^.}....... .Oq..+...y.{..bh....~..(t.@..P5.7H...].K.....Hs........)...)B.9.t.NI.N."..:..Ip.}9@cP.E....?F.5.+...b.J2Y..n....%....G..1..b`O.\nLQ.\|E..GI..)......1....2..-..\..}..eD..9.U.{.#,..Z........X0.\|...H)K.K.JW1P#.@F...1.;..}..8.....iRP...B....k..H~...M.s_B...b...x.............0DB...2H..........T...o$...pm.....H....X.O........9....C..^...[.Af.^...1.......$.C....a..U`..~...7..O3..3_so...Y..a.>z.sw0..... \|..U.4.X.o.y.n.'.uts.Z<.8.;.l.2%..........P...#...C...r=].f..B.S..D'.$....>F$q.R......8.$.....f..l.:......5T......R..$[n...Y. ..@..Oe...E..%....I9...p..*.-...N...o&.=\pH..yq.n.).O..6t..%..8"...@.d.%e.jD....C..Q.P.~.:l>.d$...9H..";...i3.0...;d{.#......,...A<......c......CK5U.....e@t...r{..m.m.w.I....8."3.M..SD7..Rl....aP..}@.J.....G.(....\3...!..AY'<.t.....L^.......\|s....P.1.^.Dz.f.R...W.y3..!.....,.K....r..e...('.[......b.cK......_pI..o$....`\...W..ck.Hy.pK..e.k#.)...>S.G._4...j..a.0.=-C~q...`M(.(lY\#....\|6?..$....Z.

C:\Users\Public\Desktop\Acrobat Reader.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	2660
Entropy (8bit):	7.926490644495107
Encrypted:	false
SSDEEP:	48:Rvru1rpbBx8V8u7gi0HuJkmtm117NMiHl7yH8dm+Mq5hL3CK:RvafbBx8V8u7gi0OCmtGUilOHRAb3CK
MD5:	F69E6F9139169DA7645F15844F7580E8
SHA1:	A0D47A59BD5235E25138B78EBC8038B5615EBDA7
SHA-256:	A1B9CC2088C8D5A3229DB961F550634CA7F2F82B3F8D5E3D68C7F262F3B3AAF0
SHA-512:	50937D5CE6641EBE29F2C66A219CCB4FE22A60A42BBB84A3CFA88912219A99C077C644D0369E9808E5A5E6E85CE410A1E513D6A3888B0FE066B8BE4C38CE36E0
Malicious:	false
Preview:	..)..8..!`c^.}....... .Oq..+...y.{..bh....~..(t.@..P5.7H...].K.....Hs........)...)B.9.t.NI.N."..:..Ip.}9@cP.E....?F.5.+...b.J2Y..n....%....G..1..b`O.\nLQ.\|E..GI..)......1....2..-..\..}..eD..9.U.{.#,..Z........X0.\|...H)K.K.JW1P#.@F...1.;..}..8.....iRP...B....k..H~...M.s_B...b...x.............0DB...2H..........T...o$...pm.....H....X.O........9....C..^...[.Af.^...1.......$.C....a..U`..~...7..O3..3_so...Y..a.>z.sw0..... \|..U.4.X.o.y.n.'.uts.Z<.8.;.l.2%..........P...#...C...r=].f..B.S..D'.$....>F$q.R......8.$.....f..l.:......5T......R..$[n...Y. ..@..Oe...E..%....I9...p..*.-...N...o&.=\pH..yq.n.).O..6t..%..8"...@.d.%e.jD....C..Q.P.~.:l>.d$...9H..";...i3.0...;d{.#......,...A<......c......CK5U.....e@t...r{..m.m.w.I....8."3.M..SD7..Rl....aP..}@.J.....G.(....\3...!..AY'<.t.....L^.......\|s....P.1.^.Dz.f.R...W.y3..!.....,.K....r..e...('.[......b.cK......_pI..o$....`\...W..ck.Hy.pK..e.k#.)...>S.G._4...j..a.0.=-C~q...`M(.(lY\#....\|6?..$....Z.

C:\Users\Public\Desktop\Firefox.lnk

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	7.886131565601455
Encrypted:	false
SSDEEP:	24:tvwcNBz4zMktRsIopgDu4iP6QClWY27LK1ouErU1i7yUls1e52jlsuKVdKs:tgVc4iPDIWYRsrUCF647LQs
MD5:	88C3E6F4058CA0BA33C9E7F278CDCF07
SHA1:	ADD80298D2819009C14B051592C8B24D30567181
SHA-256:	D4E1C5D310AF162559CC17872D9C81F3E6A072E758B8D645A9152105D61D2E03
SHA-512:	6B701CAA1C27CE53D2EB98E78E906CC477592B6B7161D9AAD4BD80127065618434399F881F8EC8919475E77ACB210D885A6E70E2289968A84D2B7B3F2209D41E
Malicious:	false
Preview:	=X,v...f.....{m...N..Y.r..._.uF6.~...x"-x`..}XMe..t..-.!........+..rt."P=.y...N.Oz%.Yr..{.aq.T..>4e..Z...s7.xB.!..KjVLWe\|.NZ.....5.v..L.....O...t....X.T?..'..;2....+....o..... D!.6.p.uZj[.a....6..............f...$..#...B.....D....'.+..$.E.....'.._.&..R..5.....N.m.....f.>.ffl..N..X.......Z..pX.~.k..e...i.......{..O.LY./.H.;k.'.xD.d.Z...:o..o....wo..r...EE..=.).R.].A..).Sk.\|.\|U^..p6`.~)..&.....k.zn.w./.C.z...7.'}.&...%-F.p.".W5 ..7...z...L.r.A...0Ft.Q..99j.#.B.M....).......BI.)aVv...l.....\....]K...YY..x..u......Ulmk........9.....a.Y.+.).y.........H....0.R.....(n..^cUD.v.Y.`0..E....k.H~ ...8B..p~.G......e.G8.k}.\.._5...B.+#QbC..q.z^...>TX...2/.....m....P....{..N.u...L.Z...J..U.5.1.X...zv.1.O.:ehzo.....+..~.v.....N<K.d...\3..0\|.Q.-8.S...\|[Z..h..n.$..9(.2J..O.5.Vl..h...../Y...?...W9}...O>=<....c#....y.hU...).....mIN...b.....(.wl...).0..<{.vv...`.OB..C.?.Q+%..D..~Y<.h.40.hU........8e....P.r.\..>...t.I.0.D`.e._1....T{+!g.9.....#."..Pd-...

C:\Users\Public\Desktop\Firefox.lnk.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	7.886131565601455
Encrypted:	false
SSDEEP:	24:tvwcNBz4zMktRsIopgDu4iP6QClWY27LK1ouErU1i7yUls1e52jlsuKVdKs:tgVc4iPDIWYRsrUCF647LQs
MD5:	88C3E6F4058CA0BA33C9E7F278CDCF07
SHA1:	ADD80298D2819009C14B051592C8B24D30567181
SHA-256:	D4E1C5D310AF162559CC17872D9C81F3E6A072E758B8D645A9152105D61D2E03
SHA-512:	6B701CAA1C27CE53D2EB98E78E906CC477592B6B7161D9AAD4BD80127065618434399F881F8EC8919475E77ACB210D885A6E70E2289968A84D2B7B3F2209D41E
Malicious:	false
Preview:	=X,v...f.....{m...N..Y.r..._.uF6.~...x"-x`..}XMe..t..-.!........+..rt."P=.y...N.Oz%.Yr..{.aq.T..>4e..Z...s7.xB.!..KjVLWe\|.NZ.....5.v..L.....O...t....X.T?..'..;2....+....o..... D!.6.p.uZj[.a....6..............f...$..#...B.....D....'.+..$.E.....'.._.&..R..5.....N.m.....f.>.ffl..N..X.......Z..pX.~.k..e...i.......{..O.LY./.H.;k.'.xD.d.Z...:o..o....wo..r...EE..=.).R.].A..).Sk.\|.\|U^..p6`.~)..&.....k.zn.w./.C.z...7.'}.&...%-F.p.".W5 ..7...z...L.r.A...0Ft.Q..99j.#.B.M....).......BI.)aVv...l.....\....]K...YY..x..u......Ulmk........9.....a.Y.+.).y.........H....0.R.....(n..^cUD.v.Y.`0..E....k.H~ ...8B..p~.G......e.G8.k}.\.._5...B.+#QbC..q.z^...>TX...2/.....m....P....{..N.u...L.Z...J..U.5.1.X...zv.1.O.:ehzo.....+..~.v.....N<K.d...\3..0\|.Q.-8.S...\|[Z..h..n.$..9(.2J..O.5.Vl..h...../Y...?...W9}...O>=<....c#....y.hU...).....mIN...b.....(.wl...).0..<{.vv...`.OB..C.?.Q+%..D..~Y<.h.40.hU........8e....P.r.\..>...t.I.0.D`.e._1....T{+!g.9.....#."..Pd-...

C:\Users\Public\Desktop\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

C:\Users\Public\Libraries\RecordedTV.library-ms

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1496
Entropy (8bit):	7.848190142252215
Encrypted:	false
SSDEEP:	24:Zph16qS2fx4wLcwqqu48cEUWIXmFQZuDJXpfMigD2r+RFTORGfpW+MVcCscV9yD:7yqcwLbqZ4RlXm+uDJX5MigDU+RFTOAn
MD5:	19169947DB23CBAB06E364A21D79E357
SHA1:	C1ACEE3CBD46126FE0D517521834361BDC095534
SHA-256:	CD8110EC39CB6C035C1B5CBA01F9FD1CDDE673639871DF483848B9683BAC45E4
SHA-512:	052B113C613B0479EDE8CBA88D0FB56986DEC9BBAA29D4191A712F2CB60284511AB055D471D439972727F7A37B7980475AEADFF39F80E125B0800770043F6DD7
Malicious:	false
Preview:	n......=.tsz\|..cF.L...g.g....i.......l..ar..N.9..T....8>9.Yi.......%...U\....@.K.b<.k...[.G.R3....v........A]....9...K.r.........3..S.ou7.Rm..#.6.T=..6nk=....6.&..&WU....c..j....G...&.'.......t+....O.....m.....S-....ef..=.~...>P......2l.s.\|E.`..(_....b..T.JDC..4..TI..l.....~uFw.N.=...rB..MN.-...U6..6.A...%`..'../$..p..\|4.h..g.wH.L..-gP.)....u...vxH.U.... i.R.P.8..t...q...rSyM.....d...0..."j.....{v3...Z....4F..9#ma........v..M.%._.l...R.cF.-.#v.ug9.6.@aS.:......]..T.l..N1m<M.._..;r..\..A..........ku:...m...T.+.m?.f.Y..Q...<i.....\....O.....%..Y.WH........{..Rt.r.?...em..".?.d.op.A2V2Kn\|Y`.8....T6_B..`b...\HEE;i7S6...(S...Ud...U}t....Q.0.QJ.ar.Woyn...uC..+b ..y?...ZhZ.!......&..O\|.f:R...k...{...2.0....FuqG%.... .`"......j.#..c.0*..;...\)../...Z...mE......c......X.vX..E.f..O(o..... $....I........u....Sv..\CJ......s)...........f.^....`.(.X.....L/....<....6\|L6.}9....}d..3.....P.p..$].g+.)...)................C._...M..8"..@..jYo...N.M.k.1/t.....a

C:\Users\Public\Libraries\RecordedTV.library-ms.dice (copy)

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	data
Category:	dropped
Size (bytes):	1496
Entropy (8bit):	7.848190142252215
Encrypted:	false
SSDEEP:	24:Zph16qS2fx4wLcwqqu48cEUWIXmFQZuDJXpfMigD2r+RFTORGfpW+MVcCscV9yD:7yqcwLbqZ4RlXm+uDJX5MigDU+RFTOAn
MD5:	19169947DB23CBAB06E364A21D79E357
SHA1:	C1ACEE3CBD46126FE0D517521834361BDC095534
SHA-256:	CD8110EC39CB6C035C1B5CBA01F9FD1CDDE673639871DF483848B9683BAC45E4
SHA-512:	052B113C613B0479EDE8CBA88D0FB56986DEC9BBAA29D4191A712F2CB60284511AB055D471D439972727F7A37B7980475AEADFF39F80E125B0800770043F6DD7
Malicious:	false
Preview:	n......=.tsz\|..cF.L...g.g....i.......l..ar..N.9..T....8>9.Yi.......%...U\....@.K.b<.k...[.G.R3....v........A]....9...K.r.........3..S.ou7.Rm..#.6.T=..6nk=....6.&..&WU....c..j....G...&.'.......t+....O.....m.....S-....ef..=.~...>P......2l.s.\|E.`..(_....b..T.JDC..4..TI..l.....~uFw.N.=...rB..MN.-...U6..6.A...%`..'../$..p..\|4.h..g.wH.L..-gP.)....u...vxH.U.... i.R.P.8..t...q...rSyM.....d...0..."j.....{v3...Z....4F..9#ma........v..M.%._.l...R.cF.-.#v.ug9.6.@aS.:......]..T.l..N1m<M.._..;r..\..A..........ku:...m...T.+.m?.f.Y..Q...<i.....\....O.....%..Y.WH........{..Rt.r.?...em..".?.d.op.A2V2Kn\|Y`.8....T6_B..`b...\HEE;i7S6...(S...Ud...U}t....Q.0.QJ.ar.Woyn...uC..+b ..y?...ZhZ.!......&..O\|.f:R...k...{...2.0....FuqG%.... .`"......j.#..c.0*..;...\)../...Z...mE......c......X.vX..E.f..O(o..... $....I........u....Sv..\CJ......s)...........f.^....`.(.X.....L/....<....6\|L6.}9....}d..3.....P.p..$].g+.)...)................C._...M..8"..@..jYo...N.M.k.1/t.....a

C:\Users\Public\Libraries\readme.txt

Download File

Process:	C:\Users\user\Desktop\2005.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	425
Entropy (8bit):	5.13697654118133
Encrypted:	false
SSDEEP:	12:ozjjMLXwuR0OLJveeC27uZWLpyzV1zu/FWqa:4jMLPR0O0eC9/zuE/
MD5:	AE800B1DDB97CB84CE8C7D0BF3E7F8D3
SHA1:	6E06AC7453DB86F1FF0FBD9110F63D272C328378
SHA-256:	88CA777178EB3CFE24BA0587B664BF318121654A6140AD93AB5121A2A1594464
SHA-512:	0510EB8748B662B5088AB77E36526BC573294DE6E552C3599F606C2937D112F869BAE8D635F09285D3770359841FE1CFC870E3F008AC1E5E7BE1988BCD775D1F
Malicious:	false
Preview:	Your data are STOLEN and your servers is LOCKED...The data will be published on TOR website if you do not contact with us. ..You can contact us directly for further instructions through emails:....ccfarmy@tutanota.com..ccfarmy@protonmail.com....In subject write your personal id (below).....Recovery information:..key: eyJleHQiOiIuZGljZSIsIm5ldHdvcmsiOiJ0cnVlIiwic3ViaWQiOiIyMDA1IiwibGFuZyI6ImVuLUdCACJ9..personal id: ARQOOLG

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\wbem\WMIC.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	3.9975790033896286
Encrypted:	false
SSDEEP:	3:+tG2UGNmOMFoyn:+tnmky
MD5:	AF404CF1944BF737356BF00A2EC9121D
SHA1:	2F1867B11BAA22A86BEFFE8147714E9805B2A58F
SHA-256:	2D46C542862CB3FC9F22BB3EB29E1EFE31AA02B438A40D62485470981F58CBD3
SHA-512:	F5B178BAFB0D8DD0833AC1830079B097FD37F32DEE617F0F4A3D6ECEA54B7E6FC9DA281D60A56A6FFB4D1ABA9AD76E643133CA23087DE8BED6593E4B5C1ED4E8
Malicious:	false
Preview:	Unexpected switch at this level....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.175861282239405
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2005.exe
File size:	141'312 bytes
MD5:	940c75b80536e5c7d686c5847c51ad2b
SHA1:	1edd8c4294d91737f05abf1b88215b2c13ea3f0c
SHA256:	a1b39e60f3d07c2ae8b375211e7dbac4efc0011444e9b09e6e37a496554fdb86
SHA512:	f5ca5f76430f48162f2fcd72ea16de5b1d6514d93f96ad7d8bbb4cd0691c6d5dee6d1b4d58507fa66188a1fb2198707e8160eb63c3ab937e20b7776ca51cb6ff
SSDEEP:	3072:1ZO75plD368W/5SeiLHpV3IhzfW+3g70XdlqgDuYUB/vemeeCL+JLV:1C5px3HW/3iLHpV4hzu+jd7uYU5JeyT
TLSH:	53D37D5075C0C4B1E57A493185E8A6A3AA7DF9300F618F6B33E40B2E1F785D09B35DAB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l.<...o...o...o.e.n...o.e.n0..o.e.n...onb.n...onb.n...onb.n...o.e.n...o...o...o#}.n...o#}9o...o..Qo...o#}.n...oRich...o.......

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x408b49
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F9335A8 [Fri Oct 23 19:57:28 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	65f731597048104980e8041a141b37d6

Entrypoint Preview

Instruction
call 00007F5640FB8845h
jmp 00007F5640FB820Fh
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007F5640FB7AFAh
push 0041E588h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007F5640FB9D34h
int3
push ebp
mov ebp, esp
and dword ptr [004214F0h], 00000000h
sub esp, 24h
or dword ptr [0042000Ch], 01h
push 0000000Ah
call 00007F5640FC454Dh
test eax, eax
je 00007F5640FB853Fh
and dword ptr [ebp-10h], 00000000h
xor eax, eax
push ebx
push esi
push edi
xor ecx, ecx
lea edi, dword ptr [ebp-24h]
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword ptr [edi], eax
mov dword ptr [edi+04h], esi
mov dword ptr [edi+08h], ecx
xor ecx, ecx
mov dword ptr [edi+0Ch], edx
mov eax, dword ptr [ebp-24h]
mov edi, dword ptr [ebp-1Ch]
mov dword ptr [ebp-0Ch], eax
xor edi, 6C65746Eh
mov eax, dword ptr [ebp-18h]
xor eax, 49656E69h
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp-20h]
xor eax, 756E6547h
mov dword ptr [ebp-04h], eax
xor eax, eax
inc eax
push ebx
cpuid
mov esi, ebx
pop ebx
lea ebx, dword ptr [ebp-24h]
mov dword ptr [ebx], eax
mov eax, dword ptr [ebp-04h]
mov dword ptr [ebx+04h], esi
or eax, edi
or eax, dword ptr [ebp-08h]
mov dword ptr [ebx+08h], ecx
mov dword ptr [ebx+0Ch], edx
jne 00007F5640FB83D5h
mov eax, dword ptr [ebp-24h]
and eax, 0FFF3FF0h
cmp eax, 000106C0h
je 00007F5640FB83B5h
cmp eax, 00020660h
je 00007F5640FB83AEh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1ec10	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x22000	0x3020	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1d5a8	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1d5e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x18000	0x21c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x165a2	0x16600	8142a2c1e5e79977c6578b772a28800f	False	0.5815184182960894	data	6.67635964191854	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x7860	0x7a00	ee11e77d8e2ef81eaf33531d88df94f1	False	0.4060578893442623	data	4.917833965990766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x1d64	0x1200	407ca758ba9120113a21925739e6889d	False	0.10872395833333333	data	1.688123578203304	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x22000	0x3020	0x3200	b79731beedda4cd07ce26bc68c8ae21e	False	0.132421875	data	2.298693642373758	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_STRING	0x220a0	0x2df4	data	English	United States	0.1175620537232234
RT_MANIFEST	0x24e98	0x188	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5892857142857143

Imports

DLL	Import
KERNEL32.dll	PostQueuedCompletionStatus, GetLogicalDrives, GetCurrentProcess, TerminateProcess, CreateMutexA, WaitForSingleObject, OpenProcess, CreateToolhelp32Snapshot, Sleep, OpenMutexA, Process32NextW, GetCurrentThread, Process32FirstW, GetThreadContext, FindClose, GetTickCount, IsDebuggerPresent, CheckRemoteDebuggerPresent, GetQueuedCompletionStatus, GetSystemInfo, CreateThread, CreateIoCompletionPort, WriteConsoleW, GetConsoleMode, FindNextFileW, FindFirstFileW, GetProcessHeap, MoveFileExW, SetFilePointerEx, HeapAlloc, GetLastError, SetFileAttributesW, GetFileAttributesW, HeapFree, GetFileSizeEx, ReadFile, WideCharToMultiByte, GetConsoleCP, FlushFileBuffers, GetModuleHandleW, CloseHandle, HeapReAlloc, HeapSize, MultiByteToWideChar, CreateFileW, GetUserDefaultLocaleName, CreateProcessA, WriteFile, GetStringTypeW, SetStdHandle, GetFileType, DecodePointer, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetCPInfo, GetOEMCP, GetACP, IsValidCodePage, FindFirstFileExW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, RaiseException, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, ExitProcess, GetModuleFileNameW, GetStdHandle, LCMapStringW
USER32.dll	LoadStringW
ADVAPI32.dll	ControlService, CryptImportKey, CryptGenRandom, CryptEncrypt, CryptAcquireContextW, CryptDestroyKey, QueryServiceStatusEx, CloseServiceHandle, OpenSCManagerW, CryptReleaseContext, EnumDependentServicesW, OpenServiceW
SHELL32.dll	SHEmptyRecycleBinW
CRYPT32.dll	CryptStringToBinaryA
MPR.dll	WNetGetConnectionW
IPHLPAPI.DLL	IcmpCloseHandle, GetAdaptersInfo, IcmpCreateFile, IcmpSendEcho
NETAPI32.dll	NetShareEnum, NetDfsEnum, NetApiBufferFree
WS2_32.dll	getnameinfo, WSACleanup, WSAStartup, inet_addr, htons
RstrtMgr.DLL	RmStartSession, RmShutdown, RmEndSession, RmGetList, RmRegisterResources

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 19:25:42.050966978 CEST	49746	443	192.168.11.30	23.219.82.74
Oct 7, 2024 19:26:23.685571909 CEST	49769	443	192.168.11.30	23.44.201.15
Oct 7, 2024 19:26:24.354006052 CEST	49770	80	192.168.11.30	142.251.40.99
Oct 7, 2024 19:26:24.354090929 CEST	49771	80	192.168.11.30	23.206.121.28
Oct 7, 2024 19:26:24.450799942 CEST	80	49771	23.206.121.28	192.168.11.30
Oct 7, 2024 19:26:24.451030016 CEST	49771	80	192.168.11.30	23.206.121.28
Oct 7, 2024 19:26:24.464517117 CEST	80	49770	142.251.40.99	192.168.11.30
Oct 7, 2024 19:26:24.464749098 CEST	49770	80	192.168.11.30	142.251.40.99
Oct 7, 2024 19:27:36.595489025 CEST	49773	443	192.168.11.30	52.111.227.14
Oct 7, 2024 19:27:36.595603943 CEST	443	49773	52.111.227.14	192.168.11.30
Oct 7, 2024 19:27:36.595778942 CEST	49773	443	192.168.11.30	52.111.227.14
Oct 7, 2024 19:27:36.596028090 CEST	49773	443	192.168.11.30	52.111.227.14
Oct 7, 2024 19:27:36.596075058 CEST	443	49773	52.111.227.14	192.168.11.30
Oct 7, 2024 19:27:37.025684118 CEST	443	49773	52.111.227.14	192.168.11.30
Oct 7, 2024 19:27:37.025957108 CEST	49773	443	192.168.11.30	52.111.227.14
Oct 7, 2024 19:27:37.030739069 CEST	49773	443	192.168.11.30	52.111.227.14
Oct 7, 2024 19:27:37.030766964 CEST	443	49773	52.111.227.14	192.168.11.30
Oct 7, 2024 19:27:37.031419039 CEST	443	49773	52.111.227.14	192.168.11.30
Oct 7, 2024 19:27:37.039797068 CEST	49773	443	192.168.11.30	52.111.227.14
Oct 7, 2024 19:27:37.080214977 CEST	443	49773	52.111.227.14	192.168.11.30
Oct 7, 2024 19:27:37.168519974 CEST	443	49773	52.111.227.14	192.168.11.30
Oct 7, 2024 19:27:37.168817043 CEST	443	49773	52.111.227.14	192.168.11.30
Oct 7, 2024 19:27:37.168845892 CEST	49773	443	192.168.11.30	52.111.227.14
Oct 7, 2024 19:27:37.168845892 CEST	49773	443	192.168.11.30	52.111.227.14
Oct 7, 2024 19:27:37.169003010 CEST	443	49773	52.111.227.14	192.168.11.30
Oct 7, 2024 19:27:37.169096947 CEST	49773	443	192.168.11.30	52.111.227.14
Oct 7, 2024 19:27:37.169157028 CEST	443	49773	52.111.227.14	192.168.11.30

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 7, 2024 19:25:50.360203028 CEST	60518	274	192.168.11.30	192.168.11.1
Oct 7, 2024 19:25:50.473491907 CEST	53	61179	1.1.1.1	192.168.11.30
Oct 7, 2024 19:25:55.023372889 CEST	60518	274	192.168.11.30	192.168.11.1

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 7, 2024 19:25:50.357480049 CEST	192.168.11.30	192.168.11.1	f7fa		Echo
Oct 7, 2024 19:25:50.357532024 CEST	192.168.11.1	192.168.11.30	fffa		Echo Reply
Oct 7, 2024 19:25:50.360222101 CEST	192.168.11.1	192.168.11.30	951f	(Port unreachable)	Destination Unreachable
Oct 7, 2024 19:25:50.473975897 CEST	192.168.11.1	192.168.11.30	94b8	(Port unreachable)	Destination Unreachable
Oct 7, 2024 19:25:51.986324072 CEST	192.168.11.1	192.168.11.30	94b8	(Port unreachable)	Destination Unreachable
Oct 7, 2024 19:25:53.502588987 CEST	192.168.11.1	192.168.11.30	94b8	(Port unreachable)	Destination Unreachable
Oct 7, 2024 19:25:55.023394108 CEST	192.168.11.1	192.168.11.30	951f	(Port unreachable)	Destination Unreachable
Oct 7, 2024 19:25:55.024051905 CEST	192.168.11.30	192.168.11.2	f7f9		Echo
Oct 7, 2024 19:25:55.482306957 CEST	192.168.11.30	192.168.11.3	f7f8		Echo
Oct 7, 2024 19:25:55.978467941 CEST	192.168.11.30	192.168.11.4	f7f7		Echo
Oct 7, 2024 19:25:56.472062111 CEST	192.168.11.30	192.168.11.5	f7f6		Echo
Oct 7, 2024 19:25:56.970554113 CEST	192.168.11.30	192.168.11.6	f7f5		Echo
Oct 7, 2024 19:25:57.473247051 CEST	192.168.11.30	192.168.11.7	f7f4		Echo
Oct 7, 2024 19:25:57.975990057 CEST	192.168.11.30	192.168.11.8	f7f3		Echo
Oct 7, 2024 19:25:58.480487108 CEST	192.168.11.30	192.168.11.9	f7f2		Echo
Oct 7, 2024 19:25:58.992763996 CEST	192.168.11.30	192.168.11.10	f7f1		Echo
Oct 7, 2024 19:25:59.473428011 CEST	192.168.11.30	192.168.11.11	f7f0		Echo
Oct 7, 2024 19:25:59.981132030 CEST	192.168.11.30	192.168.11.12	f7ef		Echo
Oct 7, 2024 19:26:00.472469091 CEST	192.168.11.30	192.168.11.13	f7ee		Echo
Oct 7, 2024 19:26:00.990065098 CEST	192.168.11.30	192.168.11.14	f7ed		Echo
Oct 7, 2024 19:26:01.469468117 CEST	192.168.11.30	192.168.11.15	f7ec		Echo
Oct 7, 2024 19:26:01.969238997 CEST	192.168.11.30	192.168.11.16	f7eb		Echo
Oct 7, 2024 19:26:02.468810081 CEST	192.168.11.30	192.168.11.17	f7ea		Echo
Oct 7, 2024 19:26:02.989164114 CEST	192.168.11.30	192.168.11.18	f7e9		Echo
Oct 7, 2024 19:26:03.469110966 CEST	192.168.11.30	192.168.11.19	f7e8		Echo
Oct 7, 2024 19:26:03.968667984 CEST	192.168.11.30	192.168.11.20	f7e7		Echo
Oct 7, 2024 19:26:04.468405962 CEST	192.168.11.30	192.168.11.21	f7e6		Echo
Oct 7, 2024 19:26:04.968473911 CEST	192.168.11.30	192.168.11.22	f7e5		Echo
Oct 7, 2024 19:26:05.468089104 CEST	192.168.11.30	192.168.11.23	f7e4		Echo
Oct 7, 2024 19:26:05.970320940 CEST	192.168.11.30	192.168.11.24	f7e3		Echo
Oct 7, 2024 19:26:06.468094110 CEST	192.168.11.30	192.168.11.25	f7e2		Echo
Oct 7, 2024 19:26:06.967822075 CEST	192.168.11.30	192.168.11.26	f7e1		Echo
Oct 7, 2024 19:26:07.468033075 CEST	192.168.11.30	192.168.11.27	f7e0		Echo
Oct 7, 2024 19:26:07.996788979 CEST	192.168.11.30	192.168.11.28	f7df		Echo
Oct 7, 2024 19:26:08.467521906 CEST	192.168.11.30	192.168.11.29	f7de		Echo
Oct 7, 2024 19:26:08.967530012 CEST	192.168.11.30	192.168.11.31	f7dd		Echo
Oct 7, 2024 19:26:09.468648911 CEST	192.168.11.30	192.168.11.32	f7dc		Echo
Oct 7, 2024 19:26:09.967178106 CEST	192.168.11.30	192.168.11.33	f7db		Echo
Oct 7, 2024 19:26:10.467525005 CEST	192.168.11.30	192.168.11.34	f7da		Echo
Oct 7, 2024 19:26:10.967093945 CEST	192.168.11.30	192.168.11.35	f7d9		Echo
Oct 7, 2024 19:26:11.466811895 CEST	192.168.11.30	192.168.11.36	f7d8		Echo
Oct 7, 2024 19:26:11.966972113 CEST	192.168.11.30	192.168.11.37	f7d7		Echo
Oct 7, 2024 19:26:12.466588974 CEST	192.168.11.30	192.168.11.38	f7d6		Echo
Oct 7, 2024 19:26:12.966418028 CEST	192.168.11.30	192.168.11.39	f7d5		Echo
Oct 7, 2024 19:26:13.466469049 CEST	192.168.11.30	192.168.11.40	f7d4		Echo
Oct 7, 2024 19:26:13.966626883 CEST	192.168.11.30	192.168.11.41	f7d3		Echo
Oct 7, 2024 19:26:14.466176987 CEST	192.168.11.30	192.168.11.42	f7d2		Echo
Oct 7, 2024 19:26:14.966191053 CEST	192.168.11.30	192.168.11.43	f7d1		Echo
Oct 7, 2024 19:26:15.465903997 CEST	192.168.11.30	192.168.11.44	f7d0		Echo
Oct 7, 2024 19:26:15.966114044 CEST	192.168.11.30	192.168.11.45	f7cf		Echo
Oct 7, 2024 19:26:16.466075897 CEST	192.168.11.30	192.168.11.46	f7ce		Echo
Oct 7, 2024 19:26:16.965883017 CEST	192.168.11.30	192.168.11.47	f7cd		Echo
Oct 7, 2024 19:26:17.465454102 CEST	192.168.11.30	192.168.11.48	f7cc		Echo
Oct 7, 2024 19:26:17.965465069 CEST	192.168.11.30	192.168.11.49	f7cb		Echo
Oct 7, 2024 19:26:18.465430021 CEST	192.168.11.30	192.168.11.50	f7ca		Echo
Oct 7, 2024 19:26:18.965214014 CEST	192.168.11.30	192.168.11.51	f7c9		Echo
Oct 7, 2024 19:26:19.465517998 CEST	192.168.11.30	192.168.11.52	f7c8		Echo
Oct 7, 2024 19:26:19.965626955 CEST	192.168.11.30	192.168.11.53	f7c7		Echo
Oct 7, 2024 19:26:20.464823008 CEST	192.168.11.30	192.168.11.54	f7c6		Echo
Oct 7, 2024 19:26:20.964734077 CEST	192.168.11.30	192.168.11.55	f7c5		Echo
Oct 7, 2024 19:26:21.464865923 CEST	192.168.11.30	192.168.11.56	f7c4		Echo
Oct 7, 2024 19:26:21.964509964 CEST	192.168.11.30	192.168.11.57	f7c3		Echo
Oct 7, 2024 19:26:22.464451075 CEST	192.168.11.30	192.168.11.58	f7c2		Echo
Oct 7, 2024 19:26:22.964335918 CEST	192.168.11.30	192.168.11.59	f7c1		Echo
Oct 7, 2024 19:26:23.464087963 CEST	192.168.11.30	192.168.11.60	f7c0		Echo
Oct 7, 2024 19:26:23.964031935 CEST	192.168.11.30	192.168.11.61	f7bf		Echo
Oct 7, 2024 19:26:24.463970900 CEST	192.168.11.30	192.168.11.62	f7be		Echo
Oct 7, 2024 19:26:24.963933945 CEST	192.168.11.30	192.168.11.63	f7bd		Echo
Oct 7, 2024 19:26:25.463876009 CEST	192.168.11.30	192.168.11.64	f7bc		Echo
Oct 7, 2024 19:26:25.963771105 CEST	192.168.11.30	192.168.11.65	f7bb		Echo
Oct 7, 2024 19:26:26.463577986 CEST	192.168.11.30	192.168.11.66	f7ba		Echo
Oct 7, 2024 19:26:26.963576078 CEST	192.168.11.30	192.168.11.67	f7b9		Echo
Oct 7, 2024 19:26:27.463212967 CEST	192.168.11.30	192.168.11.68	f7b8		Echo
Oct 7, 2024 19:26:27.963475943 CEST	192.168.11.30	192.168.11.69	f7b7		Echo
Oct 7, 2024 19:26:28.463099957 CEST	192.168.11.30	192.168.11.70	f7b6		Echo
Oct 7, 2024 19:26:28.963082075 CEST	192.168.11.30	192.168.11.71	f7b5		Echo
Oct 7, 2024 19:26:29.462950945 CEST	192.168.11.30	192.168.11.72	f7b4		Echo
Oct 7, 2024 19:26:29.962778091 CEST	192.168.11.30	192.168.11.73	f7b3		Echo
Oct 7, 2024 19:26:30.462603092 CEST	192.168.11.30	192.168.11.74	f7b2		Echo
Oct 7, 2024 19:26:30.962483883 CEST	192.168.11.30	192.168.11.75	f7b1		Echo
Oct 7, 2024 19:26:31.462280035 CEST	192.168.11.30	192.168.11.76	f7b0		Echo
Oct 7, 2024 19:26:31.962343931 CEST	192.168.11.30	192.168.11.77	f7af		Echo
Oct 7, 2024 19:26:32.462935925 CEST	192.168.11.30	192.168.11.78	f7ae		Echo
Oct 7, 2024 19:26:32.962460995 CEST	192.168.11.30	192.168.11.79	f7ad		Echo
Oct 7, 2024 19:26:33.461807013 CEST	192.168.11.30	192.168.11.80	f7ac		Echo
Oct 7, 2024 19:26:33.961960077 CEST	192.168.11.30	192.168.11.81	f7ab		Echo
Oct 7, 2024 19:26:34.461726904 CEST	192.168.11.30	192.168.11.82	f7aa		Echo
Oct 7, 2024 19:26:34.961591959 CEST	192.168.11.30	192.168.11.83	f7a9		Echo
Oct 7, 2024 19:26:35.461517096 CEST	192.168.11.30	192.168.11.84	f7a8		Echo
Oct 7, 2024 19:26:35.965408087 CEST	192.168.11.30	192.168.11.85	f7a7		Echo
Oct 7, 2024 19:26:36.461087942 CEST	192.168.11.30	192.168.11.86	f7a6		Echo
Oct 7, 2024 19:26:36.961353064 CEST	192.168.11.30	192.168.11.87	f7a5		Echo
Oct 7, 2024 19:26:37.460978031 CEST	192.168.11.30	192.168.11.88	f7a4		Echo
Oct 7, 2024 19:26:37.961153030 CEST	192.168.11.30	192.168.11.89	f7a3		Echo
Oct 7, 2024 19:26:38.460925102 CEST	192.168.11.30	192.168.11.90	f7a2		Echo
Oct 7, 2024 19:26:38.960680008 CEST	192.168.11.30	192.168.11.91	f7a1		Echo
Oct 7, 2024 19:26:39.460805893 CEST	192.168.11.30	192.168.11.92	f7a0		Echo
Oct 7, 2024 19:26:39.960792065 CEST	192.168.11.30	192.168.11.93	f79f		Echo
Oct 7, 2024 19:26:40.460316896 CEST	192.168.11.30	192.168.11.94	f79e		Echo
Oct 7, 2024 19:26:40.960130930 CEST	192.168.11.30	192.168.11.95	f79d		Echo
Oct 7, 2024 19:26:41.460189104 CEST	192.168.11.30	192.168.11.96	f79c		Echo
Oct 7, 2024 19:26:41.959832907 CEST	192.168.11.30	192.168.11.97	f79b		Echo
Oct 7, 2024 19:26:42.459819078 CEST	192.168.11.30	192.168.11.98	f79a		Echo
Oct 7, 2024 19:26:42.959733009 CEST	192.168.11.30	192.168.11.99	f799		Echo
Oct 7, 2024 19:26:43.459789991 CEST	192.168.11.30	192.168.11.100	f798		Echo
Oct 7, 2024 19:26:43.959567070 CEST	192.168.11.30	192.168.11.101	f797		Echo
Oct 7, 2024 19:26:44.459508896 CEST	192.168.11.30	192.168.11.102	f796		Echo
Oct 7, 2024 19:26:44.959238052 CEST	192.168.11.30	192.168.11.103	f795		Echo
Oct 7, 2024 19:26:45.459239960 CEST	192.168.11.30	192.168.11.104	f794		Echo
Oct 7, 2024 19:26:45.959171057 CEST	192.168.11.30	192.168.11.105	f793		Echo
Oct 7, 2024 19:26:46.458967924 CEST	192.168.11.30	192.168.11.106	f792		Echo
Oct 7, 2024 19:26:46.958985090 CEST	192.168.11.30	192.168.11.107	f791		Echo
Oct 7, 2024 19:26:47.458745003 CEST	192.168.11.30	192.168.11.108	f790		Echo
Oct 7, 2024 19:26:47.958933115 CEST	192.168.11.30	192.168.11.109	f78f		Echo
Oct 7, 2024 19:26:48.458446026 CEST	192.168.11.30	192.168.11.110	f78e		Echo
Oct 7, 2024 19:26:48.958586931 CEST	192.168.11.30	192.168.11.111	f78d		Echo
Oct 7, 2024 19:26:49.458229065 CEST	192.168.11.30	192.168.11.112	f78c		Echo
Oct 7, 2024 19:26:49.958247900 CEST	192.168.11.30	192.168.11.113	f78b		Echo
Oct 7, 2024 19:26:50.458087921 CEST	192.168.11.30	192.168.11.114	f78a		Echo
Oct 7, 2024 19:26:50.958053112 CEST	192.168.11.30	192.168.11.115	f789		Echo
Oct 7, 2024 19:26:51.457890987 CEST	192.168.11.30	192.168.11.116	f788		Echo
Oct 7, 2024 19:26:51.957762003 CEST	192.168.11.30	192.168.11.117	f787		Echo
Oct 7, 2024 19:26:52.457649946 CEST	192.168.11.30	192.168.11.118	f786		Echo
Oct 7, 2024 19:26:52.957710981 CEST	192.168.11.30	192.168.11.119	f785		Echo
Oct 7, 2024 19:26:53.457545996 CEST	192.168.11.30	192.168.11.120	f784		Echo
Oct 7, 2024 19:26:53.957220078 CEST	192.168.11.30	192.168.11.121	f783		Echo
Oct 7, 2024 19:26:54.457273960 CEST	192.168.11.30	192.168.11.122	f782		Echo
Oct 7, 2024 19:26:54.957160950 CEST	192.168.11.30	192.168.11.123	f781		Echo
Oct 7, 2024 19:26:55.457016945 CEST	192.168.11.30	192.168.11.124	f780		Echo
Oct 7, 2024 19:26:55.956945896 CEST	192.168.11.30	192.168.11.125	f77f		Echo
Oct 7, 2024 19:26:56.456799984 CEST	192.168.11.30	192.168.11.126	f77e		Echo
Oct 7, 2024 19:26:56.972331047 CEST	192.168.11.30	192.168.11.127	f77d		Echo
Oct 7, 2024 19:26:57.472012997 CEST	192.168.11.30	192.168.11.128	f77c		Echo
Oct 7, 2024 19:26:57.972373009 CEST	192.168.11.30	192.168.11.129	f77b		Echo
Oct 7, 2024 19:26:58.471988916 CEST	192.168.11.30	192.168.11.130	f77a		Echo
Oct 7, 2024 19:26:58.971770048 CEST	192.168.11.30	192.168.11.131	f779		Echo
Oct 7, 2024 19:26:59.471739054 CEST	192.168.11.30	192.168.11.132	f778		Echo
Oct 7, 2024 19:26:59.971580982 CEST	192.168.11.30	192.168.11.133	f777		Echo
Oct 7, 2024 19:27:00.471568108 CEST	192.168.11.30	192.168.11.134	f776		Echo
Oct 7, 2024 19:27:00.971239090 CEST	192.168.11.30	192.168.11.135	f775		Echo
Oct 7, 2024 19:27:01.471301079 CEST	192.168.11.30	192.168.11.136	f774		Echo
Oct 7, 2024 19:27:01.971149921 CEST	192.168.11.30	192.168.11.137	f773		Echo
Oct 7, 2024 19:27:02.471012115 CEST	192.168.11.30	192.168.11.138	f772		Echo
Oct 7, 2024 19:27:02.970863104 CEST	192.168.11.30	192.168.11.139	f771		Echo
Oct 7, 2024 19:27:03.470710039 CEST	192.168.11.30	192.168.11.140	f770		Echo
Oct 7, 2024 19:27:03.970716000 CEST	192.168.11.30	192.168.11.141	f76f		Echo
Oct 7, 2024 19:27:04.470582962 CEST	192.168.11.30	192.168.11.142	f76e		Echo
Oct 7, 2024 19:27:04.970426083 CEST	192.168.11.30	192.168.11.143	f76d		Echo
Oct 7, 2024 19:27:05.470356941 CEST	192.168.11.30	192.168.11.144	f76c		Echo
Oct 7, 2024 19:27:05.970114946 CEST	192.168.11.30	192.168.11.145	f76b		Echo
Oct 7, 2024 19:27:06.470164061 CEST	192.168.11.30	192.168.11.146	f76a		Echo
Oct 7, 2024 19:27:06.969995975 CEST	192.168.11.30	192.168.11.147	f769		Echo
Oct 7, 2024 19:27:07.469916105 CEST	192.168.11.30	192.168.11.148	f768		Echo
Oct 7, 2024 19:27:07.969917059 CEST	192.168.11.30	192.168.11.149	f767		Echo
Oct 7, 2024 19:27:08.469635010 CEST	192.168.11.30	192.168.11.150	f766		Echo
Oct 7, 2024 19:27:08.969543934 CEST	192.168.11.30	192.168.11.151	f765		Echo
Oct 7, 2024 19:27:09.469316959 CEST	192.168.11.30	192.168.11.152	f764		Echo
Oct 7, 2024 19:27:09.969306946 CEST	192.168.11.30	192.168.11.153	f763		Echo
Oct 7, 2024 19:27:10.469139099 CEST	192.168.11.30	192.168.11.154	f762		Echo
Oct 7, 2024 19:27:10.969136953 CEST	192.168.11.30	192.168.11.155	f761		Echo
Oct 7, 2024 19:27:11.469053984 CEST	192.168.11.30	192.168.11.156	f760		Echo
Oct 7, 2024 19:27:11.969105005 CEST	192.168.11.30	192.168.11.157	f75f		Echo
Oct 7, 2024 19:27:12.468724012 CEST	192.168.11.30	192.168.11.158	f75e		Echo
Oct 7, 2024 19:27:12.968619108 CEST	192.168.11.30	192.168.11.159	f75d		Echo
Oct 7, 2024 19:27:13.468444109 CEST	192.168.11.30	192.168.11.160	f75c		Echo
Oct 7, 2024 19:27:13.968502998 CEST	192.168.11.30	192.168.11.161	f75b		Echo
Oct 7, 2024 19:27:14.468295097 CEST	192.168.11.30	192.168.11.162	f75a		Echo
Oct 7, 2024 19:27:14.968209028 CEST	192.168.11.30	192.168.11.163	f759		Echo
Oct 7, 2024 19:27:15.468049049 CEST	192.168.11.30	192.168.11.164	f758		Echo
Oct 7, 2024 19:27:15.967992067 CEST	192.168.11.30	192.168.11.165	f757		Echo
Oct 7, 2024 19:27:16.467943907 CEST	192.168.11.30	192.168.11.166	f756		Echo
Oct 7, 2024 19:27:16.967660904 CEST	192.168.11.30	192.168.11.167	f755		Echo
Oct 7, 2024 19:27:17.468074083 CEST	192.168.11.30	192.168.11.168	f754		Echo
Oct 7, 2024 19:27:17.967614889 CEST	192.168.11.30	192.168.11.169	f753		Echo
Oct 7, 2024 19:27:18.467262983 CEST	192.168.11.30	192.168.11.170	f752		Echo
Oct 7, 2024 19:27:18.967318058 CEST	192.168.11.30	192.168.11.171	f751		Echo
Oct 7, 2024 19:27:19.467056990 CEST	192.168.11.30	192.168.11.172	f750		Echo
Oct 7, 2024 19:27:19.967006922 CEST	192.168.11.30	192.168.11.173	f74f		Echo
Oct 7, 2024 19:27:20.466886997 CEST	192.168.11.30	192.168.11.174	f74e		Echo
Oct 7, 2024 19:27:20.967175961 CEST	192.168.11.30	192.168.11.175	f74d		Echo
Oct 7, 2024 19:27:21.466566086 CEST	192.168.11.30	192.168.11.176	f74c		Echo
Oct 7, 2024 19:27:21.966696978 CEST	192.168.11.30	192.168.11.177	f74b		Echo
Oct 7, 2024 19:27:22.466376066 CEST	192.168.11.30	192.168.11.178	f74a		Echo
Oct 7, 2024 19:27:22.966404915 CEST	192.168.11.30	192.168.11.179	f749		Echo
Oct 7, 2024 19:27:23.466417074 CEST	192.168.11.30	192.168.11.180	f748		Echo
Oct 7, 2024 19:27:23.966043949 CEST	192.168.11.30	192.168.11.181	f747		Echo
Oct 7, 2024 19:27:24.466078043 CEST	192.168.11.30	192.168.11.182	f746		Echo
Oct 7, 2024 19:27:24.965948105 CEST	192.168.11.30	192.168.11.183	f745		Echo
Oct 7, 2024 19:27:25.465781927 CEST	192.168.11.30	192.168.11.184	f744		Echo
Oct 7, 2024 19:27:25.965652943 CEST	192.168.11.30	192.168.11.185	f743		Echo
Oct 7, 2024 19:27:26.465538025 CEST	192.168.11.30	192.168.11.186	f742		Echo
Oct 7, 2024 19:27:26.965476036 CEST	192.168.11.30	192.168.11.187	f741		Echo
Oct 7, 2024 19:27:27.465379953 CEST	192.168.11.30	192.168.11.188	f740		Echo
Oct 7, 2024 19:27:27.965190887 CEST	192.168.11.30	192.168.11.189	f73f		Echo
Oct 7, 2024 19:27:28.465221882 CEST	192.168.11.30	192.168.11.190	f73e		Echo
Oct 7, 2024 19:27:28.964895010 CEST	192.168.11.30	192.168.11.191	f73d		Echo
Oct 7, 2024 19:27:29.464957952 CEST	192.168.11.30	192.168.11.192	f73c		Echo
Oct 7, 2024 19:27:29.964713097 CEST	192.168.11.30	192.168.11.193	f73b		Echo
Oct 7, 2024 19:27:30.464622974 CEST	192.168.11.30	192.168.11.194	f73a		Echo
Oct 7, 2024 19:27:30.964633942 CEST	192.168.11.30	192.168.11.195	f739		Echo
Oct 7, 2024 19:27:31.464413881 CEST	192.168.11.30	192.168.11.196	f738		Echo
Oct 7, 2024 19:27:31.964245081 CEST	192.168.11.30	192.168.11.197	f737		Echo
Oct 7, 2024 19:27:32.464148045 CEST	192.168.11.30	192.168.11.198	f736		Echo
Oct 7, 2024 19:27:32.964262009 CEST	192.168.11.30	192.168.11.199	f735		Echo
Oct 7, 2024 19:27:33.463892937 CEST	192.168.11.30	192.168.11.200	f734		Echo
Oct 7, 2024 19:27:33.964134932 CEST	192.168.11.30	192.168.11.201	f733		Echo
Oct 7, 2024 19:27:34.463797092 CEST	192.168.11.30	192.168.11.202	f732		Echo
Oct 7, 2024 19:27:34.963623047 CEST	192.168.11.30	192.168.11.203	f731		Echo
Oct 7, 2024 19:27:35.463483095 CEST	192.168.11.30	192.168.11.204	f730		Echo
Oct 7, 2024 19:27:35.963659048 CEST	192.168.11.30	192.168.11.205	f72f		Echo
Oct 7, 2024 19:27:36.463201046 CEST	192.168.11.30	192.168.11.206	f72e		Echo
Oct 7, 2024 19:27:36.963340998 CEST	192.168.11.30	192.168.11.207	f72d		Echo
Oct 7, 2024 19:27:37.463056087 CEST	192.168.11.30	192.168.11.208	f72c		Echo
Oct 7, 2024 19:27:37.963104963 CEST	192.168.11.30	192.168.11.209	f72b		Echo
Oct 7, 2024 19:27:38.462985992 CEST	192.168.11.30	192.168.11.210	f72a		Echo
Oct 7, 2024 19:27:38.962801933 CEST	192.168.11.30	192.168.11.211	f729		Echo
Oct 7, 2024 19:27:39.462788105 CEST	192.168.11.30	192.168.11.212	f728		Echo
Oct 7, 2024 19:27:39.962459087 CEST	192.168.11.30	192.168.11.213	f727		Echo
Oct 7, 2024 19:27:40.462352991 CEST	192.168.11.30	192.168.11.214	f726		Echo
Oct 7, 2024 19:27:40.962378025 CEST	192.168.11.30	192.168.11.215	f725		Echo
Oct 7, 2024 19:27:41.462018967 CEST	192.168.11.30	192.168.11.216	f724		Echo
Oct 7, 2024 19:27:41.961962938 CEST	192.168.11.30	192.168.11.217	f723		Echo
Oct 7, 2024 19:27:42.461996078 CEST	192.168.11.30	192.168.11.218	f722		Echo
Oct 7, 2024 19:27:42.962003946 CEST	192.168.11.30	192.168.11.219	f721		Echo
Oct 7, 2024 19:27:43.461616039 CEST	192.168.11.30	192.168.11.220	f720		Echo
Oct 7, 2024 19:27:43.961668015 CEST	192.168.11.30	192.168.11.221	f71f		Echo
Oct 7, 2024 19:27:44.461699009 CEST	192.168.11.30	192.168.11.222	f71e		Echo
Oct 7, 2024 19:27:44.961333036 CEST	192.168.11.30	192.168.11.223	f71d		Echo
Oct 7, 2024 19:27:45.461194992 CEST	192.168.11.30	192.168.11.224	f71c		Echo
Oct 7, 2024 19:27:45.961189985 CEST	192.168.11.30	192.168.11.225	f71b		Echo
Oct 7, 2024 19:27:46.460894108 CEST	192.168.11.30	192.168.11.226	f71a		Echo
Oct 7, 2024 19:27:46.960860014 CEST	192.168.11.30	192.168.11.227	f719		Echo
Oct 7, 2024 19:27:47.460799932 CEST	192.168.11.30	192.168.11.228	f718		Echo
Oct 7, 2024 19:27:47.960886955 CEST	192.168.11.30	192.168.11.229	f717		Echo
Oct 7, 2024 19:27:48.461312056 CEST	192.168.11.30	192.168.11.230	f716		Echo
Oct 7, 2024 19:27:48.960299015 CEST	192.168.11.30	192.168.11.231	f715		Echo

HTTP Request Dependency Graph

nexusrules.officeapps.live.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.30	49773	52.111.227.14	443

Timestamp	Bytes transferred	Direction	Data
2024-10-07 17:27:37 UTC	621	OUT	GET /nexus/rules?Application=officeclicktorun.exe&Version=16.0.14326.20384&ClientId=%7bB0D7ECDF-3EEF-4767-BB67-27861CCFA721%7d&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.14326.20384& HTTP/1.1 Connection: Keep-Alive Accept: application/vnd.ms-nexus-rules-v16+xml Accept-Encoding: gzip If-Modified-Since: Mon, 07 Oct 2024 14:16:33 GMT User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.14326; Pro) X-MS-Collection-Policy: ExternalRestrictive, Heartbeat X-MS-Process-Session-Id: {7E978EA8-AD6B-4BED-887D-8CF0E69AE9DF} Host: nexusrules.officeapps.live.com
2024-10-07 17:27:37 UTC	377	IN	HTTP/1.1 304 Not Modified Cache-Control: max-age=7200 Server: Microsoft-IIS/10.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Content-Type-Options: nosniff Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Methods: POST, OPTIONS Access-Control-Max-Age: 300 Date: Mon, 07 Oct 2024 17:27:36 GMT Connection: close

Target ID:	0
Start time:	13:25:41
Start date:	07/10/2024
Path:	C:\Users\user\Desktop\2005.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2005.exe"
Imagebase:	0x400000
File size:	141'312 bytes
MD5 hash:	940C75B80536E5C7D686C5847C51AD2B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:25:43
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic.exe SHADOWCOPY /nointeractive
Imagebase:	0x8d0000
File size:	393'216 bytes
MD5 hash:	82BB8430531876FBF5266E53460A393E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:25:43
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff621e40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:25:44
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic.exe SHADOWCOPY /nointeractive
Imagebase:	0x8d0000
File size:	393'216 bytes
MD5 hash:	82BB8430531876FBF5266E53460A393E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:25:44
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff621e40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:25:44
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic.exe SHADOWCOPY /nointeractive
Imagebase:	0x8d0000
File size:	393'216 bytes
MD5 hash:	82BB8430531876FBF5266E53460A393E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:25:44
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff621e40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:25:45
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic.exe SHADOWCOPY /nointeractive
Imagebase:	0x8d0000
File size:	393'216 bytes
MD5 hash:	82BB8430531876FBF5266E53460A393E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:25:45
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff621e40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:25:45
Start date:	07/10/2024
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	wmic.exe SHADOWCOPY /nointeractive
Imagebase:	0x8d0000
File size:	393'216 bytes
MD5 hash:	82BB8430531876FBF5266E53460A393E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:25:45
Start date:	07/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff621e40000
File size:	875'008 bytes
MD5 hash:	81CA40085FC75BABD2C91D18AA9FFA68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	18

Executed Functions

Function 0040586B Relevance: 10.6, APIs: 7, Instructions: 78
memoryencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0040589D
GetProcessHeap.KERNEL32(?,?,00404D0A,00420A00,00000000,?,?,?,00407EA5), ref: 004058AB
HeapAlloc.KERNEL32(00000000,00000000,00000000,?,00404D0A,00420A00,00000000,?,?,?,00407EA5), ref: 004058B5
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00000000,00000000,00000000), ref: 004058D6
CryptImportKey.ADVAPI32(00000000,00000000,00000000,00000000,00421CE4,?,00404D0A,00420A00,00000000,?,?,?,00407EA5), ref: 004058F3
GetProcessHeap.KERNEL32(00000000,00000000,?,00404D0A,00420A00,00000000,?,?,?,00407EA5), ref: 00405907
HeapFree.KERNEL32(00000000,?,00404D0A,00420A00,00000000,?,?,?,00407EA5), ref: 0040590E

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: Heap$Crypt$BinaryProcessString$AllocFreeImport
String ID:
API String ID: 1508550536-0
Opcode ID: 53619cda189428386aca9b25516d7491a2d39248ea53332db8a5ad76fbc17b2b
Instruction ID: 24f612b98663348e8784ea9eb55ba291739453d06b5f9032acc871df447b646b
Opcode Fuzzy Hash: 53619cda189428386aca9b25516d7491a2d39248ea53332db8a5ad76fbc17b2b
Instruction Fuzzy Hash: 9211F072600614FFEB148B959D49FAB7BBCEB89750F11403AB501E3090EBB0AD048A78

Function 004078AF Relevance: 10.6, APIs: 7, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00421D14,?,00000000), ref: 004078DB
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00407914
OpenProcess.KERNEL32(00000001,00000000,?,?), ref: 0040794F
Process32NextW.KERNEL32(00000000,0000022C), ref: 00407963
TerminateProcess.KERNEL32(00000000,00000000), ref: 00407978
CloseHandle.KERNEL32(00000000), ref: 0040797F
CloseHandle.KERNEL32(00000000), ref: 0040798A

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 3fe4ff30f13f195c409f1d5b257021270d961209ea7afd431588fb590eb91ebb
Instruction ID: ec4c2be1fbd78b9665883bc86cf3e029f6cba2b89b42e070193e7de9b2861720
Opcode Fuzzy Hash: 3fe4ff30f13f195c409f1d5b257021270d961209ea7afd431588fb590eb91ebb
Instruction Fuzzy Hash: 4C21D871D00218ABE710EF64DC4DBEEB778AF49305F10407EE905B22C1DB78AA498A5D

Function 00406884 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenMutexA.KERNEL32(001F0001,00000000,00000000), ref: 004068C4
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 004068D9

Strings

xqh, xrefs: 00406993
-nolan, xrefs: 0040690D

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: Mutex$CreateOpen
String ID: -nolan$xqh
API String ID: 4030545807-1828756265
Opcode ID: 1afb3f5575571828dc7466b67fa3a4eceae8f4e5cadc897d3b20c0f0bf4b1564
Instruction ID: a839bbbcade8483fe9c700ab46a19453fd295481894b0e78b12f54372173810b
Opcode Fuzzy Hash: 1afb3f5575571828dc7466b67fa3a4eceae8f4e5cadc897d3b20c0f0bf4b1564
Instruction Fuzzy Hash: 9441C6726483109BC714FB62D95246F73A4AE90318B518A3FF897331D2EF38AD05C69E

Function 00404C82 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00421CE8,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,F0000000,00000000,?,?,?,00407EA5), ref: 00404CC0
GetLastError.KERNEL32(?,?,?,00407EA5), ref: 00404CCA
CryptAcquireContextW.ADVAPI32(00421CE8,00000000,Microsoft Enhanced Cryptographic Provider v1.0,00000001,00000008,?,?,?,00407EA5), ref: 00404CE6

Strings

Microsoft Enhanced Cryptographic Provider v1.0, xrefs: 00404CB4, 00404CDA

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: AcquireContextCrypt$ErrorLast
String ID: Microsoft Enhanced Cryptographic Provider v1.0
API String ID: 2779411412-1948191093
Opcode ID: b1fe9769fefd453862c1c6c7a6c6d47bcd7ac0e857984d103ba3b4c52f578ece
Instruction ID: d028f23a44fcd6ccbb88c2e92224846d38b662e38b4e3d8e02364abebfa0a26d
Opcode Fuzzy Hash: b1fe9769fefd453862c1c6c7a6c6d47bcd7ac0e857984d103ba3b4c52f578ece
Instruction Fuzzy Hash: 601129B07C03047AE710EBB2AC82BAB3794AB2074AFA0403EF542B71D2DE7C5949851C

Function 004061A6 Relevance: 6.1, APIs: 4, Instructions: 112
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,0000001C), ref: 004061FC
PostQueuedCompletionStatus.KERNEL32(00000000,00000001,00000000,?), ref: 004062ED
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,0000001C), ref: 00406313
FindClose.KERNEL32(00000000,?,?,?,?,?,0000001C), ref: 00406322

Part of subcall function 0040636E: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,00421D20,?,?,00421CFC,0000005C,004062B4), ref: 004064D1

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: FileFind$CloseCompletionCreateFirstNextPostQueuedStatus
String ID:
API String ID: 3918756745-0
Opcode ID: 0d9c8b8d54b67b9f81cd2b64c2635d896f49dc493f31413f853867dc48341884
Instruction ID: b61abdde34f1d8918cf0b34a5064c53ec76b5548b8a74bf0613d2380c30dda15
Opcode Fuzzy Hash: 0d9c8b8d54b67b9f81cd2b64c2635d896f49dc493f31413f853867dc48341884
Instruction Fuzzy Hash: 6041C371900308ABDB14EBB4CC99BDE7778AB09314F1105BEE402B71D1DF785A88CA59

Function 00406E73 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetAdaptersInfo.IPHLPAPI(00000000,Kl@), ref: 00406EB9
GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 00406EDB

Strings

Kl@, xrefs: 00406EB4, 00406EB7

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: AdaptersInfo
String ID: Kl@
API String ID: 3177971545-1008393736
Opcode ID: c69838f609e12148ff33035ba875fc31310c67324918907be8e57eeb52405c49
Instruction ID: c45767da4a1ae1a37a9a8c3c98f5d99c3859e578514dac4b87f93e37f4f093af
Opcode Fuzzy Hash: c69838f609e12148ff33035ba875fc31310c67324918907be8e57eeb52405c49
Instruction Fuzzy Hash: E9217E75C012599ECB11EFA5C880ADEBBB8AF14304F55007EE805BB281EB389E068B58

Function 00407E01 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,0000002C,00406993,00421CF0,00421D14), ref: 00407E1B
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,?), ref: 00407E2E

Strings

pool, xrefs: 00407E6C

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CompletionCreateInfoPortSystem
String ID: pool
API String ID: 463844942-2945558918
Opcode ID: 64f475ab8dd3e9c8eacaa56cfd641747fa232da1d64999fd2cec5314c4f10987
Instruction ID: ad598524c5aff2629dbff6396a65b074fa3f3b1567342d470c7d3538793e577b
Opcode Fuzzy Hash: 64f475ab8dd3e9c8eacaa56cfd641747fa232da1d64999fd2cec5314c4f10987
Instruction Fuzzy Hash: 9011B2B5D01208AEDB10EBB9CD85ADE7778AF44328F11422EF514772D1DB385E048AA9

Function 004077F2 Relevance: 4.5, APIs: 3, Instructions: 24COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,00406901), ref: 00407801
CheckRemoteDebuggerPresent.KERNEL32(00000000,?,?,00406901), ref: 00407808
IsDebuggerPresent.KERNEL32(?,?,00406901), ref: 00407818

Part of subcall function 00407831: GetCurrentThread.KERNEL32 ref: 0040786D
Part of subcall function 00407831: GetThreadContext.KERNEL32(00000000,?,?,00000001), ref: 00407874

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CurrentDebuggerPresentThread$CheckContextProcessRemote
String ID:
API String ID: 3297751945-0
Opcode ID: 1b8e5cd35d4bf145a616212d4473679b1e3780f875176ebf89d885f9044e7d14
Instruction ID: 3d1c66871d82d7627a436d692c52b267b8690093e928ec34b6260828055772f3
Opcode Fuzzy Hash: 1b8e5cd35d4bf145a616212d4473679b1e3780f875176ebf89d885f9044e7d14
Instruction Fuzzy Hash: CAE0B871E042089BDF10ABA1990D6DE7FAC9B0574DB01807AE605F2290DA75D909D5BA

Function 00405B1C Relevance: 3.1, APIs: 2, Instructions: 93encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00405AF7: CryptEncrypt.ADVAPI32(00688268,00000000,00000001,00000000,00000000,?,00000000,?,00405B38,?,00000054,00404D98,000000C4,004080BD), ref: 00405B0D

CryptEncrypt.ADVAPI32(00000000,00000001,00000000,?,?,00000000,00000000,?,?,00000000,?,?,00000054,00404D98,000000C4,004080BD), ref: 00405BB9
CryptEncrypt.ADVAPI32(00000000,00000001,00000000,?,?,00000000,?,?,00000000,?,?,00000054,00404D98,000000C4,004080BD), ref: 00405BE2

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CryptEncrypt
String ID:
API String ID: 1352496322-0
Opcode ID: c9c953cb17abde5cb2597d407bf7eb53a68be51ba1ff65b877813087a012e45b
Instruction ID: 6b9cbda9d5acb3dd9f4eccc693b857bd6da7a7470ebd1bef19bbc6a25475f49d
Opcode Fuzzy Hash: c9c953cb17abde5cb2597d407bf7eb53a68be51ba1ff65b877813087a012e45b
Instruction Fuzzy Hash: 2C315B319047089BEB14EBA6CC92EEEB3B4EF14304F50452EE102761E1EB75BA49CF18

Function 004079A1 Relevance: 19.6, APIs: 13, Instructions: 137
servicesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004079B7
OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,?,00406979,00421CF0,00421D14), ref: 004079D0
OpenServiceW.ADVAPI32(00000000,?,0000002C,00421D14,?,?,?,?,?,?,?,00406979,00421CF0,00421D14), ref: 004079EE
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?,?,?,?,?,?,?,?,00406979,00421CF0,00421D14), ref: 00407A1D
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00406979,00421CF0,00421D14), ref: 00407A2D
Sleep.KERNEL32(00421D14), ref: 00407A5A
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00407A6C
GetTickCount.KERNEL32 ref: 00407A78
ControlService.ADVAPI32(00000000,00000001,?), ref: 00407AA3
Sleep.KERNEL32(000003E8), ref: 00407AB8
QueryServiceStatusEx.ADVAPI32(00000000,00000000,?,00000024,?), ref: 00407ACA
GetTickCount.KERNEL32 ref: 00407ADA
CloseServiceHandle.ADVAPI32(?,?,?,?,?,?,?,?,00406979,00421CF0,00421D14), ref: 00407B04

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: Service$CountQueryStatusTick$CloseHandleOpenSleep$ControlManager
String ID:
API String ID: 165667597-0
Opcode ID: 9cd21c8cb574b97a095e8b9b53c1d1ed3664ea59b04b66f768d9279f641989db
Instruction ID: dc926e465e525939270f7389626a3e6bce0eef69444ec8ab64a158fcd7c11c1a
Opcode Fuzzy Hash: 9cd21c8cb574b97a095e8b9b53c1d1ed3664ea59b04b66f768d9279f641989db
Instruction Fuzzy Hash: 40416271E04209EFDB14DBA4DC889EE77B9EB09714B14403BE501F2280DB38EE45CB6A

Function 00405031 Relevance: 15.2, APIs: 10, Instructions: 161
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000,?,00000000,00000000), ref: 00405064
GetFileSizeEx.KERNEL32(00000000,00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000,?,00000000,00000000), ref: 00405083
ReadFile.KERNEL32(00000000,?,?,?,00000000), ref: 004050D1
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 004050F8
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00405135
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002), ref: 0040515B
WriteFile.KERNEL32(00000000,00000070,?,00000000,00000000), ref: 0040517F
WriteFile.KERNEL32(00000000,00000000,00000018,00000000,00000000), ref: 004051C4
CloseHandle.KERNEL32(00000000), ref: 004051D6
CloseHandle.KERNEL32(00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000,?,00000000,00000000), ref: 004051E8

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: File$Write$CloseHandlePointer$CreateReadSize
String ID:
API String ID: 1995973412-0
Opcode ID: 3a780d6f0a759eff6049de7a31538665c1951bfd50f2d103e02f3acc6bb2dadf
Instruction ID: 2c6a66ffaae7e8d2e9b5d58dc662656a3f0f463566a58fd57bd88963383faf80
Opcode Fuzzy Hash: 3a780d6f0a759eff6049de7a31538665c1951bfd50f2d103e02f3acc6bb2dadf
Instruction Fuzzy Hash: 3A514870508745AFD714DF24C884AABBBE8FF89344F40893EF59596290DB74D908CFAA

Function 00403137 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,00420A48,0000000A), ref: 00403225
WriteFile.KERNEL32(00000000,`ei,?,00000000,?,?,?,?,?,?,?,?,0041D448,?,0000006C,004080C9), ref: 00403255
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,0041D448,?,0000006C,004080C9), ref: 0040325C

Strings

`ei, xrefs: 00403244, 00403253
HB, xrefs: 004031D9

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: HB$`ei
API String ID: 1065093856-574847352
Opcode ID: 60be18121ede553b72e75928a324d75a15940a288ae9e3795e0b83deb344acc9
Instruction ID: 455985c7049ea5b1d878ef94252815b09b56262622778f28894c42be8e6cc2cd
Opcode Fuzzy Hash: 60be18121ede553b72e75928a324d75a15940a288ae9e3795e0b83deb344acc9
Instruction Fuzzy Hash: 2E315FB1900204DBDB24DFA9DC45AEE7BB8FB44305F60813EE41173192DB385A46CB58

Function 00407BF3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,N{@,00000000,00000000,00000001,08000000,00000000,00000000,?,?,00421D14,00000005,00000000), ref: 00407C3B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00407C4A
CloseHandle.KERNEL32(?), ref: 00407C59
CloseHandle.KERNEL32(?), ref: 00407C5E

Strings

N{@, xrefs: 00407BFB, 00407C39

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CloseHandle$CreateObjectProcessSingleWait
String ID: N{@
API String ID: 2059082233-1062377589
Opcode ID: 601f9026b7ae67319979221274e4e4928585e7558450e13ba34cbde776ec3494
Instruction ID: 3504c94b6fcb350dbc16d2aabd5861b8b9eed35038243f90cda8dc2c6c3a0d2c
Opcode Fuzzy Hash: 601f9026b7ae67319979221274e4e4928585e7558450e13ba34cbde776ec3494
Instruction Fuzzy Hash: E801927290421DBFEB109BE4DDC5DEBB77CEB04354B100536B611B3190D671AE058AB6

Function 004076E4 Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RmStartSession.RSTRTMGR(000000FF,00000000,?), ref: 0040771F
RmRegisterResources.RSTRTMGR(000000FF,00000001,?,00000000,00000000,00000000,00000000), ref: 00407745
RmGetList.RSTRTMGR(000000FF,?,?,00000000,?,?), ref: 00407771
RmShutdown.RSTRTMGR(000000FF,00000000,00000000), ref: 004077C3
RmEndSession.RSTRTMGR(000000FF), ref: 004077DD

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: Session$ListRegisterResourcesShutdownStart
String ID:
API String ID: 3313306159-0
Opcode ID: 44665d021b652178b6c6fd1e60e2239812aec9082ed8b9014769fe1beee14897
Instruction ID: 259d33f2b138bc8b9e6f06b18748931b952373d0b18a4dff8ccb4156159aa4c1
Opcode Fuzzy Hash: 44665d021b652178b6c6fd1e60e2239812aec9082ed8b9014769fe1beee14897
Instruction Fuzzy Hash: B7317E72D04218ABDB149FE5DC849EEBBBCEF04354B10813FE512F7294DB34AD068A59

Function 00406F62 Relevance: 7.6, APIs: 5, Instructions: 70
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402025: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00402066
Part of subcall function 00402025: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0000024C), ref: 004020A2

inet_addr.WS2_32(?), ref: 00406F9E
IcmpCreateFile.IPHLPAPI(?,00000000,00000000), ref: 00406FAB
IcmpSendEcho.IPHLPAPI(00000000,00000000,00000000,00000001,00000000,00000000,0000001D,?), ref: 00406FDA
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00406FE3
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00407000

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: Icmp$ByteCharCloseHandleMultiWide$CreateEchoFileSendinet_addr
String ID:
API String ID: 2876385541-0
Opcode ID: eb2a3824b5728ed5b5f9ab0b5048b4e2339f3fd4def068fd122cdff8197f356b
Instruction ID: 486a46997ce3b2bb318674a2cd1b47140379ccea37a73e910e2f34aefacc3b93
Opcode Fuzzy Hash: eb2a3824b5728ed5b5f9ab0b5048b4e2339f3fd4def068fd122cdff8197f356b
Instruction Fuzzy Hash: BC110831D002099BDB24ABA5DC88BEF77B89F08324F20453EE412B31D1CB785949CB58

Function 0040636E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 170
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,00421D20,?,?,00421CFC,0000005C,004062B4), ref: 004064D1
GetFileSizeEx.KERNEL32(00000000,?,?,80000000,00000000,00000000,00000003,00000080,00000000,00421D20,?,?,00421CFC,0000005C,004062B4), ref: 004064E9

Strings

.dice, xrefs: 004063D8

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: File$CreateSize
String ID: .dice
API String ID: 2791376181-949574448
Opcode ID: 90ba33a6392a8ff0b103442afd84f74e7c66af748dbe72f4790387cfca0b7c06
Instruction ID: 02252f215a139982b39ba8c216d943c37d501e698b3122c631d3eb1f36dac902
Opcode Fuzzy Hash: 90ba33a6392a8ff0b103442afd84f74e7c66af748dbe72f4790387cfca0b7c06
Instruction Fuzzy Hash: 8A51ADB1D00309AACF10EFA8EC956EEB775AB10318F15013BE812772C5DB785E95CA5D

Function 00404D3F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F22: CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,000000FF,.dice,0041D504,?,0000005C,00404D76,000000C4), ref: 00404FAD
Part of subcall function 00404F22: SetFilePointerEx.KERNEL32(00000000,-000000E8,00000000,?,00000002,?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,000000FF,.dice), ref: 00404FE9
Part of subcall function 00404F22: ReadFile.KERNEL32(00000000,?,00000018,?,00000000,?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,000000FF,.dice), ref: 00405002
Part of subcall function 00404F22: CloseHandle.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,000000FF,.dice,0041D504,?,0000005C,00404D76), ref: 0040501F

Part of subcall function 00405B1C: CryptEncrypt.ADVAPI32(00000000,00000001,00000000,?,?,00000000,00000000,?,?,00000000,?,?,00000054,00404D98,000000C4,004080BD), ref: 00405BB9
Part of subcall function 00405B1C: CryptEncrypt.ADVAPI32(00000000,00000001,00000000,?,?,00000000,?,?,00000000,?,?,00000054,00404D98,000000C4,004080BD), ref: 00405BE2

GetFileAttributesW.KERNEL32(?,000000C4,004080BD), ref: 00404E12
SetFileAttributesW.KERNEL32(?,00000000,?,000000C4,004080BD), ref: 00404E26
MoveFileExW.KERNEL32(?,?,00000001,00000000,?,?,00000000,.dice,?,00000000,?,000000C4,004080BD), ref: 00404EC1

Strings

.dice, xrefs: 00404E74

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: File$AttributesCryptEncrypt$CloseCreateHandleMovePointerRead
String ID: .dice
API String ID: 3366520816-949574448
Opcode ID: 2014d8994ab7624db6600b60e6a3248b58f1b5c7353cb60f516d1e82eace98b1
Instruction ID: d4465723ac733e5112aca98955eefd99520e90331a6e6ed021b2022014b3d520
Opcode Fuzzy Hash: 2014d8994ab7624db6600b60e6a3248b58f1b5c7353cb60f516d1e82eace98b1
Instruction Fuzzy Hash: CC417DB0A002148BDF20EB69D951BEEB3B5AF94304F10457FE502732D1DB3C6E49CAA9

Function 00407244 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 00407338: inet_addr.WS2_32(00000000), ref: 004073A3
Part of subcall function 00407338: htons.WS2_32(00006987), ref: 004073BF
Part of subcall function 00407338: getnameinfo.WS2_32(?,00000010,?,00000401,?,00000020,00000008), ref: 00407405

NetDfsEnum.NETAPI32(?,0000012C,000000FF,?,?,?,?,?,0000003C,00000001,0041D504), ref: 0040729F
NetApiBufferFree.NETAPI32(?,?,0000003C,00000001,0041D504), ref: 004072E6
NetDfsEnum.NETAPI32(?,00000003,000000FF,?,?,?,?,0000003C,00000001,0041D504), ref: 00407308

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: Enum$BufferFreegetnameinfohtonsinet_addr
String ID:
API String ID: 3856554055-0
Opcode ID: b7f8f1eec9ac096dca464c313e43a56ecbf74ee638871c39c28c0d5cef1d6803
Instruction ID: e2b1322491d51ef5fa6085116c176174a3ce8d50c5d2c1c29f015c3395c840c8
Opcode Fuzzy Hash: b7f8f1eec9ac096dca464c313e43a56ecbf74ee638871c39c28c0d5cef1d6803
Instruction Fuzzy Hash: 4A3135B2D10218ABCF04EFE9D9849DEBB79BF08314F20812EF511B3281DB346A05CB64

Function 00407338 Relevance: 4.6, APIs: 3, Instructions: 81networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00402025: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00402066
Part of subcall function 00402025: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,0000024C), ref: 004020A2

inet_addr.WS2_32(00000000), ref: 004073A3
htons.WS2_32(00006987), ref: 004073BF
getnameinfo.WS2_32(?,00000010,?,00000401,?,00000020,00000008), ref: 00407405

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ByteCharMultiWide$getnameinfohtonsinet_addr
String ID:
API String ID: 2206823682-0
Opcode ID: 046cc9e68e4cc3ab1b0af5108a1543f1c1fa485a5daba334d07a7088f9605dc3
Instruction ID: 28bdfe9df9237e96c4eaba3d1dd88fe5f69f34c2d3970a56581e34856fbe6ca5
Opcode Fuzzy Hash: 046cc9e68e4cc3ab1b0af5108a1543f1c1fa485a5daba334d07a7088f9605dc3
Instruction Fuzzy Hash: 2A3163B0D002189ADB20EF65CD85BDDB778AF58304F5084EBA608B7192EB745B88CF5D

Function 0040C6D8 Relevance: 4.5, APIs: 3, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040E0E6: GetLastError.KERNEL32(?,?,?,0040C0B5,0040EB78,?,?,0040D4AB), ref: 0040E0EB
Part of subcall function 0040E0E6: SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0040C0B5,0040EB78,?,?,0040D4AB), ref: 0040E189

CloseHandle.KERNEL32(?,?,?,0040C80F,?,?,0040C681,00000000), ref: 0040C709
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,0040C80F,?,?,0040C681,00000000), ref: 0040C71F
ExitThread.KERNEL32 ref: 0040C728

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary
String ID:
API String ID: 1991824761-0
Opcode ID: 45b07ed32337fb3dbd351a06c6c86db09922f1748a5c9275a47fb70b1538d830
Instruction ID: 3d3b211d80397b4c8f5186368902a5a1a0caa37ed505a12cfbd79ecc05abd56a
Opcode Fuzzy Hash: 45b07ed32337fb3dbd351a06c6c86db09922f1748a5c9275a47fb70b1538d830
Instruction Fuzzy Hash: B1F05431500606EBDB315B66CC88A573A996F04360B188B35F824E72E0EB38DC418E58

Function 00407B1B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

SHEmptyRecycleBinW.SHELL32(00000000,00000000,00000007), ref: 00407B32

Part of subcall function 00407BF3: CreateProcessA.KERNEL32(00000000,N{@,00000000,00000000,00000001,08000000,00000000,00000000,?,?,00421D14,00000005,00000000), ref: 00407C3B
Part of subcall function 00407BF3: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00407C4A
Part of subcall function 00407BF3: CloseHandle.KERNEL32(?), ref: 00407C59
Part of subcall function 00407BF3: CloseHandle.KERNEL32(?), ref: 00407C5E

Strings

qh, xrefs: 00407B56

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CloseHandle$CreateEmptyObjectProcessRecycleSingleWait
String ID: qh
API String ID: 1659798425-2990620207
Opcode ID: 7715a62e78af796fd858acc4f95130bc974a990ba16ee41ab78f6523a852c554
Instruction ID: 8d09433ba2d1a9f6e2244b7ea1d7eaaf22f07d0a05314b38e5cd17da18131808
Opcode Fuzzy Hash: 7715a62e78af796fd858acc4f95130bc974a990ba16ee41ab78f6523a852c554
Instruction Fuzzy Hash: 59114230E4424956CB04F7A2E996AAE73B5AF10308FD0807EA122374D2DF7CB947861D

Function 00406BDF Relevance: 3.2, APIs: 2, Instructions: 159networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00406C3A

Part of subcall function 00406E73: GetAdaptersInfo.IPHLPAPI(00000000,Kl@), ref: 00406EB9
Part of subcall function 00406E73: GetAdaptersInfo.IPHLPAPI(00000000,?), ref: 00406EDB

WSACleanup.WS2_32 ref: 00406E13

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: AdaptersInfo$CleanupStartup
String ID:
API String ID: 4133292115-0
Opcode ID: f9ab0c78f48735efb28e4188391033b2227e9628d5cf0de651d0311ea1b60fa4
Instruction ID: a2b91e85c692220888f9a1346afeb949dd52ac5f64f53f0e1e62066e5f1fea9b
Opcode Fuzzy Hash: f9ab0c78f48735efb28e4188391033b2227e9628d5cf0de651d0311ea1b60fa4
Instruction Fuzzy Hash: 77614E71D002599ACF25EFA5CD99ADDBB79AF50304F1041AEE40A772D2DB382F48CB54

Function 0040701F Relevance: 3.1, APIs: 2, Instructions: 139COMMON

Download Yara Rule

APIs

NetShareEnum.NETAPI32(?,00000001,?,000000FF,?,?,?,000000A4,00406D2A,00000000,00000000,?,?), ref: 004070A7
NetApiBufferFree.NETAPI32(?,?,00000001,?,000000FF,?,?,?,000000A4,00406D2A,00000000,00000000,?,?), ref: 00407207

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: BufferEnumFreeShare
String ID:
API String ID: 3936216747-0
Opcode ID: e0d5035b42e4e5dc49b7800c802dfe91851bad505c9907199385382959840fd5
Instruction ID: 185f767f73458d5ad9a2bd88df2eb37514c9d836e35de3db0b8c78774e816bd6
Opcode Fuzzy Hash: e0d5035b42e4e5dc49b7800c802dfe91851bad505c9907199385382959840fd5
Instruction Fuzzy Hash: 8C513770D00218DECB24EF65C955BDDBBB5AF15304F1045AEE149B3282DB786A88CF26

Function 00406AD8 Relevance: 3.1, APIs: 2, Instructions: 84shareCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00406AFA
WNetGetConnectionW.MPR(?,?,00000104), ref: 00406B47

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ConnectionDrivesLogical
String ID:
API String ID: 3607436926-0
Opcode ID: 8b38979cfcd875248828c931c2acb92cada02fc7fdf1c9a552620d2a1314bda5
Instruction ID: 04c2a7eed2985c86927b874bb82c484f348ad2d2af67d18314728e6ad1c2f156
Opcode Fuzzy Hash: 8b38979cfcd875248828c931c2acb92cada02fc7fdf1c9a552620d2a1314bda5
Instruction Fuzzy Hash: 63312CB5D002589ACF04EFE5D995ADDBBB9BF44304F10402FA116FB181EB785B49CB54

Function 00407EEE Relevance: 3.1, APIs: 2, Instructions: 65sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0040632E,006B46C8,00000000,00000000), ref: 00407FA1
Sleep.KERNEL32(000003E8), ref: 00407FB5

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 88f3a684a3058a04f944dabd84d4eb21f9e94e39210d9d2769da4d427a7a35cd
Instruction ID: fa1ec8ba2880eb64ee4f47be371e48410a73d217e3069869ab8118b29c78cad8
Opcode Fuzzy Hash: 88f3a684a3058a04f944dabd84d4eb21f9e94e39210d9d2769da4d427a7a35cd
Instruction Fuzzy Hash: FE218071A00205DBCB24DFA9D884AAEB775AF44308B50853FE4117B2E1CB386D45CB69

Function 0040C77F Relevance: 3.1, APIs: 2, Instructions: 51threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(?,?,Function_0000C623,00000000,00000000,?), ref: 0040C7C8
GetLastError.KERNEL32(?,?,?,00407E51,00000000,00000000,00408062,00000000,00000000), ref: 0040C7D4

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CreateErrorLastThread
String ID:
API String ID: 1689873465-0
Opcode ID: fa4bab5900a84ccf57fa56d1dd92a1be88b35596314f4e3decd56e4645994a03
Instruction ID: 0f50845c4e7e77578095a97242e40d33884bc8154f36fa63f823cb59a06df00d
Opcode Fuzzy Hash: fa4bab5900a84ccf57fa56d1dd92a1be88b35596314f4e3decd56e4645994a03
Instruction Fuzzy Hash: AA01807250020AEFCF259FA1DC85A9F7B65EF44364F10427AF801A3290DB39CA50DB98

Function 0040C623 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0041E820,0000000C), ref: 0040C636
ExitThread.KERNEL32 ref: 0040C63D

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: e182ffcfdf654baa82f34db88d48afd563eebb95c19cb4cdad54af4f31ff89a8
Instruction ID: 0354a2696fc4e5c6d7b83f5ce61e7d73321dfb03d31f2bd39b1d5e58a65da2bf
Opcode Fuzzy Hash: e182ffcfdf654baa82f34db88d48afd563eebb95c19cb4cdad54af4f31ff89a8
Instruction Fuzzy Hash: B9F0A4719402059FEB10BBB1C84AA6E3B65EF44715F20467EF405672D1CF395901CBA9

Function 0040EB52 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0040D4AB), ref: 0040EB68
GetLastError.KERNEL32(?,?,0040D4AB), ref: 0040EB7A

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4f3f5602332bd625fa2675d58c30e3f7d5c48d2b14ad73da589f26433f11286a
Instruction ID: 4112fd7f4ff0fc88d621af03ddd00792787b04bfbf653ed784134dc2ffe5c7db
Opcode Fuzzy Hash: 4f3f5602332bd625fa2675d58c30e3f7d5c48d2b14ad73da589f26433f11286a
Instruction Fuzzy Hash: 56E08631100204E7CB206FA5ED08BC63AA8AB14365F11453AF609A62A0DF399491CB8C

Function 00408062 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,000003E8,00000010), ref: 0040809C

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CompletionQueuedStatus
String ID:
API String ID: 2001429441-0
Opcode ID: 947ff703b3f31c33b5f7a48e10adef581a89ee3163eca7774fbd2a86bee8f1e1
Instruction ID: d329862fddceefebe991ff178448a6ad000ec0b8dce1c71f85e20e6ae3e47aec
Opcode Fuzzy Hash: 947ff703b3f31c33b5f7a48e10adef581a89ee3163eca7774fbd2a86bee8f1e1
Instruction Fuzzy Hash: D5018E74E012198ADB21DF92CA41AAFBBB8AB94704F11403FD940773D1CF385A49CA99

Function 0040EB8C Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,558B0000,558B0000,?,0040F60A,00000220,00411F76,558B0000,?,?,?,?,?,00000000,?,00411F76), ref: 0040EBBE

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ca048181448f7d21dd54210d8eab2afee9bac1ebef375b8a3c429a825628e006
Instruction ID: b7facbf5c38761f5a7ed24c713174148ff934a7a34e32cb603097956e229ef77
Opcode Fuzzy Hash: ca048181448f7d21dd54210d8eab2afee9bac1ebef375b8a3c429a825628e006
Instruction Fuzzy Hash: F7E0E531206225A7D730A7675C00B9B366C9F513A1F050577AE17B62D0CF7CEC1181EE

Non-executed Functions

Function 00407FC1 Relevance: 7.5, APIs: 5, Instructions: 49encryptionsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00421D14,00421D14,00000000,00406A47,00421CF0,00421D14), ref: 00407FDF
CloseHandle.KERNEL32(?), ref: 00407FE8
CloseHandle.KERNEL32(00421D14,00421D14,00000000,00406A47,00421CF0,00421D14), ref: 00408021
CryptDestroyKey.ADVAPI32(00688268), ref: 00408035
CryptReleaseContext.ADVAPI32(006A06E0,00000000), ref: 0040804C

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CloseCryptHandle$ContextDestroyObjectReleaseSingleWait
String ID:
API String ID: 3548849127-0
Opcode ID: 62a423d689bc1d810b422f7e51210a4feec9fb7764105c56fa2c9871c4bfb61b
Instruction ID: f923bc652f5d36d1a7cf597a93f8dfd2463e5238f4859bf282c34785c20796a3
Opcode Fuzzy Hash: 62a423d689bc1d810b422f7e51210a4feec9fb7764105c56fa2c9871c4bfb61b
Instruction Fuzzy Hash: 0C016576680510CBCB319F9AEDC44867765B768320396413AE950A7771CF357C46CBAC

Function 00408D50 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00408D5C
IsDebuggerPresent.KERNEL32(?,?,?,?,00000017), ref: 00408E27
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,00000017), ref: 00408E47
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,00000017), ref: 00408E51

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 8290532614a895ab1a4e0fd3e79fe890af91ee098fb1c1b9b0fe8b2def0a8d97
Instruction ID: 3733e80c9bfb104d9045c5cc053eb7f60354eaef85a31c8ef6c46e5b6c705bee
Opcode Fuzzy Hash: 8290532614a895ab1a4e0fd3e79fe890af91ee098fb1c1b9b0fe8b2def0a8d97
Instruction Fuzzy Hash: 29313875D4521C9BDF20DFA4D9897CDBBB8AF08304F1041EEE44CAB290EB755A858F49

Function 0040844D Relevance: 6.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0040856C,00418438,00000017), ref: 00408452
UnhandledExceptionFilter.KERNEL32(00418438,?,0040856C,00418438,00000017), ref: 0040845B
GetCurrentProcess.KERNEL32(C0000409,?,0040856C,00418438,00000017), ref: 00408466
TerminateProcess.KERNEL32(00000000,?,0040856C,00418438,00000017), ref: 0040846D

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: cecb9d8ce340af2380c26f4f64f701147826d6994aebbf50b8265f08f392b2b4
Instruction ID: a9c8dd523535ae76bea79cb7d1df670e68314ff5a95e338fc213765a0490825c
Opcode Fuzzy Hash: cecb9d8ce340af2380c26f4f64f701147826d6994aebbf50b8265f08f392b2b4
Instruction Fuzzy Hash: E2D00272044208FBDA402FE1ED0DACD7F28EB09656F01C828FB0A86461DF7155568B79

Function 0040BB67 Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0040BC5F
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0040BC69
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0040BC76

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 65b637fde7c76a34f57f66bbd6548a38e7c3a7187157376f4380a818f6e6de29
Instruction ID: d8637dcbbfeaa9fb55782e1d7f7d8a4bf25dd961bcdd0e72954237f3addae9ee
Opcode Fuzzy Hash: 65b637fde7c76a34f57f66bbd6548a38e7c3a7187157376f4380a818f6e6de29
Instruction Fuzzy Hash: B431D47590121CABCB21DF64D9887CDBBB8FF48310F5041EAE40CA7291EB749B858F48

Function 0040CBBD Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0040CBBC,?,?,?,?), ref: 0040CBDF
TerminateProcess.KERNEL32(00000000,?,0040CBBC,?,?,?,?), ref: 0040CBE6
ExitProcess.KERNEL32 ref: 0040CBF8

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 674c5ebb9f06a32f81ca303b0a4cab4ca5e0e5b284770b9206d5160ae2afc515
Instruction ID: 9d05e2f9abed931e6b5b4a921989a9dac46c3b6869317a37241c3ffabaeb4651
Opcode Fuzzy Hash: 674c5ebb9f06a32f81ca303b0a4cab4ca5e0e5b284770b9206d5160ae2afc515
Instruction Fuzzy Hash: C3E0B631004148EBCB116B99EC4AD9A3F79EB45741B018939F805AA271CF39ED92DA98

Function 00405A73 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45encryptionCOMMON

Download Yara Rule

APIs

CryptGenRandom.ADVAPI32(?,?,|Y@,00000000,?,?,?,?,?,?,?,0040597C,?,00000020), ref: 00405AAB

Strings

|Y@, xrefs: 00405A88

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CryptRandom
String ID: |Y@
API String ID: 2662593985-3205492651
Opcode ID: a47090f37fd7bdf2614c435aac3c33f7c399d4379d8e60a673ff4437914ac0a2
Instruction ID: 86fd1dcebb5f312e7d1ecf3e17a404640b4cf937824d2c17441eb1bd1a18a6fb
Opcode Fuzzy Hash: a47090f37fd7bdf2614c435aac3c33f7c399d4379d8e60a673ff4437914ac0a2
Instruction Fuzzy Hash: 93111E70A002499FCF10EFA9D8419AEBBF8FF08304B50452EE452B3251DB78A649DB65

Function 0041477D Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00414778,?,?,00000008,?,?,00414410,00000000), ref: 004149AA

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 099c7a9ec455bcd043775184cb1cef37cd6218db26a1b190ddf3ce0f13d98dcf
Instruction ID: 7214edff692341464da4094d7490ff8a688fb6b2bb3766659c75d587a5c09c37
Opcode Fuzzy Hash: 099c7a9ec455bcd043775184cb1cef37cd6218db26a1b190ddf3ce0f13d98dcf
Instruction Fuzzy Hash: 5DB17E35610609DFD714CF28C486BA67BE0FF85364F258659E899CF3A1C339E992CB48

Function 00408B70 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00408B86

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 836a11765e969a4e519fe6736428d947d2af6d0dee6f8e907429874508829bf0
Instruction ID: ba3c99d159c395115ab479448cf9ca1c79d951b2702fedbf06fb51af3e9748c8
Opcode Fuzzy Hash: 836a11765e969a4e519fe6736428d947d2af6d0dee6f8e907429874508829bf0
Instruction Fuzzy Hash: FB51AEB1A01605CBEB24CF55E9807AABBF1FB54344F54843AC445EB391D7B8A901CF68

Function 0040EF8C Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7962ca8b015567138a52131238553399348c6382ac4db784cfc714aed7707061
Instruction ID: 6f13e5c4fa8f4fd48feb9d95b154797251ebc16cc3cf820be49c3d245c057600
Opcode Fuzzy Hash: 7962ca8b015567138a52131238553399348c6382ac4db784cfc714aed7707061
Instruction Fuzzy Hash: 6E312772900219BFCB24DF69CC89DABB7B9EB84310F00457DF805A7281EA34ED45CB58

Function 00405AF7 Relevance: 1.5, APIs: 1, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptEncrypt.ADVAPI32(00688268,00000000,00000001,00000000,00000000,?,00000000,?,00405B38,?,00000054,00404D98,000000C4,004080BD), ref: 00405B0D

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CryptEncrypt
String ID:
API String ID: 1352496322-0
Opcode ID: 236b3dc9e2f56face884e5180bb740f453a05034f71cc3f1d2a4f2213f3f0c13
Instruction ID: 2b44251993a801e805e905e4d4f6d68a53ef747dc766a343b9b7c358835eafe0
Opcode Fuzzy Hash: 236b3dc9e2f56face884e5180bb740f453a05034f71cc3f1d2a4f2213f3f0c13
Instruction Fuzzy Hash: 85D09EB116020CBEEB00CF65DC41DF73BFDDBC8B55F00C129B909CA140D675E98446A0

Function 00408EE6 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008EF2,004089C0), ref: 00408EEB

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0bd35452872d9d3562040c8dd8269200b0f237bfc229692d44af4e21d06e9328
Instruction ID: 3b947aedefdf64a4b476a76d7939ae1b97f249de08cdb2c3085f312e010bcb4a
Opcode Fuzzy Hash: 0bd35452872d9d3562040c8dd8269200b0f237bfc229692d44af4e21d06e9328
Instruction Fuzzy Hash:

Function 0040E970 Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0040E976, 0040E980

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: 6e998245c995db8eccc7936cb85cfba3c1278b45d41cbdf6068c7e2b78ef1216
Instruction ID: c497f5231ae6e4eb61b25aa65637f3989249af34b4a118f0e7ee121b49cb238f
Opcode Fuzzy Hash: 6e998245c995db8eccc7936cb85cfba3c1278b45d41cbdf6068c7e2b78ef1216
Instruction Fuzzy Hash: 89E0CD3268232477C21136D26D06BEBBE04CF50B71F144073F94466181C979087181DE

Function 00404687 Relevance: .5, Instructions: 476COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4939659ab8864d1fba7261b6d098f0134da8801dc2c4c21729b05d8ea5d03ea
Instruction ID: 40b165ad0c27c9e55eb6b9598aec947e4a87c7c6249b9d8e95cf805f3e8efdf6
Opcode Fuzzy Hash: a4939659ab8864d1fba7261b6d098f0134da8801dc2c4c21729b05d8ea5d03ea
Instruction Fuzzy Hash: 4422A3B4E002189FDB64CFA9C981B9DBBF5BF48304F1181AAE509EB342D674A941CF54

Function 00416820 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: bacae71bfdd28d244d2ddcd6e98663a7135bc2764c6ce56f6a2dbc26a57acf78
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: F3113DB724314243E618AE3EC5F46F7A39AEBC532172F437BD0414B754D22AD9C5960C

Function 00405C99 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49b86db3c68bc113c4b2784d59ac3fc5b975b37b80b7786c9c46cfd51c70cc43
Instruction ID: da2b7094b807793d2f9e07098b90cf6b269fcb8ab5a46448bfff6a4ce4441fc5
Opcode Fuzzy Hash: 49b86db3c68bc113c4b2784d59ac3fc5b975b37b80b7786c9c46cfd51c70cc43
Instruction Fuzzy Hash: 60219031A00608EFDB14DF5CC88069EBBF9EF48314F2445AAE415EB392D7B5EA418F94

Function 0040EC37 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ceabb2baae720b713b4a25f9454755192dd3cbcbbe3204b9d1f0e0ec916376
Instruction ID: 8cb64879af241f54775de70efdb66e8ff4a61c9f6b6dedbd973823c6a282e455
Opcode Fuzzy Hash: 84ceabb2baae720b713b4a25f9454755192dd3cbcbbe3204b9d1f0e0ec916376
Instruction Fuzzy Hash: 22F0A072615224DBCB22D749C809A4A73A8EB05B91F114467F041E7290C274DD40C7C4

Function 0040EC7B Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee18f16b814753967f93bcba19a251b99a345edb89de6dffe9b7eb5ae087f712
Instruction ID: 585bae6c8e8552c4e60c2b29e61369cb6673ffc4e6fed7c3ca97c357fa10d136
Opcode Fuzzy Hash: ee18f16b814753967f93bcba19a251b99a345edb89de6dffe9b7eb5ae087f712
Instruction Fuzzy Hash: 83E08C32915238EBCB18DB8EC90498AF3ECFB44B08B5508ABF511E3241C278DE00D7D4

Function 00405211 Relevance: 18.2, APIs: 12, Instructions: 200fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 0040524A
GetFileSizeEx.KERNEL32(00000000,00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 00405269
CloseHandle.KERNEL32(00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 00405297
SetFilePointerEx.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000004,00000000,0000001E,0000001E), ref: 00405306
ReadFile.KERNEL32(00000000,?,?,0000001E,00000000), ref: 0040532E
SetFilePointerEx.KERNEL32(00000000,C0000000,C0000000,0000001E,00000000), ref: 0040534B
WriteFile.KERNEL32(00000000,?,?,00000008,00000000), ref: 0040537E
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002), ref: 004053C0
WriteFile.KERNEL32(00000000,00000070,?,00000000,00000000), ref: 004053E7
WriteFile.KERNEL32(00000000,00000000,00000018,00000000,00000000), ref: 00405430
CloseHandle.KERNEL32(00000000), ref: 00405442
CloseHandle.KERNEL32(00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 00405461

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: File$CloseHandlePointerWrite$CreateReadSize
String ID:
API String ID: 4172884140-0
Opcode ID: b84b333d6cc0bbb4b8095840656ec3137fa0b2d047b74cb1db7be4b711a9b34d
Instruction ID: ee9ae1be1be93fa85468bf4649c70c4e2e95fb3ec1bd1597241f6b7793f2c74e
Opcode Fuzzy Hash: b84b333d6cc0bbb4b8095840656ec3137fa0b2d047b74cb1db7be4b711a9b34d
Instruction Fuzzy Hash: B47126B0108704AFD714DF25C884AABBBE8FF89345F40892EF495A2290DB74D945CF6A

Function 0040547B Relevance: 18.2, APIs: 12, Instructions: 197fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 004054B4
GetFileSizeEx.KERNEL32(00000000,00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 004054D3
CloseHandle.KERNEL32(00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 004054F5
SetFilePointerEx.KERNEL32(00000000,?,?,C0000000,00000001,00A00000,?,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 00405572
ReadFile.KERNEL32(00000000,?,?,?,00000000), ref: 0040559A
SetFilePointerEx.KERNEL32(00000000,?,?,?,00000000), ref: 004055B7
WriteFile.KERNEL32(00000000,?,?,00000008,00000000), ref: 004055EA
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,C0000000,00000002,00A00000,?,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 00405645
WriteFile.KERNEL32(00000000,00000070,?,00000010,00000000,?,?,C0000000,00000000,00000000,00000003,00000080), ref: 0040566C
WriteFile.KERNEL32(?,?,00000000,?), ref: 004056B1
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 004056C3
CloseHandle.KERNEL32(00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 004056E2

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: File$CloseHandlePointerWrite$CreateReadSize
String ID:
API String ID: 4172884140-0
Opcode ID: c0aa7dad1b87425837c6b60f77dac825fa8e6985262c4706b32e699243812658
Instruction ID: a209c7a7d36fe76a9e07e4dc1c0380abd0a229f5866664ed29d724590fb8884a
Opcode Fuzzy Hash: c0aa7dad1b87425837c6b60f77dac825fa8e6985262c4706b32e699243812658
Instruction Fuzzy Hash: 3A713771509B05AFD310DF25C884A6BBBE8FF89304F908D2EF595A22A0D735D905CF6A

Function 00407C6D Relevance: 16.6, APIs: 11, Instructions: 124memoryservicesleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407CA7
EnumDependentServicesW.ADVAPI32(?,00000001,00000000,00000000,0041E4B0,?), ref: 00407CBD
GetLastError.KERNEL32(?,00000001,00000000,00000000,0041E4B0,?), ref: 00407CCB
GetProcessHeap.KERNEL32(?,00000001,00000000,00000000,0041E4B0,?), ref: 00407CDF
HeapAlloc.KERNEL32(00000000,00000008,0041E4B0,?,00000001,00000000,00000000,0041E4B0,?), ref: 00407CE9
EnumDependentServicesW.ADVAPI32(?,00000001,00000000,0041E4B0,0041E4B0,?,?,00000001,00000000,00000000,0041E4B0,?), ref: 00407D12
OpenServiceW.ADVAPI32(?,?,00000024,?,00000001,00000000,00000000,0041E4B0,?), ref: 00407D49
ControlService.ADVAPI32(00000000,00000001,0000007C,?,00000001,00000000,00000000,0041E4B0,?), ref: 00407D64
Sleep.KERNEL32(000003E8,?,00000001,00000000,00000000,0041E4B0,?), ref: 00407D78
QueryServiceStatusEx.ADVAPI32(00000000,00000000,0000007C,00000024,0041E4B0,?,00000001,00000000,00000000,0041E4B0,?), ref: 00407D8A
GetTickCount.KERNEL32 ref: 00407D99

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: Service$CountDependentEnumHeapServicesTick$AllocControlErrorLastOpenProcessQuerySleepStatus
String ID:
API String ID: 2237175040-0
Opcode ID: d81147e30e44270e36fb8d0151e64aee969b515f745b94df6807969a741fc98c
Instruction ID: e1ca83a1ae3df4190ba0755104e57d6667b22fc9ae0cb5adf004e78e3605c6f1
Opcode Fuzzy Hash: d81147e30e44270e36fb8d0151e64aee969b515f745b94df6807969a741fc98c
Instruction Fuzzy Hash: 2F412672D0421CAFDB118FA5DC84AEEBBB9FF48710F11812AE505F7290DB34AE458B55

Function 0040E6A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 0040E6FE
ext-ms-, xrefs: 0040E712

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 21116466f905e018a0a81aebae1a94e8756d5b1ed64afbb567eef5e098827508
Instruction ID: d2046308dc455944ddc84991a8e0bba08bce8675fbea5ced70bae3defb83b6e1
Opcode Fuzzy Hash: 21116466f905e018a0a81aebae1a94e8756d5b1ed64afbb567eef5e098827508
Instruction Fuzzy Hash: B821C332A02220BBCB219B36DC84A5B37589F117A0B650936ED15B73D0DB78ED11C6E9

Function 00404F22 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,000000FF,.dice,0041D504,?,0000005C,00404D76,000000C4), ref: 00404FAD
SetFilePointerEx.KERNEL32(00000000,-000000E8,00000000,?,00000002,?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,000000FF,.dice), ref: 00404FE9
ReadFile.KERNEL32(00000000,?,00000018,?,00000000,?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,000000FF,.dice), ref: 00405002
CloseHandle.KERNEL32(00000000,?,80000000,00000000,00000000,00000003,00000080,00000000,?,00000000,000000FF,.dice,0041D504,?,0000005C,00404D76), ref: 0040501F

Strings

.dice, xrefs: 00404F51

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID: .dice
API String ID: 4133201480-949574448
Opcode ID: c74fbe09781cf0656f9b7cf150a49cceaca52e99d28afa80be9917f324ec7134
Instruction ID: 7d5cc8a6836f154c00e799939dc7c7741736329e282a3bee7e9aba25a82a9b05
Opcode Fuzzy Hash: c74fbe09781cf0656f9b7cf150a49cceaca52e99d28afa80be9917f324ec7134
Instruction Fuzzy Hash: 8131A470A006189FDB149FA58C81AEE7BB8FB49314F10463EF811772C1DB785E458AA8

Function 0040B6B2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,0040B773,?,?,00421544,00000000,?,0040B89E,00000004,InitializeCriticalSectionEx,00418F0C,InitializeCriticalSectionEx,00000000), ref: 0040B742

Strings

api-ms-, xrefs: 0040B702

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 9c49c62ff1ebed205da28c723352345382896da9073c2b9c193734e2ef001c53
Instruction ID: 6bafeb1e3b1dc6002c2653febfb85d5ce16f416881a4390232d7d8dc30647c6b
Opcode Fuzzy Hash: 9c49c62ff1ebed205da28c723352345382896da9073c2b9c193734e2ef001c53
Instruction Fuzzy Hash: F511C636A01324ABDB224B689C44BAA37A4DF517B0F250136E915F73C0EB78ED0186DE

Function 0040CBFF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0040CBF4,?,?,0040CBBC,?,?,?), ref: 0040CC14
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040CC27
FreeLibrary.KERNEL32(00000000,?,?,0040CBF4,?,?,0040CBBC,?,?,?), ref: 0040CC4A

Strings

CorExitProcess, xrefs: 0040CC1F
mscoree.dll, xrefs: 0040CC0D

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5fa9a2eecd4c7095db86937e1d44b92379b06b6f0115495b2e55f1bce8dcdd89
Instruction ID: 38f9631645d9a32963094c4d1c9682187196cac357794a754209273f80aec4a5
Opcode Fuzzy Hash: 5fa9a2eecd4c7095db86937e1d44b92379b06b6f0115495b2e55f1bce8dcdd89
Instruction Fuzzy Hash: B2F08231941219FBEB119B51DD09BDEBB74EB00756F108175E905B21A0CB748E41DA98

Function 004056FC Relevance: 7.6, APIs: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 00405736
GetFileSizeEx.KERNEL32(00000000,00000000,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 00405755
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 0040579A
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004057E6
CloseHandle.KERNEL32(00000000,?,?,C0000000,00000000,00000000,00000003,00000080,00000000,00000008), ref: 0040580B

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: File$CloseCreateHandlePointerSizeWrite
String ID:
API String ID: 1886887421-0
Opcode ID: fdea06a62feb463cacb23d2a74cc297f17a7883ce37bcbb8f5ca8cc564f7ed26
Instruction ID: 067cbd4b4ad597bfafddf44ff4bf81fcb18abd3b5b986d502403e19a10b8fa51
Opcode Fuzzy Hash: fdea06a62feb463cacb23d2a74cc297f17a7883ce37bcbb8f5ca8cc564f7ed26
Instruction Fuzzy Hash: 46316A71508745EFD310DF24D88096BB7E8FF89748F008A3EF891A2290D7349905CFAA

Function 00402980 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000160,?,0000006C,004024AB,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000064,0040692B), ref: 004029B8
LoadStringW.USER32(00000000,0000006C,?,?), ref: 004029C3

Strings

+i@, xrefs: 004029D6, 004029E2, 00402A1F, 00402A48, 00402A51, 00402A22, 00402A4B
\r\n, xrefs: 00402A02

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: HandleLoadModuleString
String ID: +i@$\r\n
API String ID: 3590730445-2393078228
Opcode ID: 3d8a992bd709f93514d668571647ba917c8ea071aa15e2c37ee6354f46828761
Instruction ID: 3c3aaae91af2667d32ccaae650fe5dccb8714c180c5d1a68aad68bc9fba81b3a
Opcode Fuzzy Hash: 3d8a992bd709f93514d668571647ba917c8ea071aa15e2c37ee6354f46828761
Instruction Fuzzy Hash: 9C210C71D04248DBDB04EFF5C9859DEBBB8AF18304F60812EE501B7192DB78AB49CB64

Function 00411F1A Relevance: 6.3, APIs: 4, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00000000,00000000), ref: 00411F62
WriteFile.KERNEL32(?,00000020,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004121A6
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004121E6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00412292

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLast
String ID:
API String ID: 765721374-0
Opcode ID: 75a421ef55b878e6d966565cd1e9243600f26fa8670671f1c4d584a8868433f4
Instruction ID: ae42c93534a235c1ecb94d76ebe842fa47c9e955f09c005fe5b6a5fe2fe00b3c
Opcode Fuzzy Hash: 75a421ef55b878e6d966565cd1e9243600f26fa8670671f1c4d584a8868433f4
Instruction Fuzzy Hash: B4D1AC71D002589FCF15CFE8C9809EDBBB5BF49304F2841AAE815F7341D674A996CB58

Function 00408FB1 Relevance: 6.0, APIs: 4, Instructions: 25timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00408FC3
GetCurrentThreadId.KERNEL32 ref: 00408FD2
GetCurrentProcessId.KERNEL32 ref: 00408FDB
QueryPerformanceCounter.KERNEL32(?), ref: 00408FE8

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 64cb90e1cbd1ac958c0752589e50e0d393bc9288ac9b10562f9274fa9149ddbc
Instruction ID: fb8af08e47802c25385064c10c517c35d014f6503ac724d53b53e658491f04fe
Opcode Fuzzy Hash: 64cb90e1cbd1ac958c0752589e50e0d393bc9288ac9b10562f9274fa9149ddbc
Instruction Fuzzy Hash: CDF0AF71C10208EBCB00DBB0C989ADEBBF8EF08205F6188A99402E7210DB34AB058B54

Function 0040AD03 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040AD28

Strings

MOC, xrefs: 0040AD3A
RCC, xrefs: 0040AD42

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: bd070c95e6e46396ecf155ef6fbd64b2a7d6f5b028d601cba5ff6745476b8f9c
Instruction ID: 92de23eecfb16cb5642a8b2457551096ae25d008cc63af46b4e66d456b0455f5
Opcode Fuzzy Hash: bd070c95e6e46396ecf155ef6fbd64b2a7d6f5b028d601cba5ff6745476b8f9c
Instruction Fuzzy Hash: B7418B72900209EFCF15DF94CC85AEE7BB6BF48304F18816AF90477292D3399960DB96

Function 00402BA2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000006,?,00000054,004024C6,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000064), ref: 00402BDA
LoadStringW.USER32(00000000,0000006E,?,?), ref: 00402BE5

Part of subcall function 00401F75: MultiByteToWideChar.KERNEL32(00000000,00000008,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00401FAD
Part of subcall function 00401F75: MultiByteToWideChar.KERNEL32(00000000,00000008,?,00000000,?,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00401FE1

Strings

+i@, xrefs: 00402BF8, 00402C04

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: ByteCharMultiWide$HandleLoadModuleString
String ID: +i@
API String ID: 4068035459-163242349
Opcode ID: 82703355d72557536135698c29cb8b0d8f027b8d23a399e87fd8e40911b1595e
Instruction ID: 1b52a50eb46ce485ab4515c3c6e3b79a2b4f7ed0e36262cdb80514f473bb5c5b
Opcode Fuzzy Hash: 82703355d72557536135698c29cb8b0d8f027b8d23a399e87fd8e40911b1595e
Instruction Fuzzy Hash: B0113071D002089BCB04EFE9D9569DE7779BF18309F50803DF116B7191DB786A09CB64

Function 004024FA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000171,?,0000003C,004023A0,00000064,0040692B), ref: 00402532
LoadStringW.USER32(00000000,00000065,?,?), ref: 0040253D

Strings

+i@, xrefs: 00402550, 0040255D

Memory Dump Source

Source File: 00000000.00000002.115418531270.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.115418465226.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418616936.0000000000418000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418688257.0000000000420000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.115418754834.0000000000422000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2005.jbxd

Similarity

API ID: HandleLoadModuleString
String ID: +i@
API String ID: 3590730445-163242349
Opcode ID: 75bbae711470bb59a3e5b7c94e6c359bf5841ef2ee5ddc45bff1927790ca1565
Instruction ID: f7cb58a48d2bee32aa8de5465bd50b1dc8174d6a757b49464141c58b22c21c77
Opcode Fuzzy Hash: 75bbae711470bb59a3e5b7c94e6c359bf5841ef2ee5ddc45bff1927790ca1565
Instruction Fuzzy Hash: 34112BB2E002089FDB04EFE9D98A9DE7B78BF18305F50843DE115B7191DA74AA49CB64

Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_0040586B CryptStringToBinaryA,GetProcessHeap,HeapAlloc,CryptStringToBinaryA,CryptImportKey,GetProcessHeap,HeapFree,	0_2_0040586B
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00405B1C CryptEncrypt,CryptEncrypt,CryptEncrypt,	0_2_00405B1C
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00404C82 CryptAcquireContextW,GetLastError,CryptAcquireContextW,	0_2_00404C82
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00405A73 CryptGenRandom,	0_2_00405A73
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00405AF7 CryptEncrypt,	0_2_00405AF7
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00405C99 CryptEncrypt,	0_2_00405C99
Source: C:\Users\user\Desktop\2005.exe	Code function: 0_2_00407FC1 CloseHandle,WaitForSingleObject,CloseHandle,CloseHandle,CryptDestroyKey,CryptReleaseContext,	0_2_00407FC1

Source: C:\Users\user\Desktop\2005.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: d:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\2005.exe	File opened: a:	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 23.219.82.74
Source: unknown	TCP traffic detected without corresponding DNS query: 23.44.201.15
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.121.28
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.121.28
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 52.111.227.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.111.227.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.111.227.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.111.227.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.111.227.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.111.227.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.111.227.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.111.227.14
Source: unknown	TCP traffic detected without corresponding DNS query: 52.111.227.14

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2005.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Default\NTUSER.DAT

C:\Users\Default\NTUSER.DAT.dice (copy)

C:\Users\Default\readme.txt

C:\Users\Dylan\Desktop\Excel.lnk

C:\Users\Dylan\Desktop\Excel.lnk.dice (copy)

C:\Users\Dylan\Desktop\PowerPoint.lnk

C:\Users\Dylan\Desktop\PowerPoint.lnk.dice (copy)

C:\Users\Dylan\Desktop\Word.lnk

C:\Users\Dylan\Desktop\Word.lnk.dice (copy)

C:\Users\Dylan\Desktop\readme.txt

C:\Users\Dylan\Favorites\Bing.url

C:\Users\Dylan\Favorites\Bing.url.dice (copy)

C:\Users\Dylan\Favorites\readme.txt

C:\Users\Dylan\Links\Desktop.lnk

C:\Users\Dylan\Links\Desktop.lnk.dice (copy)

C:\Users\Dylan\Links\Downloads.lnk

C:\Users\Dylan\Links\Downloads.lnk.dice (copy)

Windows Analysis Report
2005.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre